a8c2ae7dedd5da2510a37b4b218802ced03e95e63c89b3e5ff281f5cc37515b3

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 10:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-28_f8b8c768a0ad3a7b6e9b609e7734e567_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Size 4.4MB
Sample260928-mchews1ene
SHA256 a8c2ae7dedd5da2510a37b4b218802ced03e95e63c89b3e5ff281f5cc37515b3
MD5 f8b8c768a0ad3a7b6e9b609e7734e567
SHA1 e42acbcb86841b4859712182144408f22dc65da7
SHA512 eecd47ce0d74d34c866bf317ba814f1d3e0111dd62e8dba420c8bc2e03aff47d29ba45ab8b7a85cd0154d25e42e6780c8bd484af5d7958ae776fcdeef03efc13
SSDEEP 98304:0lT05eybka9pbVu0VLGMb5Cx0taAUgLdpq+Xvna9k7VoiX996Kc2wfb9sxYbJzl+:0lTWj3pbVu0VLGMb5Cx0taAUgLdpq+X+
TLSH
T1B526D021BB4DC072E49503B146BE9FBB84686E35676101D7B2C87E6D19302D33B37A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4960	elevation_service.exe
5248	elevation_service.exe
1112	maintenanceservice.exe
6132	OSE.EXE
2712	PerceptionSimulationService.exe
248	perfhost.exe
4152	ReFsDedupSvc.exe
5504	SensorDataService.exe
5984	ssh-agent.exe
2572	AgentService.exe
4772	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\a:	SearchIndexer.exe

Drops file in System32 directory 48 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-28_f8b8c768a0ad3a7b6e9b609e7734e567_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-28_f8b8c768a0ad3a7b6e9b609e7734e567_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-28_f8b8c768a0ad3a7b6e9b609e7734e567_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-28_f8b8c768a0ad3a7b6e9b609e7734e567_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-28_f8b8c768a0ad3a7b6e9b609e7734e567_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-28_f8b8c768a0ad3a7b6e9b609e7734e567_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-28_f8b8c768a0ad3a7b6e9b609e7734e567_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-28_f8b8c768a0ad3a7b6e9b609e7734e567_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-28_f8b8c768a0ad3a7b6e9b609e7734e567_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-28_f8b8c768a0ad3a7b6e9b609e7734e567_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-28_f8b8c768a0ad3a7b6e9b609e7734e567_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2afad96c9600bb.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5628-0-0x0000000000400000-0x0000000000861000-memory.dmp	upx
behavioral2/memory/5628-72-0x0000000000400000-0x0000000000861000-memory.dmp	upx
behavioral2/files/0x0001000000009326-131.dat	upx
behavioral2/memory/5628-136-0x0000000000400000-0x0000000000861000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_108687\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-28_f8b8c768a0ad3a7b6e9b609e7734e567_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-28_f8b8c768a0ad3a7b6e9b609e7734e567_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001bfd441a334fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000482d19d6324fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000787b891a334fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000028175fd7324fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c8e553d6324fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4960	elevation_service.exe
4960	elevation_service.exe
4960	elevation_service.exe
4960	elevation_service.exe
4960	elevation_service.exe
4960	elevation_service.exe
4960	elevation_service.exe
5248	elevation_service.exe
5248	elevation_service.exe
5248	elevation_service.exe
5248	elevation_service.exe
5248	elevation_service.exe
5248	elevation_service.exe
5248	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5628	2026-09-28_f8b8c768a0ad3a7b6e9b609e7734e567_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Token: SeTakeOwnershipPrivilege	4960	elevation_service.exe
Token: SeBackupPrivilege	4152	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4152	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4152	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4152	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4152	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4152	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4152	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4152	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4152	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4152	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2572	AgentService.exe
Token: 33	4772	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4772	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4772	SearchIndexer.exe
Token: SeDebugPrivilege	4960	elevation_service.exe
Token: SeDebugPrivilege	5248	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 4076	4772	SearchIndexer.exe	101
PID 4772 wrote to memory of 3520	4772	SearchIndexer.exe	102
PID 4772 wrote to memory of 5744	4772	SearchIndexer.exe	103
PID 4772 wrote to memory of 5972	4772	SearchIndexer.exe	104
PID 4772 wrote to memory of 5956	4772	SearchIndexer.exe	106
PID 4772 wrote to memory of 3420	4772	SearchIndexer.exe	107
PID 4772 wrote to memory of 4056	4772	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-09-28_f8b8c768a0ad3a7b6e9b609e7734e567_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-28_f8b8c768a0ad3a7b6e9b609e7734e567_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5628

