8248d1eee1276a231b1a3f54cd6b8d4aed1a6456ff95417c2dc4b6ea5545a9ee

Analysis

max time kernel
150s
max time network
158s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_c7047e2eab30f75d0fb3871e1873ba06_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
Size 1.0MB
Sample260908-phvnhszdpg
SHA256 8248d1eee1276a231b1a3f54cd6b8d4aed1a6456ff95417c2dc4b6ea5545a9ee
MD5 c7047e2eab30f75d0fb3871e1873ba06
SHA1 c50b1590324dd6bca2604f3f5368a4afd279f358
SHA512 d861d76a8895ac9bc437605d270aa94a37aa09eedc92dc9269775dad7a99c23096787759d9fa88bfa4df9943bd3589642a8a1ea4935ca4196d158d83cfd04878
SSDEEP 24576:UOQvxuWxr5E2Xa9vODdagI3KnAoIBlEq1tIgAWz5foj3Z:9Qv8Wxreu2g+KnAX1tIc5foj3
TLSH
T12735E111B788E036C26221744B67E7B9AABDFD705B3542C373942F7E2E311C15939B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5080	elevation_service.exe
4336	elevation_service.exe
2680	maintenanceservice.exe
5956	OSE.EXE
3596	PerceptionSimulationService.exe
3008	perfhost.exe
3528	ReFsDedupSvc.exe
5428	SensorDataService.exe
3240	ssh-agent.exe
1696	AgentService.exe
4412	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-08_c7047e2eab30f75d0fb3871e1873ba06_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-08_c7047e2eab30f75d0fb3871e1873ba06_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-08_c7047e2eab30f75d0fb3871e1873ba06_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b07501dfe62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-08_c7047e2eab30f75d0fb3871e1873ba06_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-08_c7047e2eab30f75d0fb3871e1873ba06_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_c7047e2eab30f75d0fb3871e1873ba06_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007021647c8c3fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000252de57c8c3fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c77bccbd8c3fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c094a87d8c3fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c9b221808c3fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005eb261be8c3fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009e3737be8c3fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000861646be8c3fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5080	elevation_service.exe
5080	elevation_service.exe
5080	elevation_service.exe
5080	elevation_service.exe
5080	elevation_service.exe
5080	elevation_service.exe
5080	elevation_service.exe
4336	elevation_service.exe
4336	elevation_service.exe
4336	elevation_service.exe
4336	elevation_service.exe
4336	elevation_service.exe
4336	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3552	2026-09-08_c7047e2eab30f75d0fb3871e1873ba06_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
Token: SeTakeOwnershipPrivilege	5080	elevation_service.exe
Token: SeBackupPrivilege	3528	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3528	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3528	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3528	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3528	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3528	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3528	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3528	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3528	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3528	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1696	AgentService.exe
Token: 33	4412	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4412	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4412	SearchIndexer.exe
Token: SeDebugPrivilege	5080	elevation_service.exe
Token: SeDebugPrivilege	4336	elevation_service.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3552	2026-09-08_c7047e2eab30f75d0fb3871e1873ba06_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
3552	2026-09-08_c7047e2eab30f75d0fb3871e1873ba06_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
3552	2026-09-08_c7047e2eab30f75d0fb3871e1873ba06_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 3452	4412	SearchIndexer.exe	100
PID 4412 wrote to memory of 912	4412	SearchIndexer.exe	101
PID 4412 wrote to memory of 2016	4412	SearchIndexer.exe	102
PID 4412 wrote to memory of 5408	4412	SearchIndexer.exe	103
PID 4412 wrote to memory of 4668	4412	SearchIndexer.exe	107
PID 4412 wrote to memory of 1740	4412	SearchIndexer.exe	108
PID 4412 wrote to memory of 4216	4412	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-09-08_c7047e2eab30f75d0fb3871e1873ba06_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_c7047e2eab30f75d0fb3871e1873ba06_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3552

