3bf03ba36b0acb175c686dc63a18695fae4d561b85193cf8b97ad6eb0bca0681

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_2262036161bdb702048d85ae962975f6_amadey_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Size 2.0MB
Sample260930-e2kbsassfz
SHA256 3bf03ba36b0acb175c686dc63a18695fae4d561b85193cf8b97ad6eb0bca0681
MD5 2262036161bdb702048d85ae962975f6
SHA1 9883133a8c8165938ba55614b3855ac27b2cbd0a
SHA512 49120dcdbcd5bf8c0244b91d417347330da5ce2d7103759da7eea8267c7e66aa3db6602431ff3b2bbd4765b9ca53592d361127032d87b6b8f96ea2c8234a3e2f
SSDEEP 49152:HclPBqC7KKYFBGZJ7LxfJ4klKXn6m1gvtlxSGLdrFxz:HclPpEGZXfJ4kigf8G5rFxz
TLSH
T1E7A50111B491E036D8032172652CF339A639E6064F708ED7D3889DAC6FF55D21E3A7AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2440	elevation_service.exe
3460	elevation_service.exe
3852	maintenanceservice.exe
2688	OSE.EXE
5888	PerceptionSimulationService.exe
5176	perfhost.exe
4596	ReFsDedupSvc.exe
4320	SensorDataService.exe
1980	ssh-agent.exe
6116	AgentService.exe
5404	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_2262036161bdb702048d85ae962975f6_amadey_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_2262036161bdb702048d85ae962975f6_amadey_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_2262036161bdb702048d85ae962975f6_amadey_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_2262036161bdb702048d85ae962975f6_amadey_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6bef4cbc612dd39a.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2952-0-0x0000000000400000-0x00000000008C5000-memory.dmp	upx
behavioral2/memory/2952-32-0x0000000000400000-0x00000000008C5000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_112109\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_2262036161bdb702048d85ae962975f6_amadey_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_2262036161bdb702048d85ae962975f6_amadey_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000660f3f209450dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009c2f05209450dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000601ef5da9350dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000798a5adb9350dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000044865edb9350dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000017f1b209450dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002e4949db9350dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2440	elevation_service.exe
2440	elevation_service.exe
2440	elevation_service.exe
2440	elevation_service.exe
2440	elevation_service.exe
2440	elevation_service.exe
2440	elevation_service.exe
3460	elevation_service.exe
3460	elevation_service.exe
3460	elevation_service.exe
3460	elevation_service.exe
3460	elevation_service.exe
3460	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2952	2026-09-29_2262036161bdb702048d85ae962975f6_amadey_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Token: SeTakeOwnershipPrivilege	2440	elevation_service.exe
Token: SeBackupPrivilege	4596	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4596	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4596	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4596	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4596	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4596	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4596	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4596	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4596	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4596	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	6116	AgentService.exe
Token: 33	5404	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5404	SearchIndexer.exe
Token: SeDebugPrivilege	2440	elevation_service.exe
Token: SeDebugPrivilege	3460	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5404 wrote to memory of 1616	5404	SearchIndexer.exe	101
PID 5404 wrote to memory of 4612	5404	SearchIndexer.exe	102
PID 5404 wrote to memory of 608	5404	SearchIndexer.exe	103
PID 5404 wrote to memory of 5688	5404	SearchIndexer.exe	104
PID 5404 wrote to memory of 4488	5404	SearchIndexer.exe	110
PID 5404 wrote to memory of 3420	5404	SearchIndexer.exe	111
PID 5404 wrote to memory of 6040	5404	SearchIndexer.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-09-29_2262036161bdb702048d85ae962975f6_amadey_darkgate_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_2262036161bdb702048d85ae962975f6_amadey_darkgate_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2952