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4960

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5248

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1112

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6132

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2712

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:248

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4152

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5504

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5984

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2572

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4076
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-696679853-3915825385-3233721679-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-696679853-3915825385-3233721679-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3520
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5744
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 2860 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5972
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5956
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 2860 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3420
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a07b1b32dccf941c8dede7f184e70e4d0d913c2d5369d763b3fcb337073faa38
MD5 42e2e18a7405f504d6eb49514129fbcb
SHA1 b1dc9b9ab2ef18983c107aa9860b66c1a422e353
SHA512 5a7ffb004babfc677ce34d90ad7106094624b4bcd5c07c5a52150b6b80b3b46fe579a4333e837b1889f61b833cf6837dea0ae2a859f7cd73a6e29b2235380474
SSDEEP 49152:Wb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnBA9n/TDbXNKd:I3q6HjB3fb9s
TLSH
T1B2D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 3385bc156af97e7f5589acf258e38d2c511fc4ffa16e18df69214bd4c67cb093
MD5 af41d0da5e4af563583495f1bc31b7ab
SHA1 975ba54fc4a60b96ef32df9c865dcc9d4fa394e5
SHA512 15cde1a52440c74b56221e2ed4291deb40e1743e4e325ae52c8dc3e2b418db30f6137a58121867e0884dbda3219fb43a1c4ddf925cec23ba9d96686d48b272a8
SSDEEP 24576:wXYfDtczA4UeA9n/TM4NZYeNm+9MhUwd:HtczA9n/TDbXNKd
TLSH
T1DD85022967E408F9DD67827CC8A28505EA73BC454760E7DF03A4992A1F333D85E3EB46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 2e2a9ee563ccafdd152f7fff1ee0c20b61c1cd31e73ad5a214296e24bb50d02c
MD5 5613677fb74a30fd62402adb5a618a05
SHA1 717ff0dc973816d6fab6fcfb46ad5a66f40564fc
SHA512 d9792d8815bdf9c345cd9a43682a8efcb62f413399e4210da81d67fb24cdcadd064a871b8f6577ae44836b4727fd32959bd9e6dbf99d2cb975e056849fd0d8a1
SSDEEP 24576:o0Le5ji0hmxYrMOUeA9n/TM4NZYeNm+9MhUwd:oPji0A2hA9n/TDbXNKd
TLSH
T1A0959E16F6748731D073C0B9C5D2A68EED72348657308ACB4286D77C7E27AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 fd6a6daf15ec03c1f7c3fb61ee88d75277a21e19cb5f2364bd4c30cfb4bfcfa8
MD5 1791a4d61af202704455ea22ae44f480
SHA1 89e196a0247d8a87fea55ce04cd0defd365d156d
SHA512 023dfd70b7cda08dc0df32f01a25ab6fb70b3f4de7d5b1561c4d20f3fd47abd2771b37ad99bef1cb5bb62e422c69dd41863dbf91c7a9f316e2ec2eb143763292
SSDEEP 24576:ta7/ezSC6vUyD/aqgrvWE6q8wyugUeA9n/TM4NZYeNm+9MhUwd:k/ezSC6vUzPvxHjy9A9n/TDbXNKd
TLSH
T10D755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 aa2fb7605f335bc58c2b928723d38aa4bc283e0f4dd7661e86a3655792713742
MD5 16f5b2c17bd70a32b5c8415b34171352
SHA1 b32f69fed1ca20f28d3b752d5393a04878ed5890
SHA512 520ebfd191c81ca71e5d65555174abc310970e4e591a8095a7aa69cd43ab3612220155ab59da89567ba6f05c283503996d5d988c50174d65ee34d20abbc30328
SSDEEP 24576:1VbqPb88hv/l+6jUeA9n/TM4NZYeNm+9MhUwd:1VO88hXl+0A9n/TDbXNKd
TLSH
T1CF559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 cf298988d150c3bca8c2ef29f3d2c415765ac1db2d951ad0a2129cc3eccb390c
MD5 fafc5342f06f0cf63d9b95b8c95a7ade
SHA1 d2fc00dfd6cf7f81e10aca80cbe0a90ee4e54efe
SHA512 b9304282f38c45b8884b7fa8b3cbe335029c08e0a5ea71cca16f7d00f6dcf65d99a75e2b3687fec05568a8e9a5a5f54b7ac899300ee60692d34c25310364bbfd
SSDEEP 12288:pHSBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dD:pHSUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1336523824FFC08F1C78E0A7544EABF0CCDA2BD4DE684879E4719762A5E385C6C95648F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 f5bee38f7c50aa0d6d334d7d6937a1b605a41babdc50a58bdf8dfbab216522b3
MD5 478ba94e772464b3babb3ee01c5bbab4
SHA1 a3484410de3a22119f79679731681e6edfc12833
SHA512 a43237a3ac02d8bcc1a65c54e19308096aa0000a3ba25029e2698f288a99b9e635d3c8e5f11b138296e1f3dab7078af9bbddbeb4f4955d92a7eefa840a5666c5
SSDEEP 12288:CeBNUbTVO86ULBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dB:CJIULUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1AB85CF7BAE38ECE2C27E4DB956918700D77278304B6293CBD165830EDE235E15E7AC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4e75e9362225026e7a60b089822c3196972a38bececca50e0f6a05270b63ce44
MD5 3e408e079dc4086b5b0559d9ea79ec73
SHA1 17dd1f455409e0479934b2f386026dfe61d833ef
SHA512 99f65aed9ae6fecd89403f9956b3f73ad448525edc8447ca1fd0ed5712fb0d532d1e866b67eed0d59e0643ac480117b789a189ded45f426e2b81f7761e1b6a46
SSDEEP 49152:PQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THl:PQvGAdlCEL8c/yRNw5Czfb9s
TLSH
T19C267D656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 f6399a2e1e03430e143a7703e7bcc682972d19ab66ffeed2589650616d7cf605
MD5 2e04f256c1c04c0347e94bd206392615
SHA1 9d4ea15a7e25cbe3568660f27eec810240ea3229
SHA512 3c3aaf80d76d12ccc12946a85d6a2fe0dbb2d0d5e684521a06df078384202cd11e18512ecb39a824c8765e4e08cc83e3fbc977f9262895c85919a8e2a8872710