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5080

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4336

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2680

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5956

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3596

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3008

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3528

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5428

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3240

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1696

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3452
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:912
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2016
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2980 3004 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5408
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4668
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1740
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2980 3004 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3ed2e36d027d5aa5e0d9399014b055b9d9f62108676654f26eca7871e35214a9
MD5 ecc05dd6824a442f66816347da22b1b1
SHA1 4adc127ab08c8181e5ba81527fb85dce7f30ab97
SHA512 42fb42b5ddc7dc33f375f5ac3051d9392f1587dc14294a6f6fd8607bb0acd0b78a2690eecd05bc60991edf0a6f6e21bc76a87407a44d4ce6721be7be52d0438b
SSDEEP 49152:Jb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnfKnAX1tIc5foj3:f3q6sjBs0Okc5g
TLSH
T103D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 f14b64c65cd65a24da5122e9c6cf108c0bc1c0c3d59ffde0d850aad78eafedfd
MD5 a9a75366c0eea593b90787324df9faa2
SHA1 e6396d95b34343e5e46849e43e63ed1974521465
SHA512 ea5c1583ff02026a2027a31e7dc17e993ad24ca646e05ee2151c979cfbf6b0b2002623ee27068541c0b00afd8c2c3eb4e7a9c02bfe2d4ffcbb6e3eacb585156f
SSDEEP 24576:DXYfDtczAa3KnAoIBlEq1tIgAWz5foj3Z:GtcFKnAX1tIc5foj3
TLSH
T19805012477E408FDED678238C9B28506EA33B8514770E69B03B499266F377D81D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 6f4ad15e4f7d517d6eed43c8598876dcf1b0d0481c81e1d9367c1ea5914e30b0
MD5 32e581b380c8b5ae64f10506f2edab2b
SHA1 1ca3983982da999960ead435c7a0b4891f307bd8
SHA512 e527f4eec2c2d8016bdf639846fba4736d3521f385c0ad2f58a6a18d41d69581c18da84c00aefdbffd0b12aa9a403df83f4b8c2e723e3d0ef959d816c861b9b7
SSDEEP 24576:20Le5ji0hmxxrMX3KnAoIBlEq1tIgAWz5foj3Z:2Pji0AjiKnAX1tIc5foj3
TLSH
T101359E26F6788335D073C0B9C5D2A68EED7130825B3089CB4296D77C7E67AE6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d0d1eab30c70f47eaf72cd93042a8231ba02cfb32cb0dbe133d9c866bb160ad9
MD5 359d8429a255f2593b9268779a4f7d36
SHA1 ebd63539269750d15ea24f638e99d999698985f6
SHA512 84e1ed813243316e8f4adadad7264fbe4e9b9384cb0205890aed0e44298d673def834d1d1c00bbc220f49d49cec90087fe25d59d5fdccb24e178f06690f9022d
SSDEEP 24576:Sa7/ezSC6vUyD/aqgrvWn6q8wyul3KnAoIBlEq1tIgAWz5foj3Z:1/ezSC6vUzPveHjy+KnAX1tIc5foj3
TLSH
T16F756D25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6b1c5b9f11cacc07b5f4f6afb7f3d90fff06d406ea12c8ff317e89d29b69106b
MD5 553e61cc2dd2fe31e8a32799b558072b
SHA1 5afd02f398b8cae11e456a5b6fc169582feb5c4d
SHA512 89b354704f40ee4e6ff427d6ba2aa3871b76398bd9beaf78ac79bc5f62a96d873dbbf4d61c6e8061062f609c1099b982cf4533d3bc608fb2a6f53038672e71bf
SSDEEP 24576:kVbqPb88hv/l+Ye3KnAoIBlEq1tIgAWz5foj3Z:kVO88hXl+tKnAX1tIc5foj3
TLSH
T180559E66F5748331D073C0BAC5D2AA9AEE3234414B318ACB1246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 0c993a25bb319f8fcff7fd0a6877b9021a02f79bad3fa0023fc5a8ff15e7a871
MD5 3afedd247b43e01f920daf0b78d60628
SHA1 65931c36b5d3ab0897bc28d2096b917ba7158632
SHA512 226bda92a13bb9135492998b1e70e941130b6b2d197aef861cfbc042de11395217093c93f18f36a2f827bcd08373440014ad277582f3ca12989ce3bd41a0b994
SSDEEP 12288:iLZZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:iLb3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T194C423217B5C182EE7674631A2F6684AFD75DD70453A48232036FD07B63DDA0A83F27A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 faaa9f1e2c1ff37442cd2c7cfbee0c6f3f392636fc652a8a1452a7d2677c9e65
MD5 75d8fbde0db59b125adc9a20eb2ec0a9
SHA1 801d15cdee1b0233a309d9c99ec9caae9d8209bc
SHA512 a07c8f432ea276437c1bf446ec33844d8dc46b8043019417cee8da1982a78e07d016698f31da2e8cf16c49227332215d55698dac7ef3bc8ebc7d6ced1e507db5
SSDEEP 12288:FeBNUbTVO86UsZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:FJIUm3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T10605CF37AE28FCE2C27A8D7957918640EB7278304B6293CBD175C20EDE275E05D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8073c6d4e2e9a672a38abdb23c71d41711d23cf571121b15525cc159b23cbf69
MD5 dfbd96dfb6354cc8e3dca437e4c959d1
SHA1 bbb368c5d7c58a18bc87501d1aef75bf779d671d
SHA512 9e48cf3aa83d2169b6228abeecca74d7caf4dcf7fabc713950cbe152e263c24b19083db85a7c1fab5a629114e1a5be870bd5200e5b64dc2a2c8ea434ddcb026f