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2440

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3460

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3852

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2688

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5888

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5176

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4596

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4320

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1980

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6116

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5404
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1616
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1704430598-3087477806-3297458608-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1704430598-3087477806-3297458608-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4612
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2656 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:608
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 2924 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5688
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4488
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 2924 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3420
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2656 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 09fc981a108d2696b8a898ba6ae7ee104591dce92ee951da8c21c83818e0dea4
MD5 94b5cd6bc7e6a3d8db2d5a540714aff0
SHA1 aa70abf2d1a1a70922d40474ec2ad1ec72885722
SHA512 f7aa1e8cfe484f9104a3f3ae378b90550df6316504737fec636ae92f1b287c3e083822908a595dac6777bda8186ec47038d0443754bc2914cc2387d7a6b7e3c5
SSDEEP 49152:9b+632BuPkFKRrdE6ohdstBhuXjfS4LWxn0fJ4klKXn1:D3q6mjBHfJ4k
TLSH
T168D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 0775fd04efac38a65ef852e69755a274b917cee00487285d7cf965da19d698b1
MD5 ca313ad4a232027363cae30f7d4261d8
SHA1 e5e6bdadf3b70eef7aa1c8806e9617b46d7dade8
SHA512 9dfe74864efc8b7264a172cf2fcdba599b8e2003dc24bc66dcb24de42e963df9e8dd0b67a390e62b1ab8e79a1bfc932a3647933d9906630e0ec0e952b36b6eb6
SSDEEP 12288:x1XLsswWkxy2lRq2czA7fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S1:/XYfDtczA7fJ4yL/tNCJPXUQrPq
TLSH
T13105F12973D008F9ED67827CC9A1C101E732BC954764E7DB03A099662F776D81E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 9fcac124c0586580660bea0168fe5cd767f067e4eccdafb8f38b29b6c0ec378b
MD5 b46a862895b0f0f625892f1bf0ec3a77
SHA1 607f18480297f38c6dbddf7ba116b653dadb8636
SHA512 6537be76d4fc3c06de6368fdbf48eff74dcc38b5edc8c4ba0ccac782364ef1406827ebfb636f0b3bf254ac30c64686308cc3328448c67fc01899dd39149e515f
SSDEEP 24576:W0Le5ji0hmxhrM8fJ4yL/tNCJPXUQrPw:WPji0AzJfJ4klKXnI
TLSH
T1A735AE66F5748335D073C0B9C5D2A68AEA71308257308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b127b9bf3deb5fb74f981c729dea5e0b89349c63dbfb02b36ce478eff69d2e47
MD5 e5f589c4cc21f5af0b0f0d2ad3158626