SSDEEP 12288:rAwSfxL/2Dc3SDLLmt0LDQewsAj1BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9W:U7ewsAj1UeA9n/TM4NZYeNm+9MhUwd
TLSH
T11F85E031FE74D432C3BF0DB21B36D706586DB9204B511AC3E3A89E9E59302D26776A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 698529d2816cdb97dba9684f62276ad29805e3defd3950998e413349120c7a78
MD5 34ae940cf1ad1caaeb914f1fb757bce8
SHA1 faa612cae9bbc0f1b56c92afb61b62da6f2e524b
SHA512 bdf91314d5a7a2d7c84d5d383ed8b6c2e4d0b97a557fab5f0ca9f416636d8311861e0d913fac04bc50db2528cbb40637dfd85eed06ae4264b2b210b461295122
SSDEEP 196608:eUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHQ9:eUEtQevvqc2W1cpV2EI32
TLSH
T1E9474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 23d19c3b4d26490560cabb73d3e5292c1c11c2aaf209a83f92b20c109ae92118
MD5 d7d2459f123c3619204d5b687fa3d7dd
SHA1 84b735bf13051182ac6991e650ab2aa6104b1206
SHA512 c53c1ea8aed7b792062435748750e2383c4dda952af079addf4d43bcb68760c9b3c35f661c187d0fe1a026a64eb8a9b67574c831439bd6fde3068c62d32b267c
SSDEEP 49152:kCbRquA/m2yL5zTfFiV+XenmE3/zRA9n/TDbXNKd:toquVjnm3fb9s
TLSH
T151D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 708256b18b0b2129200b49102a5d0074af9879808a4438aa8878a32e5f49c3d1
MD5 e4c97eab7df7d9a802e7028318611dc1
SHA1 69a120c6e0d44cce8a2256a81c5f34027e4a01f8
SHA512 035fbf5e3c0470adc5a959baf3b839b0cbe668c26eed1a84726e5d883af34de905d86402afc09594dae87d6782d7e76ba719cf779ccea18239a1749fe4284ff9
SSDEEP 24576:WAhGLJIFoiwtA5l7S53sUeA9n/TM4NZYeNm+9MhUwd:WAMyFoiq5eA9n/TDbXNKd
TLSH
T139359D81EBF945D4F5B3AAB899B69570EA76BCAA5E31C20F1150D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 3bbf056c62dc3af4dbe0ced9f4142b7339eb7d2298e00f61031f4397dd0db618
MD5 3da57618b570c01ea1c7fe9f8ab1da45
SHA1 2aa19483676f37c22c558e99fca8e150a50a37e0
SHA512 eb2368dda371417493bf6c71e924dcf934ad761e08c22f4a3db8777fb66820e3847ba83d9a05ad9dee4bfd9fa58f505ae4d542a842147c593ce122f8a7a7378a
SSDEEP 12288:pmw5HEjsChNzBFgl0WDm+CvBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2di:kwuSOWSUeA9n/TM4NZYeNm+9MhUwd
TLSH
T11285F14637E80CF9DA6742398597D635EBF2BC062A21C71F0760C65B5F37261AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 1f28a5cb4134f0631480e057368c594b2d8e80bf63c3f2f89a7a6db4b5a09c00
MD5 a61c8ac9733d6052d58c3cd25f2b4494
SHA1 d3cfd5c5a625efeb5974d86a6e0262cd5c2efc41
SHA512 f9082baf6bc97772796c05c78f7dd0c3d31158e2d8ea70ab1212095b200e6c306a55f6723743c307ef9b60d2788753038fb2b2a3b1eacaee366b6ea5632d2b1e
SSDEEP 12288:VjZ1IyFBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dd:hZuWUeA9n/TM4NZYeNm+9MhUwd
TLSH
T17475128627F814F5C397427CC8E56B08DBB27C5A677543CF0625526A1F32AC28E3A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b06707c2eecda611169851cbaeb90c4a45fe867586c69f1373b3a9bd823fdaf4
MD5 0b6e980cd66790d4ebed539e2f1dd61b
SHA1 882a8b17cd62249605e7132393cdddbb9ea110e0
SHA512 4dc56c9b119a8df20ceea14a184b9d34f4c5ee512414ee98151785b1fbf13469c73ee04e37d48b303880dd8d58e91fd5c5278a1adadfd8b5d2b1ac88eaa63c22
SSDEEP 49152:Dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ux:SQRQyi36YOcPQLvw2gAf+PN3wfb9s
TLSH
T11B666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 09d2e54c207b490f1ae16b608ee779d3fa5e104e9b41a595e29f8fd7eb1c3bbc
MD5 c9862f3e07d7e453ed4bd4388d212037
SHA1 6cce7bfc30fc31cc90e1eb7bb688cd024c123e51
SHA512 08bad6557ad6672ed232de85ab462aa544a585b4b3706bf89238f0a7f5a37b9aae923cbe104320e502ab7b2c4dccadfcc2434caecb99d7fe66575e06fa9ddd5f
SSDEEP 49152:Tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ux:CQRQyi36YOcPQLvw2gAf+PN3wfb9s
TLSH
T1E1666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 682bbc136b8d852093141c5499b595c4ee303fdd88b1f96fe765d71e7c5ced1f
MD5 b004b9afe42619dc90d82436a584ebbc
SHA1 ad0b9ec97cde2b8cd11b0501095a6d4752ccd444
SHA512 feb457e0ceae468ad62cd5ce2f0e0850260db7d06f23815de94086570dd0228bcfa607a16b928dcc01d8454b1b569de685eb40febc38793a6b984310060cc4e2
SSDEEP 24576:gwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0GUeA9n/TM4NZYeq:G68Qg55nhheWu7PNU3/hA9n/TDbXNKd
TLSH
T1A2B55A33B2F600A9C44DE1769F4A972196D27C758FE0E3DB851172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 afae8974bf6a494494c2c3f823ebf0b7a1a4692b03f6a31731d81e26b325eb6c
MD5 b9b8c6553760d884a845486f0ba7fb6d
SHA1 2907dd938493d034729e0e479a6bf474eda3844b
SHA512 f5f09386102720ddda3587d1f9d11e456b6a1f44cc891d72bde680e7ef02578707b568f9105d5b5ac67f35beed2df1498cd975b57504b44b9613fb63dcb94129
SSDEEP 49152:z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99D:my5112gYy5azzVvL69nLKnhZ5fb9s
TLSH
T1B0167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 afc343d8cdad52aa5e25d8b6b631e5f6c8da761f1ae6936ca44a110e67f04f80
MD5 2dfaeb64dafff28522fb37348fe1712d
SHA1 2c67869d2f7be692f461eb01de9bcfdc583eabf2
SHA512 58f62bbb15ec7bef4175d59bf382f93bcbb1d1937cb524e16bb33992b24f95db55d4fa4f9d59de1183b1a133550d10fcfeab6f11e8c55f24a48d4611a92fefd0
SSDEEP 49152:pB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glKA9n/TDbXNKd:/u6JmVxd2d7fb9s
TLSH
T170D59D13F1D901E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7447cedca88cb04c51bfa56549186ab9158fb003ab6bfa3c8b02e4201eeb8da2
MD5 1de0bfa70f667825542b6aebb51709e4
SHA1 e849e947870f28a50cd6216fbf23ea536b06f912
SHA512 552a05258028e414b4a319e049c43c8164a63243ee120737a5052b22392f95b30825df59fd50943793918ecf2ee8c9a104e3f07a27bbf0cc6babeb51611affbc
SSDEEP 49152:S1hpsNoJpF1A6UU44CwH7R4xvA9n/TDbXNKd:SmifPbR3fb9s
TLSH