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THJ:XQvGAdlCEL8c/DRNw5Cl0Okc5g
TLSH
T16F266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 330112e4c6ec7161ce37d4936e01680864389e17f80bc8419e9e829c809654a0
MD5 3caeebb47aadb12f7afa68e424e264d6
SHA1 b3571317481f13ae4c252d7cb00a38c5399efefd
SHA512 f1611438bdd57c4a443c8b8c6b3e66b25b11d1216b47298b2ac3154f573625d1634257bc650c66a888c964631a272467ddf4110db0926374162a3da0ef58ac0c
SSDEEP 12288:ZAwSfxL/2Dc3RDLLmt0LDQewsAjKZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+p:K0ewsAj83KnAoIBlEq1tIgAWz5foj3Z
TLSH
T13D15E031FE74E436C27B0DB21B76C716687CB9204B6119C3E3B88D9E59346D22736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 975a9121858d29edbf930b87be2016f190f83ddbe2e5c3eee2c5ed4ea94f064e
MD5 25efa9c578f63c30aaaae8f2f1fcc3c3
SHA1 d9a6db8bb69f73b9815be7130f5704834b8367fd
SHA512 531c2bcfbffd4dccae9639944b0856bf52ad77e1c20fea828e91b018f914f3db50a4eb6a08c6731ede2b4ca24cff98884cd73effda666114d158490998a92a49
SSDEEP 196608:jUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHHOBg:jUEtQevvqc2W1cpV2tI32u
TLSH
T136474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 509410607d7fc5f68fdc8dc59fe1d7d5b7ec614660b9ca12dbff0fcc7da79026
MD5 69898cbc915b3cf59fd1d7db7e5a753c
SHA1 72b75021f988c65fe777ac5f41588090b85bde61
SHA512 b3256f67fd64c5188dda11b8ac7f9de0f7030f29ba05338f05159a00ddb24fa84b60e558a1fe2492e9b781b56cd0808a73c0017eba62b99210aaf2cbc9016bed
SSDEEP 49152:ICbRquA/m2yL5zTfFiV+XenmE3/zSKnAX1tIc5foj3:hoquVjnmR0Okc5g
TLSH
T156D58D0976B8C1E4D1F6C77886A2C647F37178154B319BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 701dc69b7382cd9386d52af35592dc51566d5a968c224f6d8c5fb60b14e8f65e
MD5 b402c1de6cca2f51f7537779586de82f
SHA1 095e2b3d5e87dac2d514cc4afb82f57388e3b1f6
SHA512 d22dd0df9e9edf179c0a0c60e6313671e023987c458ffc2f0154e43cc877a7f850ba8061b745996f14432e537a912a90a1969933ea4182a597949c56bba88148
SSDEEP 24576:OAhGL3IFoiwtA5l7S53R3KnAoIBlEq1tIgAWz5foj3Z:OAMUFoiq5hKnAX1tIc5foj3
TLSH
T1FC35AD80EBF955D4F5B3AAB899B68171EA76BCA55E31C20F2160D10F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 8d1a5cc30d9cdb6ec1d62d7792f43f0d522908cd2c570efd731a2dc42fd5a938
MD5 3f95c36066db67991caf1b9402be80bd
SHA1 7767b6517eeb6e695d8291f5723e77f7437b272c
SHA512 9aa344413627f195a59fa0c1bec2ade783f680e6735ad6fa682b93e98878f8a4755590d0a18823569e68eff6ab6a48ff4c20900b7cbad55947118e43ed773295
SSDEEP 12288:vmw5HEjsChNVBFgl0WDm+CrZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojp:Owu4OWo3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1E005F14537A80CF9E9678239C6978536FBB2B8112A35CB1F1370C61B6F376616D2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 e31791e35c9a16c373e5c81e8a2ce31e1f96ff25032e36502fc09250227b5436
MD5 6f42023d9d84bb624c7b13992b1593cd
SHA1 a612c96ea148193c6bfbdf90fae5a441e5094083
SHA512 d7ec5057a53caa45f7a31c65a97e7abb34527d2f78a81dfc715d33a2b7946104042b17cd2d062915fd33c1cf821d2ab4a63db912988b6b22c75d14ddb925d527
SSDEEP 12288:AeZ1IyaZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:BZu/3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1E5E4125137E824BAE2A34238D5F6554AEB72B861533643CF213586577F3AED12C3A332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 bfc5ecc09476d747496d54a744356b7eb13caa92651a243ef49f06b21829bef9
MD5 bda556c8967a12ded4fe674b95e416df
SHA1 0a345b8a72500f48858e6a68c51a0cfdef89a35b
SHA512 b6501e9e333b98b47865ec62e0e3cf356cc1bdf0c58b95ba40c746336dbc7949c0b8a80e2ee88d6e50803b0c0f1b0f13dcae88eebb6e8e3510fd0a098355d4c1
SSDEEP 49152:Qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ut:3QRQyi36YOcPbLvw2gAf+PN3Q0Okc5g
TLSH
T1A9667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 da8df049331027d86a8297ea9a233791e1e3114880088638751a22a90f77f57f
MD5 c7b9ac25c24b9fb58c036115598587a0
SHA1 b4de6ac617d9f3bb744d8339812ca6d4c43d3e12
SHA512 31c71087d6401a3b5695680d51ce926532b61e0829d1edf5980a7c5b994cbaf9be01e26f7393a66e53dc959d30e3a2f318a7e35b0ae8bd82ea10c69824cd79f6
SSDEEP 49152:0j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ut:rQRQyi36YOcPbLvw2gAf+PN3Q0Okc5g
TLSH
T1F9667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 853a9e6b17f70e6613ca2301c0a5eac1b9d65058abdf7d866728234beeb15f64
MD5 b62e57f1571dfac1ed796b8defc5e0a3
SHA1 5e8961d2f31ae9cbc1135088d9f2be3f68f5dbc1
SHA512 015e8987d2fa0b3b4f20a9aee1fd9775582b07e0cd3c642942b83706bd8dc682394daa19c93e30c626881fad5a053a113e26d0d252c63cf45e316ff33f07d5b7
SSDEEP 49152:/68Qg55nhceWu7PNU3/iKnAX1tIc5foj3:5thLRc/i0Okc5g
TLSH
T1B2B55A33B2F600A9C44DE1769F4A873196E17C758FE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 7b003067e1e3adce5bc48f76b7eb84f37992969c0ab6462fd8c0060cf05e8426
MD5 1457d18593539889ee76ca742a14afad
SHA1 9ff2c193d682303bf8111024408ee03a2bb3af96