SHA1 84a0c2aeca523da0b9b60df7fad2fcf3436b141e
SHA512 aa7214af37fdffc215dd168a5dd60e617b07607b7df5274c6aa7e15df56c40094b4ac10d61cd1ab056fee1fd12ab007f1576530b080e144f7dc301f8327ffe55
SSDEEP 24576:ca7/ezSC6vUyD/aqgrvWj6q8wyu+fJ4yL/tNCJPXUQrP6:7/ezSC6vUzPv+Hjy9fJ4klKXnC
TLSH
T1F6756D25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e242e7c6cd6ba414927537e704c89104dcba2322b200c4ad53baa4eb674e492d
MD5 76d7f06c0341b6c86560a6fb532ea667
SHA1 79283e8b1828455d61471476c2d38ae38d3a14c6
SHA512 dd1f5301a086ee73925230c8012fb0205c0a95085094c856d4ebb8c14ed3b71af39bbc6f5a4974f01f52f9526f3d79bdd37ae807d681e9b307b6e6d75129bad1
SSDEEP 24576:IVbqPb88hv/l+B3fJ4yL/tNCJPXUQrPR:IVO88hXl+pfJ4klKXnZ
TLSH
T134559E66F5B48331D073C0BAC5D2A69AEE3234425B318ACB0246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 6a84f0106924e49301c5aff861c9f44397d5f7bd880c5c64f4ff8c3d15f9be91
MD5 b9924df728ee2f512ace88f59698b8b4
SHA1 08b92d62697fa39762072523ac414d7c2569e860
SHA512 a69b248c327f08251430514ba9cc19878cd3c35fb1fd2172ef0146806749ec0ad20bdcd7b771ac3fb0b35a3c983f5caf1857c42a3fd63d3fa98866a12fc60d53
SSDEEP 12288:RGofJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Si:RGofJ4yL/tNCJPXUQrPd
TLSH
T166C423E751849486DF6687F82788F001C704BEC5562FA2F6DE82B8863FFC91A559C363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 29a89e5735445505dc9208dc9744e0f623b6c6192a9226f0b7bf6e7a5b67a184
MD5 89c690b7152c4777dc5022de56568aac
SHA1 2fb89e401775c4a64eead3441b34b98e9b94a7e3
SHA512 b167bcff90a3bb43db5b6ebae612527c210707fbbe4d5c051e965f79581d40a6a7996d6281c2544604e733944fc36637a02ee5a655c939c9551baa5707270cb8
SSDEEP 12288:8eBNUbTVO86UffJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SK:8JIUffJ4yL/tNCJPXUQrPR
TLSH
T12505C07BAE28FCD2C67A8DB85790C200D77278704B22A3CBD165C20EDE275E51E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 64097e667628741748689d5a61717fb75e8f619caff1ca17c738a9b65eca762a
MD5 44e841e6152d836259dcfd2addce4c87
SHA1 6687e284440e6e4fbadece820a9e33aad6c4c63e
SHA512 adf9a1c0fa8964c61696215d39aad87d2b1c04c87700db0b9ee43f11b3baa5d88bbba715d035a1c2bceeb3b91f136a5d06b444ef3405ff1e95fce16918e00384
SSDEEP 49152:DQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THe:DQvGAdlCEL8c/WRNw5CufJ4k
TLSH
T1E8266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 59da5a3484e7f53c8474f3672581b4f199e10de93d2d39c988b389ce1b5d8d05
MD5 133ddbb8b1a34adef384dca8c8907646
SHA1 1f85b918eabecedd863931cd8e1e81e2cd68746e
SHA512 0d3a23453dc67e8bed18031af8e4599a7df3adc4e65e34fa829184e703eab4d95fbbf61488ca67dfa86dc4583206657f6ff95d769d6a1401c6736d33612a0d0a
SSDEEP 12288:fAwSfxL/2Dc3mDLLmt0LDQewsAj5fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yWD:ofewsAj5fJ4yL/tNCJPXUQrP1
TLSH
T15F15E031FA74E036C77F0DB51B25D306552CBA604B621AC3E3E89D8E5A742D2237AB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 141732915008342da2e5423db7c0b12824e47a432ac4dbf42f57ccc7daebe1ab
MD5 6c126c8cd165d65dddbc5b78ab459fb7
SHA1 795b9d4c81ca5c4b843fadbb0cbe0f75e7b7a48a