T1E7B5BE13F2D800E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 05f7f64e019926a2c6a0b087f904b9f32be62f39e17ed5de2cc1e09c339d9445
MD5 22be8e8af41d52348502fcef4337351a
SHA1 f99d11c46c2a2e4f4234d2806a66db73f9faba7c
SHA512 1c4cf9d798f54726cb003557e676f31f19244a22be96c63c586c128ea1ff36a42af7d6a6cf7fbb43a216c1e3dca6330bb1502ddcaacea5ecea91110a3289233a
SSDEEP 49152:pSuZQIY0Be2KRRVtOnks6NMHqAA9n/TDbXNKd:n5dKTi61lfb9s
TLSH
T1E9C5BF03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 fe505bf20e7d3a47af4c172d425044d8df52496e5daec0196b9aecd5de418cfb
MD5 c2831fff37caf8660cf85aa9dbbc15e1
SHA1 7af707b1e34c36712a9cd79710e4a577141a64a7
SHA512 d6458f73ef4917841226c188e57213d32ab6b1b947b32329b2af3c1dcc6a17428cd63154b3344c28609e885412641b386040de7587b4d811c230287e0bd1cea1
SSDEEP 49152:uhtSn8EApI0figngiDn0AP5wzA9n/TDbXNKd:vX2iyph7fb9s
TLSH
T1C795BE13F2D900E8D05ED178C7568632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 d9497797165764c0e07f6a6b38a7a81aff2699c2fc31a6cf9b034a6d16d9f760
MD5 8a68c9fd22b469462cb922669c4a9c6b
SHA1 34027f611cbdbbc97608211e35a45ec1a676674a
SHA512 435865a6cc147305c81359db33f27ea0a974659399a83bca48e7ecfe0ff77067dd42347f5f3fbf0f3b2bba742a07b620628543c1310e2b052f18e15794a58db3
SSDEEP 12288:66BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dL:66UeA9n/TM4NZYeNm+9MhUwd
TLSH
T12B6523824FFC09F5C7490AB584A6BB0CCD92BE4EF685439E470E722A5F385C6C9564CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 b752e86bc072765516a6111d4284d96317d8e70f3bf89bfef04e98e3933a9e88
MD5 e29f4fe9e537b51515018c62340993fc
SHA1 a8792c39a7383a28689d7460bd3368424bdc611d
SHA512 f04e358de70f4b843eedd207f96ee0fc2ef4d4e9ae0f6e11cf0e1ba164ce3a0eddcae36f8319845955330f023ea90f47d070c7ade78506cbef04bac7d173080e
SSDEEP 12288:GJBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dL:GJUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1016523824FFC09F5C7490AB581A6BB0CCD91BE4FF685439E470D722A6B385D6C9168CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 a4cb2d9acdde9878140870f4b36a68e68f47179df6369dc00b1702292ea7dbd2
MD5 bc78ced14105f4e272e2a6ec4281fc08
SHA1 3c028cc08e885fa72eed78ed6da04430d627466e
SHA512 2101c1c8c8a432f849566e21e1d3912f1b2034b017ff27664bb8813dd57e44339b79e5abcc88373001dafddc68106cc22ac4295278e3480758c3ed3a7900f7c1
SSDEEP 12288:ITBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dB:ITUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1C86523824FFC09F5C7490AB581A67B0CCDA1BE4EF685439E870E712A5F385C6C9568CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 1b32ecdb42f930708e9a89d537cabcad7a772d0c6cc1cc238c6c4fe4ba1cc7d7
MD5 6845c50d375bf44c23e08f79ce6547c4
SHA1 1c0a8d19be9896eb0e735cfe04507f1bbb3ea7ea
SHA512 7f06f0817123ddf1145f1bd5502134bc69fe82a7857b21f18aba6aad3a8b7409b1ab879150503a4699a725efca9c6fd6b77d69f405965178b49987dd93b9036c
SSDEEP 12288:sVMBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dz:vUeA9n/TM4NZYeNm+9MhUwd
TLSH
T17B6523821BFC04F1CB4A9675C5A6AB08DAB2BD4EE76183DF4705361A1F302D5CD35A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 ba9ac75c71321b24b3d93adb2f6a653a0af19f10697d67254188f4d78dc7c48e
MD5 6fa855b4a463487050f590b1a9ebcc48
SHA1 185caee6d27f049d421d03bf3466cdede33c86ba
SHA512 5d75c53341662347c75cd2ec633b7df9df01b067c4e0f3848a15a667f31e42731b9979a184187dd80a2ff6bb8f039001e5ad8327f941cb0e2e85890f43cf7feb
SSDEEP 12288:wEBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dk:wEUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1EA6523824FFC09F5C7490AB580A67B0CCDA1BE4FF685439E470E722A5B385D6C9568CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 953c057ca7a2fc64d7a6119e0f61c822e97c35e10469f9a9ee812703bef272f2
MD5 5ac161f906d656600385e64ceae7b09f
SHA1 19145280b93f19224b7abcdfa7827ea521cda20c
SHA512 bdb09ab32c8e40f3783222bcaaa98cf4fdbb8fd64b5f26bdedc9555b67b262cf714d14cdd910d528918602f32706b29ea581ff7ce298202a88bd29876b4b73bb
SSDEEP 12288:udBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dk:udUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1F96523824FFC09F5C74A0AB584A6BB0CCD91BE4FF685439E470E722A5B345D6C9168CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 8447203bbe44f9ca8bb86200d86343f30aa6e3f8482be291b20a37b6d2b43865
MD5 e0644632b67137a06e439762d1e3acab
SHA1 e549f187e1be8b8337b008b004996d60925e8dfe
SHA512 185bc0416f95e2069633106356dfa67f2a8a344c7adaee0c24b64d1bd56a185f97f0b4a3a92633fe53a23a620c5fe2869c23809d022529e53c3d55dbe5b34c5a
SSDEEP 12288:TBBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dV:TBUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1156523824FFC09F5C74A06B581A5BB0CCD91BE4FF685439E470E722A6B385D6C9168CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 984de7da535d9d4bca6502331286cf3b5a1939c5328f68d6791ad78eba9b34e6
MD5 d128e8f6bd12f63f22ee340777c8b3f7
SHA1 109959b03363f3e8e3319128e7d6d702a73a15a6
SHA512 b22ce19c215a07c995a367bc036b2f4c1108c7d39290f671a29213769c58f5803cc174bd8d5c087578f6675d2f59b45e8caa52dfa104d0cecf0e3b49a3bd0d50
SSDEEP 24576:PZMEzFVSOpUeA9n/TM4NZYeNm+9MhUwd:PZMEzfpA9n/TDbXNKd
TLSH
T1C8850295B3A00CF4DD67423EC8659A05D6B2BC1A4760C75F03A8362B5F333A14D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 b2141adbb4014e3e38cedc861959335dfcad6437883f33635c5c7c945f587d4b
MD5 f0929ee11ceacdc6effde017f6c83bd0
SHA1 b9b6340c65b4f662e367ad41d4086545765ca888
SHA512 54bf8796dac50055f315d9fee2ec352f74ef5ffb77a0cb767d0547282d8f1ee0e79fad5b5f90c93cb8a233a1e4e2ce960d7cb3b6951ac4168121962663883280