SHA512 b1faba1672bcc2fd7191e2a97d895903b8d212f4a8837c8d08ba8cace8b8a4c131ac26289bf679f2c85f5f65c63370bf0d90cc13c6ef5d28e47ac42d509b3559
SSDEEP 49152:u3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99f:Py5112gYy5azzVvt69nLKnhZb0Okc5g
TLSH
T125167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4e5e17fccf6914e6fbb3964600e7bae23b06f0ed2e9fd82f7f37f7a59cc32bd0
MD5 924d7f2ca8b025520aa3439bf4fe6deb
SHA1 a91727b4ebd6d157c960da407e3f31edda04b319
SHA512 9563086804f5526e755ed7fef5d94c7d63646a75d5561f8c02cd352b6b79e063435796cefc1d1e852855510ce1cabda157549f7af81f180f54ebd5583af4e8ba
SSDEEP 49152:IB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glRKnAX1tIc5foj3:Cu6Jmdxd2dR0Okc5g
TLSH
T1C7D59D13F1D901E8D06AD478974A9233FA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1ba6c2939e83983c2c73f0d327790b4d4757069cf6d8ba80271bcbbf2662a431
MD5 2cbf0cafd018554db15cf49af325470f
SHA1 d2453fdb0c394ee3c4c9ba5bc96252d073e6d9c5
SHA512 35c863e8833c267b1a8cf1934a24a5977d2c8153f78e27aa8b65d7e35d318d30d9cb299f4d3d0543e0ee06a03b5630cd89d60fcb1c676d09fc499b38f27516f8
SSDEEP 49152:p1hpsNoJpF1A63U44CwH7R4xEKnAX1tIc5foj3:pmifPWRR0Okc5g
TLSH
T173B5AE13F2D800E8D05ED17887569632EA62BC450B35B6DF0A90B7962F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 168c288b1c7a0b3d47573d4bc23cd9b98a881cd1507c1234af03dc74cafb3cb2
MD5 abb0b129305fc8ae5c0057cd742dacc0
SHA1 a7504bfc9abacc41c865edfa10c6072526a96f89
SHA512 06b1807f094a5b9ddcff299688571e51a7f5480f5713e8a484f216e4677cb21cd6dbd04075cd771e5ac9c0ab012d7d1463410a2405712c105029829f96e7ea45
SSDEEP 49152:gSuZQIY0Be2KcRVtOnks6NMHqvKnAX1tIc5foj3:65dKii61v0Okc5g
TLSH
T193C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e9ab31e6a8030ce75032a486595793ae6c66ea1a295ebbdce8c2d7ad9708d530
MD5 2e695dfe19766952bff67c4f9bd5fea1
SHA1 9a875251705fea97bb8f32c3032bd9e50f7f223b
SHA512 cb78c244e14423e169ffc1ebf2dd3b9f6731f5ec7bd4f5f3cea4372957391db7225ac7985036beac59e2a8bbc5cfebb976d0c0233acb8ad9c61117c7ca898cfd
SSDEEP 49152:chtSn8EApI0fig3giDn0AP5woKnAX1tIc5foj3:dX2imph90Okc5g
TLSH
T17695BE13F2D900E8D05ED178C7568632E962BC150B39AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 01a9e08c8df0f76bb69f33b9ea98bad10973e523f9bee1065f4936ce692ddde3
MD5 646ca5add206823ea038680a72be3cec
SHA1 008d05a4827500b0462154e5b65ce19ed22f54a8
SHA512 dc44d59df1fcb6a19f50e5d0d8cf7d6118ff40b23d0594d5cd68a5d58f7a716d99f0ee2b5725be502e901a649e6bf7d0b112cdb50c9ef26b6be55e3e09a7ed39
SSDEEP 12288:txZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:tj3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T152C423217BAC082FE6538671D2F6548AFD75ED74453A4427313A9813B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 9ca1e9bfcd1f63edda54f9ca370737566f71a33810d39ecf0320bb1ce9f2ad81
MD5 6a2ced4462f2655cac94053de9230227
SHA1 2f2357fb6e91653f3eb8ef9a04cf3787900cc1dc
SHA512 21b5dba5f73e2026cbaf7db4ee366b54ca51e6eaecb86e468ee110c517438ac51f39c2e8ca374595464926d3033c239340015f42e7da02226d9712abf58cc5d4
SSDEEP 12288:xFWZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:xFg3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T117C423217BAC082FE6538671D2F6548AFD74ED75453A4467313A9803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 36fe9bc48f6227946343bfb9f159f24e53684dfc6251a61d78cc1dae580df457
MD5 25f3285d941be1f3e433170a08a32f1e
SHA1 c71fab952704a583a164f73158501b7834f1ff08
SHA512 3dfb6b4c2d9f995cccdf67765e6a5d7942523948cb2637e5dfd3ee0f55e7851f72ce2b5676f8eadf9107d7ea56597bad581f1ea10315b5662968f0f381773261
SSDEEP 12288:PkZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:Pu3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1B1C423217BAC082FE6538671D2F6548AFD74DD75853A4427353A9803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 6d981a19d054e092eb691d6f688fcc1e58f61a97d193db93299559a552c95644
MD5 ee1237c39e29d439e7a65c1cee666f7f
SHA1 9561a885251febcd420f174c7e63cadf6619972a
SHA512 0e5e96f6614c8a9801a0bb24fa6f61bebd39de5674b67503d32324fbb6a59423d4b5d404d8708dc072a4ab46e8255953e3328da96c3b5c2c7ee56ad74b8be55a
SSDEEP 12288:aVvZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:A3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1D8D422213BAC04AEE563C274C2F6544AFEB5FC708636446B252598077F39FE0283A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 71be49dbf163e9b9ffd8fececd17cbeae692724dd89b748a3bd0ea7b318f88c0
MD5 c42a493fbeef9d92aaabaf3b68853d6b
SHA1 68acafca8f60a9c0461ba4f8b4322668ad78a5be
SHA512 e123634c3c4f3778bee13c2c88ba3c0ec74dc4f893426724fcdaafa36d3266892c47ea5f6a2f655cecc06bbd9ac6f060c3d328df9203978c06fca01908d51a52
SSDEEP 12288:gXZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:gp3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1FFC423217BAC082FE6538671D2F6548AFD74DD75453A4467313AA803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 64542b907932407ee58ce2fbaf1eaa95d677521f1cb111433c2783edae9a120a