SHA512 81f5e6def06a97688324cd6d51bd9c18f4bc0f983f190e3341a8a649c14ddd617b218d620a2167c6a8260acdc24df48e61f9e65c67ea51f0d46791c9aeec60da
SSDEEP 196608:4UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHRfJ4:4UEtQevvqc2W1cpV20I32R
TLSH
T132474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 bb8c89995f03d4447aa79d5888ae9569e6046a452f2861c322cf4d5db0643913
MD5 2862afa0ff9235d30c83f80b02f74a0e
SHA1 8465f2d03ac0277ed33786165849b17428ad37ed
SHA512 eec77c29d15ede586c118d2fac7a121e2b3adf8fa62276099683b4478cba83cb2f08a601756f3e4b44bc6996f23bc0900c73088aa2f3420e28747f44b09a481d
SSDEEP 49152:NCbRquA/m2yL5zQfFiV+XenmE3/zZfJ4klKXn2:qoqtVjnmCfJ4k
TLSH
T146D58D0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 15eaa0203ad309f6e8b7952bf797f4c5774aa2be81b2d28dd91dd5c1ca5d2743
MD5 9fe0a4ccb920f05bd80f0ddfd115e57e
SHA1 9fc2cbc6c5a60377985be55051bf248d950a423a
SHA512 388ec39b38a8ddf5b8c9a502a9efb3f396a4dea3e46b0e5b47b0e181a88ba2245eb52e65519b95b3b8d79ef991202bbccaeb15212d2b9ea02b1bfe15f5caa1f3
SSDEEP 24576:uAhGL6IFoiwtA5l7S53ifJ4yL/tNCJPXUQrPu:uAM5Foiq5yfJ4klKXnW
TLSH
T163359D81E7F955D4F5B3AAB899B59170EA76BCAA5E31C20F2250D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 730b56f04e581d2d579cddb4abe28ecf5fc969837a693a4a08c84dd8b2a01434
MD5 203f8f41d2e6770e403dfe934794d958
SHA1 39f9661166456c45a871ef529be775c702a4f9fa
SHA512 7b95e8643f8f0075396141c85e39ededca3afcaf0b11a2a47a9528dced46839c6cfe1277726b1036e3743958ded755bd2114a6bb8739e613b18d50b7489e090a
SSDEEP 12288:omw5HEjsChNEBFgl0WDm+CefJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTK:FwuROWdfJ4yL/tNCJPXUQrPO
TLSH
T1DD05F14A32E41CF9E96782788687D132F7B2BC422A26D71F4760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 230bd6584113ec243d6a61aae0cc6d794981759be00ac51a13b9404b0f4e340c
MD5 d51e472f28d74cf212f3697776fa10d5
SHA1 3d456c7509d5297361157a0d20774a8996bce0e5
SHA512 39a6ab659852b326c73352d91351e6719da75b4ad96dcc55f2bf2a8e5184b8e646da0775753e6ddf709014915cc8b9757fbd8839db962ef05027b6035ab9afd8
SSDEEP 12288:VyZ1IypfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S8:MZukfJ4yL/tNCJPXUQrPj
TLSH
T130E4129B32D460F9DAA782BC8AD4E101D3317C92273A43CF5A5155963FBBAC61D3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 fceb767c19df763ab25774e56135fb5793b43aee485ea752891fbc5b0a7f26fa
MD5 7f092c66668184c43a6e4688eb485a4c
SHA1 340b95a85f4df206e3dc9fe78f54c607f3a5c246
SHA512 36e6463d38cabe30cc2e0b03020fd7aade9b60e974896c7491c8d623bc1c3b498b71f6daa45e5780d98c5870d1d102553a1fc8135cb03a48ddc2c6f54b262934
SSDEEP 49152:Cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Uz:hQRQyi36YOcPDLvw2gAf+PN3DfJ4k
TLSH
T13D667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ba4297e21c5bb3a196d48a15d395bb2f7631964a5f9bcfe6c58f5388cb641aae
MD5 efbd761ce56da8a9106128bb01086b7c
SHA1 287458f1da81c68410c66957c65da6a036f70752
SHA512 1b228cdda58ff7fb1c8108d45fef800766c2e598ae303e23d0f5d65820bfcdb0bbbcc89353c052f133c1eeffabceaef44ac48e54c42d8cebf7422d51320be9d5