SSDEEP 12288:xmBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dI:xmUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1A16523824FFC09F5C7490AB585A6BB0CCD91BE4FF685439E870E722A5B385C6C9164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 204ce71e9cf84842f792dfa49b9a7c456b40d3b0bc1c47b5b14fa92f942eee84
MD5 b870bffb973ca46f3cbd0a78a9624424
SHA1 3f8fdbde84aaecd354baabb9ae7e995cf72287df
SHA512 c6144c98ee74c2450d5992e20365f16cd0784598a78b799680f419ae309438395cdb54e07443a83e81a0c464c217670eabdabcbe75a172f421fe4d454cb5357a
SSDEEP 12288:uiBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dp:uiUeA9n/TM4NZYeNm+9MhUwd
TLSH
T14C6523824FFC09F5C74906B581A6BB0CCD91BE4FF685439E470E722A6B385D6C9164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 336d1624fcd8d0d75c9588316591b61922a55608bad5721f7e7b90a5661e8d48
MD5 89f4b3ca713703b98be17f0b7ec835de
SHA1 bffa6ced3b68f755879a8e286a4ddc1217e8b7fb
SHA512 f7d97943c158456f56b52649a6d4cf537ce763cb4cf3c85beef359e68d692191bdca03f28b4f5cf35e988b578f0ded44d640ff847eb925051731acf619707aa9
SSDEEP 12288:NyPz5L8FBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dG:kzyFUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1C075024777B520F9C2664238C8A21B05F772BC3A57608BAF036417362F376D19E3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 cfeb208697da35fdf7e7c6759a9d16678bbb0a6daec2126884498695812c3852
MD5 7258fbc292a78aa7b3ed5314c18d451c
SHA1 15f637d1f049aeaa79e5b9f72060f3a328f79f55
SHA512 864c41a49b7d157cc9a2f606af1ee3812a04bcd616015465cd9cf1f043b49feae920254475886973bfc2698c613642c05f41d693cf60bc291cd5242bdcdfe325
SSDEEP 12288:kmBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2do:kmUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1DA6523824FFC09F5C7490AB581A6BB0CCD91BE4FF685439E870E722A5B385C6C9164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 9d27f5e828e7c6ed5547f024d4919fd2012da3c783b940e6a07f801e8cf02cdf
MD5 7b8d9fa24a5864f47168179526943a8b
SHA1 3dfd0299e55514b1e6ae709bfe9774e23e86e379
SHA512 51e7835e08d96458b4a5e3261921edbe10806e9eb9d8d8ed6d2db49745b69c797d4aa3c75bcbdb238fac2296471a2a2facc3376d9edce2f986dd78ec478348fc
SSDEEP 12288:MmBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2do:MmUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1106523824FFC09F5C7490AB581A6BB0CCD91BE4FF685439E870E722A5B385D6C9164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 93bc62d06d9dc04013ad305a458e905d502f84f8c027db4f051c13bbf8a85cc7
MD5 37b1b7773e1ce8a45a9022bc8af7695e
SHA1 0a43d4cfb7337839029d522152ccd0e388e1eae6
SHA512 817577ea91305d70d092601b810b8a5bdc08e994a70bb9cc67de0a182d80bbc5b8add6534634b398f3816e5434d5df9bc94ac673356c6248203c2e7927c25812
SSDEEP 12288:ByPz5L8FBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dE:QzyFUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1F275024777B520F9C2664238C8A21B05F772BC3A57608BAF036417362F376D19E3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 df78174e43f3f69afdfdab06d0896edc7a0b4611c3bfaa2f2d20ee60113e4a2b
MD5 4a1452770c7055dfe5fceaf1fb5d12b7
SHA1 8b09f212622138be4b6a64d7a9e46ab635030804
SHA512 1f03cab8ed97dae69fc285a3e25aef2bb8816e3416388cec367a04fa1861ad06fe0d20c46266352f0ef5609817c0be04b535c2f99767d306ed188eafb58be8c5
SSDEEP 24576:kTdaLl3z0zDDUeA9n/TM4NZYeNm+9MhUwd:kTwLljiA9n/TDbXNKd
TLSH
T18B850295B3A00CF8DD67423EC8659A05D6B27C5A4760C75F03A8362B5F333A14D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 21467bd0ec0e05dc9375f8d5a8683456258a8567d9301e69021bc61353f4fe5d
MD5 3d0c4599df6c07390aaa0e9c9ff840fb
SHA1 0b070a31fc1126ba47bcc5eb4bdf5fbdb26ae6b8
SHA512 024bf27b15efa9974ef65e15f23782cc766030276f06e3785c7d1ca1191b56d2781679c47b2a741690cf7c2923ab02235cbb64637ff591348e41b30586fa6329
SSDEEP 24576:e35d9CHKy7GZHUeA9n/TM4NZYeNm+9MhUwd:g5d9CHKyapA9n/TDbXNKd
TLSH
T19395CF90F3E814E8F1B79A3589765501DAB67C5A5B31CA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 0fece7548655ec5dbe56ac739e09bf4dd57c2c265e68b66e699e7a00e0e85175
MD5 1b452992f4610a05a67576fa9976ab48
SHA1 e832ad191f49a41ddd93a8f3ba5f88b443008fdb
SHA512 500fd0b82d34f85593db7148aca87cae864ce198b6c226cca365f767f43c9b54d8727a4527dda500fc216eeddd620e9a847cd7e460c7e8435540b6c7ea9f0915
SSDEEP 12288:zzBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2ds:zzUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1886523824FFC09F5C7490AB580A6BB0CCD91BE4FF685439E470E712A5B385D6C9164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 996948f9755694a660673b1916aea46c43f1dd9bbb5a10a11ea6330d6b0ff03a
MD5 7b5a06dd228efabf50843ab66b41b611
SHA1 cabecb526727777155a57097af903952629ba205
SHA512 fac515969d45cc43b872354791e851c36375484fb715e74bec308cd7b6aaff2688ca210a083d4f546dd998c92ffc3b67b950995cba395ec42e9e8b2bd0b7871f
SSDEEP 12288:ilBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dZ:ilUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1806523824FFC09F6C74A06B584A6BB0CCD91BE4EF69543AE470E712A5F385C6C9164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 1c66ae1dab1ce90666cf5fe3257066f9ef44f48cedb8f83e5f2d7b860d8334d4
MD5 4943acc73002a54320d9213c99ca4158
SHA1 29ff7a01c1864f429ee5297b8f62d3aeaf604a01
SHA512 6da7d3af93c168dedc5e0aa639f26c2e137a9fae64dee284479a373b0a15056a18220b1807ba2be044201e470c963ebe00c4cf26ea36c7b0bb49291aa6e051be
SSDEEP 12288:Q4BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dX:Q4UeA9n/TM4NZYeNm+9MhUwd
TLSH