MD5 e26ed7897991c4cbb5e2651e0435a002
SHA1 015bcfc7a911987f08956d04fbc47df5051e8ef3
SHA512 98a8a367b34a052d8cb868a8f0b0237bcd88a2d2fece4d3a217740825ba4ba6c9c48158dc54ba3e5157c7ca2112b2e7a30dc0a011b020061769acff3db781e9a
SSDEEP 12288:6CZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:6E3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1ABC423217BAC082FE6538671D2F6548AFD74ED75453A4467313AD803B73DEA0283E2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 49d8f047cb3c7eb9a2543e0cd7d54ec8f95f24554c8bbf92d05754522b613b7f
MD5 f5b16feb068f5755889b0a21d095a5be
SHA1 e265e78bbb2d148da081e1e6eb92ce4d88876907
SHA512 b025ee4e3409fab36eede0adea71fc683eb0e655a50fe04b7496a6552375aae2669b0e5710acd910822c174e04f629e6730839c1a5d98bc7fe42283f157f5010
SSDEEP 12288:PeZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:P43KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1A3C423217BAC082EE6538671D3F6548AFD75ED75453A4427313AD803B73DEA0283E2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 4aaffe5e69d6c68a17566b75980dfd9a7c4c64981e71457e20ea5fbf37ceb129
MD5 db2dc78c824a55d6fa266265fedebe6b
SHA1 fbd76921fcfc15dedbd4a100e2e95c8de4847b29
SHA512 0889ddc33b86cf8c9c6dac8de3eaec02aae4e9c59103f8ea87193c321b4ac9b8e6b7c1bdc1075fd0d2154bab2adf784916bf84bf705170e8ba45047ff0472f18
SSDEEP 24576:jZMRzFVSOA3KnAoIBlEq1tIgAWz5foj3Z:jZMRzfKKnAX1tIc5foj3
TLSH
T15505F151739418F9ED63823EC9658906EAB2BC650770C51F13B436276F377A01C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 547549c7bcf63aac8242497440a5c9ce993e58dc27fe31ad8ded2fa99c5db649
MD5 48db30a0c368ddfe90810bb45929ec94
SHA1 a629f8579dfe9ec1d9b6161fd2e6a37e84c3be74
SHA512 e0d22d55b35952b8f5e323786cce90d6aa5b6dfc0bba1dc837f6caf64067365a198d08db9b9f591a6e8ceb56dd359bc4e5ecdf7d08467f8e1bb530e5b8cc34c5
SSDEEP 12288:xVZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:xv3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T142C423217BAC082EE6538671D3F6548AFD74ED75453A4467313A9803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 a37f01c6f93b8713cfe18e46e048f0880db6cac96dc2bfdb15a7bc747d986555
MD5 a8be59d726252eea2d4daf9cf6d0b96e
SHA1 2354ac953adefdb67d8ad1bbfa6f4dbbdb877e95
SHA512 e43b198e5cb69cc12fee2c4cb22a73abf3af73e7477c1ec87a55f9e4534ad9ee4440a5a406ddffd61b66c89d63849d40f5ec0f12eb9cb94ed5a5b55f97967ee7
SSDEEP 12288:bpZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:bL3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1CAC423217BAC082EE6538671D3F6548AFD74ED75453A4467313AD803B73DEA0283E2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 46193654134b4336e48a6db1771e70880fc22830dc034b2f712ff18c8ac9a014
MD5 24c1272b22d426e10d77e7e23283034a
SHA1 8f6e60edf4350c3c411e01d1f204b2a5f7a58d79
SHA512 e93bfa616d68fd671f09e1204f3b86d7a6146895a9e193ad3918567961e3cbc8ad066092d098dc9b29c4ea19c5b9c35b02679ae72198441c4ff67bb196dd37cf
SSDEEP 12288:xyPz5L8aZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:gzys3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T143F4021377A820FDD1678235C9A21906FB71B831473589AF236446776F2BAE06D3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 aa2f4db9e01e93dc80209841cb5ade953c9761d426ce15bf10149b4ef7846a53
MD5 0c659a5f8596278d9017801f0486d5b0
SHA1 bab59d5fe8ec0d3c388ebe41cb2e26698978a017
SHA512 98972944395eac329db460474852def0185c5738fa4a9214796173ddc540b443cbe6b93667fed7fce0016e9f1880f39f00bfa2149282220ccbe8bfb79ea3c6e9
SSDEEP 12288:8VZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:8v3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1AEC423217BAC082EE6538671D3F6548AFD74ED75453A4467313A9803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 6e858de03c54898a38d359a003d8158c728171b90cefb7d90e87efd3e1859d91
MD5 9696c606173c2407851ff4542bc5293e
SHA1 f4e22ffa75c9f1ea7e9cf8cf58eb0d88fa89ae26
SHA512 be559f8f99c3a917b8a9901117aa83fbc90871f6b5fb98f573175f8b8783fb41188205fe856f90f125d432faf874cd970c29294851fed5e5d7d07255f1451ed4
SSDEEP 12288:GVZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:Gv3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1CAC423217BAC082EE6538671D3F6548AFD74ED75453A4467313A9803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 9c4611cfd31cba835eb10e438cd4d9df8751709fed36af9da594b15a229d4c53
MD5 4fa3472a869318ff4aa3fe55832e3c98
SHA1 907d7a992d29b9e807420618eda4a1a339f33c8d
SHA512 b0bf3d7be5fe473551eac4d4adadea23e1485159d42800a66d3d619eb4577e8182ef4ee2123b73426970c69330c1145fd022097f7b7815a61e7b23c2b8789a61
SSDEEP 12288:AyPz5L8aZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:xzys3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1A6F4021377A820FDD1678235C9A21906FB71B831473589AF236446776F2BAE06D3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 b9eac43d886243419303b6e8a34639dbad08d8a8cfd7cebfeec453c3f2ad3024
MD5 3912a36d29ab4de011de36a731414841
SHA1 3a26923ac36e0e58ec7c843ad1e4ec926c17969b