SSDEEP 49152:Cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UU:hQRQyi36YOcPDLvw2gAf+PN3DfJ4k
TLSH
T16E667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 516f83bea6875d860850f8e04b3c7c9569828a637b8fc263cac533b8abf7e888
MD5 7fd9bbcb5392eeb118291070799968f9
SHA1 7e9adc5043bee791aa2eddb38aeb200ba415e507
SHA512 a924c8dd2d04edc23ffd5d25a48faf1c7ecb3d66fb82d311c78b4d49ce58499ca88c720bb3672d7bfaea9e21e8e039a508a86d3ff8681acdaa6fbdefdda645fd
SSDEEP 24576:BwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL00fJ4yL/tNCJPXU0:N68Qg55nhkeWu7PNU3/JfJ4klKXnf
TLSH
T1DDB55933B2F600A9C44DE1769F4A972196D27C758FE1E3DB850172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 082aa29723ac06c358c802070cf0a066a0392d755c72f56ffab690f05ab0c8c2
MD5 ad39faee5205e23ab3676c7a7095584e
SHA1 df3cbdd1b921b3a7357fa63e28d473879f7f24b8
SHA512 e02abaafacf77745c6d1087f0b7b0b313511bebe701ed974c80f24e3a80cc1b7e6e06e9382cc63d7900afc13b34d070e9da521a8bcb610d7ab03a33222af0ec4
SSDEEP 49152:Z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99y:Iy5112gYy5azzVvU69nLKnhZofJ4k
TLSH
T1F7167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 358e8f90236d4b22686ca30f83103d3177881ab5ac18c6bc60844e59823a9352
MD5 9face0861d5b7fa5453286ad375b29c5
SHA1 50a2f8e08c411335050da822a082d98569345e8e
SHA512 8e784235b6547a8f19415144924518e7b8f36d5ec30460eeb55af65b87cec5ac94a7defa195cadf2fc0e511bfce8b5b1a89057df706fba8f683975a5a21d5a80
SSDEEP 49152:/B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glMfJ4klKXnL:Bu6JmIxd2dMfJ4k
TLSH
T17ED59D13F1D901E8D06ED178974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 534353969f6ef06cd14eb9f739ea62dda12932d41335204bca9ba7557e24dcd3
MD5 49929aa582d3ba3f862dde9b9f7fc582
SHA1 904b084b5f1df5c619939deaf56b8b153e5f8d1b
SHA512 bde5e434120d3a2c917f0207602a8c60fb87cd87b5ade54514686bc652a9e1cf878621899151561377a52e2c78ca6e2c8b260aa2f440cc94d86de88ca795d1ea
SSDEEP 49152:Q1hpsNoJpF1A67U44CwH7R4x/fJ4klKXn8:QmifPqRCfJ4k
TLSH
T10CB5BE13F2D900E8D06DD17887569232EA62BC460B35B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 180007769626784ac8dd9b7c218a9b6274fe5b6835a38d002e065f8105c0fe6b
MD5 4a83974ec8f9b2e75381b61c7d1ed732
SHA1 08c44c777302aae47f1b594f13082e71f7c7b087
SHA512 1b17203a2f2d34ff0ffb98d890b4d27b5941abb5a37d8bc7bab2eaf3c816ee62b008094607f28bb96d1c7d13a51c42f0c64f38dd5b0b8351629cfedcec3b2ae6
SSDEEP 49152:XSuZQIY0Be2KkRVtOnks6NMHqkfJ4klKXni:N5dKqi61kfJ4k
TLSH
T120C5BF13F2E940E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 04422d95e04469d31b27e59bda04646c138249b3b9e00eb02118860dd589b4d0
MD5 70c41932c7bb0277f3597162c85c7d63
SHA1 4b206948f910e6ca06cac69941797fd787b1e4c6
SHA512 2ec4abbb828dff08ec9a5f8a24c67599123f0390c49dc23b8cbc06853fd289421b361633af0b66d22bd56d4faba3a42d1f9f47e39edf1302b50cf9fdbad762d6
SSDEEP 49152:YhtSn8EApI0figjgiDn0AP5w7fJ4klKXn3:JX2iWphGfJ4k
TLSH
T11795BE13F2D900E8D05ED178C7468632EA62BC560B39B6EF0A90B6561F7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 500f6c5854adff2fea8bb2bf622f64ec51619aee423a7140739217d62583de9f