T11C6523824FFC09F5C7490AB581A6BB0CCD91BE4EF685439E470E722A6F385D689164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 818d892b496a4d6938f5b545ba51feb7162ed5b2d17fbfa706a098651f00cee4
MD5 c5c28ff7abf6ccae02c81277c9849974
SHA1 94a94485dd979598c16801389d88beb00dc225b8
SHA512 a79a476df45d5de7f94a66c190acd90da5f3c8de1c9de59256f09e588c4df6901dd82354bf8b5a16dbb772855cbfb45eee113c5e668855072a0e37b1ed13245a
SSDEEP 12288:bmBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dX:bmUeA9n/TM4NZYeNm+9MhUwd
TLSH
T17B6523824FFC09F5C7490AB581A67B0CCD91BE4EF685439E870E722A5F385D6C9164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 775c94ef3f396ce90ae1508f0b3e632fda235182d47a4a8ee4cb190a117a7f5d
MD5 23b98a3ae6b5ddd110da6806f9e5d649
SHA1 5a736cf479c3732350a05b964a56a783f41a9e23
SHA512 fb772560c2932b93b1a99afcee9724e4f30dbe0e24afd35c383a29094299185ae5bd00008d623b080db169b3d620fe5cf86ddeac32426c72d0726a12dad339ad
SSDEEP 12288:7zBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dz:7zUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1D96523824FFC09F5C7490AB580A67B0CCDA1BE4EF685439E470E712A5B385D6C9568CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 580b02e4c61e3019880eea1798069bb7840ddde17d482b5c26a27d2421e7dd26
MD5 3ae65aea13991a794580ed355db16a6b
SHA1 4cfcf1098a4785261b7cd8ff3e35888feb3360aa
SHA512 8879d782150f00d48ba326c8b3d8763c06a6e82ee382a208a0d126c4a86fc77a8bfc4fdc5178871165294fb2e8a5e2a845ca8f359f6332d8b472a103f90910fa
SSDEEP 12288:0+BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dU:0+UeA9n/TM4NZYeNm+9MhUwd
TLSH
T1F56523824FFC0DF5C7490AB585A6BB0CCD91BE4EF686439E470E722A5F385C6C91648E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 9d30836b20e48f92849bdfc87eb17cb4e65a6224ec8d674751d38f9e57e0f20c
MD5 151ba82becdfe49a863d0e6b81e5b60f
SHA1 fda8b391a3d6e99ffb4bb0b446aaed8db99d963b
SHA512 17031a8eab84fcc06ac56904df6437546b3f4adc28e620251043794787fa83cfacafc11960849ce16ccb30ec12772ef9ea591a8b18d2a67d2911a4c2638d18ee
SSDEEP 24576:Bfwv+k9RX6wkyAIxUeA9n/TM4NZYeNm+9MhUwd:xMnYI9A9n/TDbXNKd
TLSH
T10D95CF29EBDC04E5E1B7923C89B7460AF6B178591B31C2CF025A536E0E37ED49E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 0cd7e972ae485dcbe0f4d267ccd0098524498cf5c13e5f3fb6eafcfa4d5515eb
MD5 e64f8c9029aa0e08e7ccbdb08402e764
SHA1 d8854d5c3d15f2ddb50621835cf5ee934eb2be1c
SHA512 dcf9cf888ab13ea27f3aa523c4b743473dbecc861c723c2f5af8c163279e0b9adc670bace462a9c77d322f7789e633d9de0908f0d38d3a856b8822b1c69a7895
SSDEEP 49152:mYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0TA9n/TDbXNKd:YySzPQfb9s
TLSH
T105066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 624f24a2c0638e3637e0d3eead4105e24e76cce0d0795ef305c5b7ba00be508f
MD5 8ec26ae3abad2073f550af369df7c595
SHA1 3f3c0c27bd3f09b9ae84da272c07556d44fcce8f
SHA512 ad6db3240c20b0e297317bf95a4dedf6f9d30cfa13a0625b8c87f7d31b4698fa32d7acada0324bf6c8812323dafb85adac5618c214de1d209f9836a76d6c55d4
SSDEEP 24576:S47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY5UeA9n/TM4NZYeNm+9MhUwd:S47JUQj1irIhCnDHUPfF/jA9n/TDbXNs
TLSH
T11965AE1EA3EC01E5D1BA927885154A1AEA71782E5F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 39926f1cd18df8e5457d478809503b5faf3ae707ce57f98e866fc4bfb0120c97
MD5 28d9ba6ea7d2b4153ae8fa12ff9c6e85
SHA1 86a7af53d5decf501ac8c84d6cfc4adc51155b3c
SHA512 ba04f2d00cc0fca72bf2cbf8c186d333b844a5c20e14c98c551eb0c1f5a1617b7ce4a88c46fd43d84ec2aa6eb17441fe07564a39e8956b8abae88f8e36c5fd95
SSDEEP 12288:ZzsfWBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d8:gWUeA9n/TM4NZYeNm+9MhUwd
TLSH
T18F75F04AC2A802E8C15E6279C7965A04F7637C2993E1D3CB43C0F53E1F366D19DEAA47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 968KB
SHA256 df20caa87412b50e6bcc9b31b142b924533311038677bc5a623e4fe92ad2271f
MD5 a7779986fafb7e2ae5322bcc71026af5
SHA1 a3f454699f69222e8a5d544f379f1ed20ad6f5ac
SHA512 055f9632ae53f0369ddcacc2830723a70df7208c1affc665e8251ba9097608407e00e9572560cdbf418221c31d22d01b9d157a4e8d4cc51f80deb83e41b9f53c
SSDEEP 12288:FsbJAk54U3f2yg5rZ+pjR5PVylrjV8ohS:FsbJAe4UPY8/dVylnVq
TLSH
T1D22507007626DB4FC5AA50322E76C6CCAB70BD01FE499B1372C9473FC576658BAF5282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.8MB
SHA256 1f3e83e56ba39a2644aeda26eb6c573842202b5f90d152b59a23bafda66f97a0
MD5 6beb069c9ee0de8005e7f1aa5d801c50
SHA1 f7a4baa1d77e0dcb0acf4d3310014af74e2731f4
SHA512 b7ea558faebba0dc000d351d6d6c213e17b8c31a3f4bca52768c036ad1a30fd1794c54550dda9e39dafa7e0b701d99a7b9e150804a935b27938185bc34f5f90e
SSDEEP 12288:ie/3sDh0rhTbC49t6bUIkbpGU8qPac1vr5ihvzJdg6P+kjRTLeC5LJQ4r:ie/3sDyxbC49kAT9uvzJdg62GT5LJFr
TLSH
T189853A015577EB4FC9BE50331336958CAB74AC02BB493F057385893998AB96EB1F23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 f9da90005b386de90c65e108bc0a6f363a896ab5ad8197850c5afe7400cd1fb6
MD5 792fe16371bf32e3cf93773c90afae5e
SHA1 32a3ef293c2a8a23e43eac8ad4d899eece6831b3
SHA512 b6ac2cf5d449481ffbfc787b01e91e0d5262f6f8dfa55e75822ac47fa3c2de5188b2acae7d3b394e7a7dc0a689b00081d9c497a822df49b2ee5e0f33e73cc1ca
SSDEEP 12288:MO79BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dL:n9UeA9n/TM4NZYeNm+9MhUwd
TLSH
T15F6523824BFC0CF1CB5E1A7440AAA70C9E56BE4DEB4483DF8609722A5E345C6CD7654F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 77b75ff9ff91f6ff7865002c56b23dc8009bb96cb0ddb56f5b36c5a77afc1edf
MD5 a1f0fc53010e21773b4f6b36f134181a
SHA1 8b18ab70c6d5673df87aa402b38481698872daa1