SHA512 d3baa874645ada13b596bc791ef557dbab8d0ea5e1e33c7f82f024c73a3c19fdde5cffa72bcbcb2c96a08515c7c32f2208acbf677abdc725b814f0b8c8c76efa
SSDEEP 24576:bTDaLl3z0zD+3KnAoIBlEq1tIgAWz5foj3Z:bTuLljVKnAX1tIc5foj3
TLSH
T14D05F160735418F9ED67813EC9668906D6B2BC650770C61F13B836276F377A01C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 2b19c547b58a119110a8b46086da31e08200e489e586d2d842d5cbb8a0e17d83
MD5 320ec6fb0c3c421766821ab416cccd26
SHA1 6695f5288d97405e3c6352c18b054a4bdd1ded4a
SHA512 dd30615ebb138c1a50b20560e4bb5a21c7b0e67c176ab1728b8a5c6892d08485dc415a0b2b6d04b86862e25d4e9e05df9d7db9b8f1a095ad7225413290b6aea6
SSDEEP 24576:J3vd9CHKy7GZC3KnAoIBlEq1tIgAWz5foj3Z:Zvd9CHKyaKKnAX1tIc5foj3
TLSH
T15725CF90F3E814E8F1B78A35C9765512DAB67C691B31CA8F03A4651A1F33AD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 650d5e35f36bd865bd1d9b170e042c39c3fbeef4efcc075877533469cb06ae44
MD5 9b9e18220f04a00ca004a957ae2a3d99
SHA1 87231829e3ce7ee58efa13700cd09322fe9f37c2
SHA512 f1d33cd91cb1ac852f776b4f6306f6acf6ad790a5a4186b235d9f25655614a23939e365df5fc2bf0ae7860d1451ca8e9cc55c703aa68cfea3de5ac7ae2c234cb
SSDEEP 12288:1EZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:1O3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T117C423217BAC082FE6538671D2F6548AFD75DD75453A4427313A9803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 cd4caa2c8a0527440f8c175a4c4e472003aa88d8efa86e21c67d3a36422151d0
MD5 31f3801d41be8004a1e0f90f09c2895a
SHA1 6ee97d2542e433b84fe29aa2278fb9394c7b1359
SHA512 6243d4292180e4bec718540065c4100b467fca0cfd91aa51cf597b0bab8baa119f0df08648cbb0de65f730ac2c7371e2290cc49634e05b333b2a0e9e841e1edb
SSDEEP 12288:j6Z3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:jM3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1E6C423217BAC082FE6578671D2F6548AFD74ED74453A4467313A9803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 d31147f50d70eb14720b19114a8ce9c2d283aabf3c08d98aa3b161b6c775c1ed
MD5 5af5287e567d84b4d0f8496026b903cc
SHA1 61ff220a0a7fcee5b2454f6bde29231f0aa6f658
SHA512 9f4b77b0745ba20784307809e09df9b8380df31bdac2a2559343eb44d3076e0fda251121a4dfda6b74fc314f20aeb67038ed2f9673464c8414212c86918efe08
SSDEEP 12288:PTZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:Pd3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1E3C423217BAC082EE6538671D3F6548AFD74ED75453A4467313A9803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 5471d01290a2d53adc4099a4e288d8c1f4f02c4b007f962efe89c7ed3e605680
MD5 590d703f930b4d6e9f93fdab31e13da6
SHA1 d8272de20cd90938c25579e8ea7b0adbba474e80
SHA512 4da161265c84da08696628ab45245e36ca4e0f0ebb876410721c01db74309b0acd37e8560329c81116bb2d7690a5c6932591ab47982205789f66a2748a3b4004
SSDEEP 12288:TVZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:Tv3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T192C423217BAC082EE6538671D3F6548AFD74ED75453A4467313A9803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 a9f95869a5f42b8373955498a7c20d6f9c19b82a283112198f81f03b2450fe26
MD5 1a97b63b2fb460228326fff16c514570
SHA1 a36c40925af88b3d2cad61d49f35733774e35d88
SHA512 0972475c004aeef1ef841965214adc0afdef81319df67e59225c2c046c72448f35608f6f1890b2bcab04d2d88d299ef695c34501375eabaf0732bc3a8f8283f9
SSDEEP 12288:VEZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:VO3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1E7C423217BAC082FE6538671D2F6548AFD74ED75453A4467313A9803B73DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 571ff71383f473d41f92e5921e2c23811a0c95d049aa023230136e9244883ff6
MD5 efa61e02697d74a2200cff79d4427dfc
SHA1 37cd3b46760526e7882b05f71b22a630cd8a6047
SHA512 881a3b6042fb9a4474bf5209ec310cc2ad30f91f1d9ff0ddd5432de69833b8ec1458c251ec9f737951a2aa4bcab708470f388b2011566613de63df9e76b8a06f
SSDEEP 12288:A9Z3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:An3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T171C423217BAC082EE6538671D3F6548AFD74DD74453B4427353A9903B73DEA0282F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 40883fb90a346be9fb740f77c8fe091b5748504a5bfae0c27ef1397a897de681
MD5 67d2fe06998ca10b954d5176adfc02d0
SHA1 d98a84b079334a0db64a76b8dd10c40847a1b7d1
SHA512 7177146040ac51aead60727730629f06fe0aba624502bc87dd7460aea2dc0f4dec6cfad8e7f7a42e0257ad7839c5ebd41c98a74447c9e6df13830dfe087fb3f5
SSDEEP 12288:zXZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:zp3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1D4C423217BAC082FE6538671D2F6548AFD75DD75453A4427313A9803BB3DEA0283F2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 3934636a6b272d6c7282bf235546913d532452fd4508fbbcabc89ee5cd5b9b80
MD5 4737487aea73738e2a38f1c076227b05
SHA1 69376befd73bc3ac466f0a82f9c5a74d57dc1cf7
SHA512 6fad74675a596aef0a75a318eb375cb05324ac5faf8bea5ba7552753b2d48e0f4ff0d0d9732869fd98f20ff6e85fbe3710550d5b29ecbf2a0ad9645f23b386a1
SSDEEP 24576:JfwvUk9RX6wkyAI73KnAoIBlEq1tIgAWz5foj3Z:DMnYI7KnAX1tIc5foj3
TLSH
T16F35D029EBDC04E5E177923C89B7460AF6B178680B31C6CF125A536E1E37ED46D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 6a82ae22cba0a9c84586ef05bff7e40d34f2bf35596455be13fa2e81958d45e5
MD5 45b6213e6b159f3efb3f5e30a376fead
SHA1 4790de466982316b02dbc8ff42b4aecb61e9ac3d
SHA512 489d5472d68f72ccdcf2536d2c3531193cf899e71a969aee37858ec2c73f761c34c81a3cc976ed3d62c871658921c5852bed71d37a2e0523533241be828e8c88
SSDEEP 49152:hYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0IKnAX1tIc5fob:sySzPw0Okc5g
TLSH
T154066C56A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 b01bacd5386a755d0e178597fdd1a05152b06c7b31943d9233e776a95a8624cf
MD5 b8c9572b33e17d24974c3aa08a595b70
SHA1 cc8a5d9f97b9549e12355499a63293eac49ce86d
SHA512 132d062f82c09489969c8252983e50bf238102b557e32312edc52f24296fbc16d768399d14a8a857742b1e4f933868d8d15b060c09fc94cc00e4f4c15a0e7fe3
SSDEEP 24576:F47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYw3KnAoIBlEq1tIgAWz5foj3Z:F47JUQjTirIhCnDHUPfF/YKnAX1tIc5g
TLSH
T1E165AE1DA3EC01E5E1BA827885554A5AEA71782D1F31CACF2270837D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 6405e85ecc5c0912deea60d36600bdbcc8ca51f8cf8e2b9b0e5bdfc45ad20377
MD5 a34b6dd74b4bd2ffbc2e8adc755cc050
SHA1 76b0e7960741e454967da3bc90408d37dbcef307
SHA512 cf3e9e2f0aefcf1a503325e1b3df35dc621078a9b757ec3b4abb06171b7baefcf860f7e8a072b68a723b114edef02aa1808ac3e362149daad74e8c3e2eb06ae1
SSDEEP 12288:GbsfFZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:t/3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T13CE4F115E29801E9D06E5275C7A65A45FB337C2583F1C2CB22E0F53E2F3AA905CEA753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 5df9172db4d1b575ff500d0f5d5699194b3a465513ebc827cbdd80dc73ba2c2b
MD5 cf6b9bd2c97603f07f918d0bb5f00ed2
SHA1 2799424e6e89622d447f30d91a135402c3f35578
SHA512 975e465536f303ee8d161af17dd9661f66435dee777acf0df068af0bbd8db395fc2f6d5b55d7b1b52be96981340dd596d2f7782172475678203f092183e1d386
SSDEEP 12288:W07tZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:v33KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1B2D42321779C182EF577467092FA9419FD39F9344B3584E33029A907B63DEE06C3A27A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 cd6adf1f4fd4a2becba32d8ae2435d46b706a861ec8a5d13b162e37cd9695085
MD5 90cdb0f2fada43f574b9a833fcd49ac5
SHA1 21b3796070b73ee177466c0c9f5579746c3bc8fb
SHA512 b6944abc1f9ce587c37a2ff1c2be80d8de68849126bee8f1b81af2fb77a5f41fbe8d09157eafe8eea7c208eba09c33ac94da04f28436ca0996facee917f72c7c
SSDEEP 24576:Zgb6bmBIi49WNNFpg1rSvFv7bYl3KnAoIBlEq1tIgAWz5foj3Z:Zgb4mBIBhGFGKnAX1tIc5foj3
TLSH
T1F4659E1E22EC02F5E1F6D2B8DDAA4417D6B278160732D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 63f203fe12ea88a9446444514a5a9b216a0edccfb99d72b6c221685b7200d6e6
MD5 74881bcda5494635f898797c3fe5f0bd
SHA1 7eddbbab509605ee06e403025751b69db9184f5b
SHA512 0a52f7797c6d5e166c3d970e17f80648158a0b8fe74f727bfd74974b44fc92b2d0995c78f20c54d3682d49708d8ff93234a094412ea889415a5e7b61d113ddc1
SSDEEP 24576:EG88u8FpJqH1bzria7/mA3KnAoIBlEq1tIgAWz5foj3Z:37ZFPqVea7/tKnAX1tIc5foj3
TLSH
T15835F16177E401F5D477D1388A964667FAB1B4250374EBDF06AC8A522F23AE40B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 345f9bf94b0d1d418d798b37e82b024d5a0dbced2b4565c114691faa6c75fb25
MD5 3da1a60bbeb6ef064da56f76e3ea8f76
SHA1 3ee245141db59ea79cd3a00990ed4c1a083b8bb1
SHA512 26996084035a0b64eed1b10ed8b9b9c7894afee5c677b1b1b20ceb482a8cab95444f221ad5dcb22323bf9259d880435c1751a04df8ebaa79a4320cd530efba7e
SSDEEP 12288:PHvUrBFrEjwaQSZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:PPUr+NQ03KnAoIBlEq1tIgAWz5foj3Z
TLSH
T17205E12B36AC1CE9E676E17D85924609F771B462071291DF02A1817F5F27EE87C3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 328b1a099c502f861c1dd7d9955cfa995d0e8a25e339df3510a6c9d6d8b239a0
MD5 031be19a626dc530ce50971b38b9c27f
SHA1 81f1d69c6a9db85ea6c6f76b0a5fe295b9ba7d9b
SHA512 b10efa71a9352232617e20eb22f61db363392109fa74db692e182a9e14a725e1358608cd50b724fb04911a7063f41151f637cad7f05d8e8c2cfc63c6732a475e
SSDEEP 49152:KBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj6KnAX1tIc5foj3:1G05lO43bT0Okc5g
TLSH
T137D5C06A62EC11F9D1BBC17CDAC6460BEBB23825033556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d3492029b89bd9562ac2d88d095054d6b25dec2830f95390b734c1b2691613f3
MD5 863bc77c08ca7f15ca531b723a321dbe
SHA1 24868a17d22eaa2acc77c069fe9b1deb318e1c48
SHA512 05b72ea9f6b21e7053acf5535220b3a07a103315222f601cefa8e36e77e7c7cc0207347c397ae03e8a043e5f8d243f353355b3b7f1f828a013c688e9293d7a01
SSDEEP 24576:Ffa5POZ3dpuWVM50JicR2hG0lasx2+47eidn63KnAoIBlEq1tIgAWz5foj3Z:Fa5POZ3BJt2pasx2+miKnAX1tIc5foj3
TLSH
T1FC65BF5EA7FC00D5E5B9D17DC583861AF5B1342153329ACB122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 6c6246635e2efe7eb24d8f432bb4824198e5e5620aefa6f43f49aa93f776ad25