SHA512 0d639fe265a16e68d080a29a2e2a3510c4bebed57665a4d4500e0d96a82d30ab1800f21ea13f4bb12166e6e9b25505519fd749506db7522cae863a228773543c
SSDEEP 24576:Sgb6bmBIi49WNNFpg1rSvFv7bYgUeA9n/TM4NZYeNm+9MhUwd:Sgb4mBIBhGFFA9n/TDbXNKd
TLSH
T1B565AE1E22EC02F5E1F9D2B88DAA4417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 eb2da64cad99a691cc176a928596a3bbcb7ff383560fc5eab3820523eeda9a2f
MD5 23c933e0fd7f221a42a824522c9d7f68
SHA1 28fd2d89837ba57e943bb31cd9506609a6f6a3d2
SHA512 8b09ce6c4e85a4a42278ecb581bf71dc71a79a7ede63083e4970a71f17b0ab96298f132907a27e9cf76593d0c09f7edba38a34e302da27615ba5e86a96519281
SSDEEP 24576:zG88u8FpJqH1hzria7/mpUeA9n/TM4NZYeNm+9MhUwd:C7ZFPqVoa7/6A9n/TDbXNKd
TLSH
T19595016567E401F0C47BD13889824667FAB2B8251364EBDF07AC8B551F23AE54B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 b57ce21364e79055d02d87a9c49dd248514c0a9933048f9e6b044fbd76cdb89e
MD5 cb4f846f35139eaaaa3f2589b5013fad
SHA1 21052ee1b6fc7d7c889abdc09f3643aa24e660fa
SHA512 2d716fc2c45f55cbf3fd13e03dec6773b27ebec0b3d908501ba0be51f57d16e63dd994fb76d859605368284873d4479ccb03838ce6152df0b90f795f0a02ccaf
SSDEEP 12288:dHvUrBFrEjwaQ+BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dM:dPUr+NQ+UeA9n/TM4NZYeNm+9MhUwd
TLSH
T12385E11F26EC0CE5E67AA17D8582870DE772B856131292CF0290817E4F37ED8AD3EB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 93b3c1a97f6c5f8d5c116d8601594eb357d4254842d04ca90abb9dc607c80da6
MD5 9eb2c0eaa83ec58ae4be521c7b304840
SHA1 34c4d34cbb06e6a7054689940edf8db96b020dd4
SHA512 8cafb2815655cff6a39a87751fce7741c6568d0f5472995f8982aefff900b6ef3bddf4a894d624419f3e632e199ca9aefc9b58970b87b55f86c4dbe21a4ecd6e
SSDEEP 49152:QBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjYA9n/TDbXNKd:LG05lO43bmfb9s
TLSH
T1B7D5C06A62EC01F9D1BBD17CD9C64A0BEBB23815033556CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 14226d0ab9593d6873b6155adba105ebe04ad2b5be60bc49397edc792c98713e
MD5 7c12f038cebcfdc4dfb0c962cfec1f83
SHA1 74c0007be08a8097937f308e4bf69f4931159ea6
SHA512 d9ea021d8157c51b017b3880803c91b0a65610cb3e40aaf76dced3c1a7eddfc5ceceba5d5f1bd29a8bfaae272e6c8de1780d98b9b1fe6c8314cf653c4e0abb6e
SSDEEP 24576:afa5POZ3dpFWVM50JicR2hG0lasx2+47eidnfUeA9n/TM4NZYeNm+9MhUwd:ya5POZ3+Jt2pasx2+mhA9n/TDbXNKd
TLSH
T12265AF5EA7FC01D5D5B9D17DC583860AE5B1342653319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f3332d20f0651a2762515b8ad6d7fe1c6096de69fc2fab36673b3ae76f22e955
MD5 6e2f08490ca700e24233649e4ee1f5da
SHA1 b488fb7b0080fe0891813867646a6507d2f6a8b0
SHA512 1c7c39bb19ea9303cc4446e5f902e9bad24d904a11944d801793b6d7f67229f8d6d214d5fabda093254ed2e933315c3c39c566d8c92a0fc3d5f6c841ae309573
SSDEEP 24576:PNcwHdjbyQ4nLC18lb/EOjowL7FkyUeA9n/TM4NZYeNm+9MhUwd:PNc/zEOVHFLA9n/TDbXNKd
TLSH
T10B858C1623E901E4E5BBE1BE89779646FA717869533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 948KB
SHA256 336ed27a38b5cf896b66d6f719469472ae77a3e6720fc91001aa05aadf120535
MD5 e8db79d3c0c1d71e7055ce86ec1acd3f
SHA1 fb8f00b1000a7446ac04496229e79747c34042fe
SHA512 e3deb8a9d005e33587e40966a79286ef5acfc1653ec63d6e9ac0485b6abe0186accefb3e6dcacb9113fb7e0964932a6dee1dc1100e09abb3407f1267b344c865
SSDEEP 12288:AiHPkij5ZI7gyLvMtKPMyEUhiqxl4y1uimhsMEm9CLX9U6Pmne2zxj83vUfwN:miDI5vM3yReRdqmCAzxj884
TLSH
T14725126D63BA10B9E177D03E82830543D2B2B0758762AACF5694D07D5EB3FD8BD38A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 60ec5125357234e7afec6520f2d16f31bee64349c0986223737ef32302a3fb6d
MD5 584d65f592ed9b01714c546d3a4e101a
SHA1 b9263bcb12dd873f9325543ae29988189a5c0fc1
SHA512 a856ad1c9d972be5419cc1e5280cbf69e1b9b5d0b967b9c7d8b38d932d4c33a02f646e05a57309b1424706728e43b49c698e607ef39462e402686019db9612cd
SSDEEP 24576:K8kNvNnaFeYhJNtmZBmkUeA9n/TM4NZYeNm+9MhUwd:K8MwBtOmGA9n/TDbXNKd
TLSH
T1CE55AF6EAAF805E4D1FEC6B58D238516EA727851173293CB4390C13F0E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 cc7b3aabed848a5d98143a922565d2d11f7385fe240d49fd66bb6406b989ce4d
MD5 df0053a24d724daf77da4e49ce046923
SHA1 cd856b44f7df248189eecf22d98cccc02f450a06
SHA512 34e806a10acb9898af5039efbf77f4267951eb7b9038f7d519c6fb6e47a61bbf10b9bcff85e6865f4a865aff60e69e1c6e561a94111fee4ad7145f5d2a3085cc
SSDEEP 24576:zD3FHshBIYQgAaUeA9n/TM4NZYeNm+9MhUwd:zDVHeBIAAUA9n/TDbXNKd
TLSH
T14D95E17EEBAC04E4D57BD1BCC6638A06E77138AD032156DB0294917A1F2BEE46D39F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/248-334-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/248-89-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/1112-45-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/1112-59-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/1112-57-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/1112-53-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/1112-52-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/1112-46-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/2572-161-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2572-163-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2572-159-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2572-153-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2572-152-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2712-76-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2712-81-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2712-73-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/2712-306-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/3420-416-0x000001E4725E0000-0x000001E472828000-memory.dmp