MD5 3e344a1c638cf071bec7cab9e46b16a3
SHA1 9b402fe6fb8469fe0790bcb4f22564b1e11922a4
SHA512 bb0fba75d7cfc36e9933d96f7aa237f1f35c71df26e723ab5a7151126920635989958df34e22073a3b7064fc48a5e54a5cd13360dbef5ac099c2580d23ffad25
SSDEEP 24576:rNcwHdjbyQ4nLC18lb/EOjowL7FkI3KnAoIBlEq1tIgAWz5foj3Z:rNc/zEOVHFNKnAX1tIc5foj3
TLSH
T100858C2623E901E4F1BBE1BE89779546FA71786513348ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 dd7b4cf865b48216d447ff594b623b2b32e9c569311542245e1d05d7ae7761e8
MD5 16ad706ab22db29f042de199a3fcc7cf
SHA1 82071f0eadd7b36f7e1596d3dbce22ace93f6789
SHA512 307c6c320d9375f74e0eb0c6c959eeb71d88a5786383ce25050112b5a26b2f9537b53089aaca69bf915cb197b6db87628a85d9aa59d0baa33581d9e74ad5376d
SSDEEP 24576:/TkNvNnaFeYhJNtmZBm93KnAoIBlEq1tIgAWz5foj3Z:/TMwBtOmtKnAX1tIc5foj3
TLSH
T13B55AF2EBBB805E4D1FAC6B5CD238512FA727461073292CB5290C13F5E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 a165550780ab21659314d9c3144fbdf2654ab7f1bbb4931f43659083ddd375e3
MD5 1bbd319c0c279c5b1c6569ff4e2a3abe
SHA1 5006dec17400e641d0e99c899bf01652637fda43
SHA512 7156444f6aaa52d60cc6ed94e6ac88c8f4c0ab15523a5c7007ab216a5663cbe1f56138565dab4bc5a292af88da65a13081fdc70a31ff5d31a4e74e25f9581cff
SSDEEP 24576:JD3FHshBIYQgAD3KnAoIBlEq1tIgAWz5foj3Z:JDVHeBIAAjKnAX1tIc5foj3
TLSH
T11125E13DEB9C04E4E57BC1BCD6A38906E67178A9033255DB119481B66F2BEE43D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1696-130-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1696-123-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1696-124-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1696-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1696-132-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2680-42-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2680-54-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2680-56-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2680-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2680-43-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2680-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3008-302-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3008-81-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3240-117-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/3240-309-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3240-111-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/3240-109-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3528-307-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3528-325-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3528-326-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3528-91-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3528-85-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3528-84-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3552-15-0x0000000000400000-0x0000000000510000-memory.dmp

Download

memory/3552-1-0x00000000025A0000-0x0000000002607000-memory.dmp

Download

memory/3552-8-0x00000000025A0000-0x0000000002607000-memory.dmp

Download

memory/3552-0-0x0000000000400000-0x0000000000510000-memory.dmp

Download

memory/3596-77-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/3596-291-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3596-69-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3596-71-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/4336-30-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4336-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4336-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4336-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4336-122-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4412-313-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4412-140-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4412-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4412-139-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5080-96-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5080-16-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5080-25-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5080-24-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5428-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5428-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5428-103-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5428-97-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5428-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5428-310-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5956-65-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5956-272-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5956-58-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5956-59-0x0000000000860000-0x00000000008C0000-memory.dmp

Download