Download

memory/4152-93-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4152-101-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4152-335-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4152-99-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4152-355-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4152-353-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4772-175-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4772-169-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4772-168-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4772-341-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4960-92-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4960-27-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4960-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4960-28-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4960-21-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5248-40-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5248-41-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5248-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5248-140-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5248-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5504-115-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5504-109-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5504-336-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5504-108-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5504-340-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5504-338-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5628-117-0x0000000003C80000-0x0000000003CE7000-memory.dmp

Download

memory/5628-13-0x0000000002F90000-0x0000000003015000-memory.dmp

Download

memory/5628-1-0x0000000002500000-0x0000000002567000-memory.dmp

Download

memory/5628-6-0x0000000002500000-0x0000000002567000-memory.dmp

Download

memory/5628-14-0x0000000002F90000-0x0000000003015000-memory.dmp

Download

memory/5628-122-0x0000000003C80000-0x0000000003CE7000-memory.dmp

Download

memory/5628-72-0x0000000000400000-0x0000000000861000-memory.dmp

Download

memory/5628-136-0x0000000000400000-0x0000000000861000-memory.dmp

Download

memory/5628-8-0x0000000002F90000-0x0000000003015000-memory.dmp

Download

memory/5628-0-0x0000000000400000-0x0000000000861000-memory.dmp

Download

memory/5984-142-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5984-139-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/5984-148-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5984-337-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/6132-61-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/6132-68-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/6132-62-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/6132-264-0x0000000140000000-0x00000001401AF000-memory.dmp

Download