MD5 a6dd0640b42f2d7b879837403fdb05e6
SHA1 ff3694064ddad9a1dbdbe54c3e38d680e8f251a7
SHA512 4021df7ba03eb43cf5ccd071a7271e34c2fba2e0657b3fd6770161068f2d371dfa90f2568d9d3898eeac33328917f866a5702ef955f32d38e232454f7913debc
SSDEEP 12288:ewfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S6:ewfJ4yL/tNCJPXUQrPN
TLSH
T15CC423AB60C5948ADE5587F81688F001C7087EC6672F62F7EF82B4427FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 650ed64106534ab3d0df92e962bbe2c0e7707ed6b7ec063f14db5f3e6102a5ff
MD5 0fa642ccfe5c8554ebd93d082b153b63
SHA1 f14b0bbd6eed495d3f0441e453696f3fbefce1e4
SHA512 d9b2ec1626a0b5c45a90aa586f50c36af38f7c814b8b67408bf8f7b2a3f23ce64df03009d984126379848ccd28d85d311cba4b1be70aa333c4efa3a41aa236d4
SSDEEP 12288:N1fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S6:N1fJ4yL/tNCJPXUQrPN
TLSH
T146C423AB60D5948ADE1587F81748F001C7047EC6672F62E7EF82B8427FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 6c5f886a26e1ec134d9feb76650d94f656a19ebe1acc6ecedb84bf0051ab00be
MD5 e6196693a3f59fc072cba8295b009388
SHA1 d8defda015ea91060d48e16151774328acb4ec64
SHA512 097067d552429e9eef0d7da52872f05f2344ed4975866bf9782f7b50c630e2346015f0443f9c5ddff129a412d1b9d2aeefbbf5b4de870d6e91dbf75731b86365
SSDEEP 12288:OHfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S6:OHfJ4yL/tNCJPXUQrPN
TLSH
T126C423AB6095948ADE5587F81748E001C7087EC6672F62E7EF82B8413FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 9c4e2ed86c9029b5e260e6b4f95e5150bb9ddbb545174a9bdf10c425adc85467
MD5 7d1e4997e02a0d4831cff155c502380e
SHA1 2bcc72c9425090befbe9928ec3896274243e9f5e
SHA512 e7281a02cd128d33bfa37da120eb098f49b2309a3241113ce81d18df4048b3dbe1d0919417628176eb61f1f1e5dbd49dc0754e62534bdac65853db32e5d08550
SSDEEP 12288:SVCfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SV:9fJ4yL/tNCJPXUQrPW
TLSH
T1ABD42397229580C6DD66C3F84A44E001D324BDC6673BA3EFDF4268863FF9659297C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 b35615ff877e09ee3f041b9ee5e6ac87c9847f2123f6392b1b38790523bab11d
MD5 4be79a83ab74e0d4c222817c5eb68a28
SHA1 01f1e4447b447bb08cd6b00fd05ad2580b2da7b2
SHA512 051a61b1c4a63bb80a79375599be42ed8199cd51fc05db4289dfcb848b8cf86c31fc041c99107394c6c8114b71ff91d99eb559e8ead74c3b9af51d833840201f
SSDEEP 12288:FafJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SC:FafJ4yL/tNCJPXUQrPZ
TLSH
T139C423AB60D5948ADE5587F81748E001C7087EC6672F62F7EF82B8413FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 a32d151e531009fde557a672ffc738d8d324443805fdd31eb49158692d69c2b6
MD5 63a4365cc16d5580bd45c53bf83c1ef8
SHA1 6a5329abb542bdbc2d2f02b00d26124995e14c7a
SHA512 d25f38ed9b3c649fddba5069011a4d917aed9803e37c83d51d20eab1c109457384c261b0a4f84e5d064022dad29a14093a0ab719366fa9701531f91c71c7a9ef
SSDEEP 12288:LBfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SC:LBfJ4yL/tNCJPXUQrPZ
TLSH
T175C423AB6095948ADE1587F81748E001C7047EC6672F62E7EF82B8427FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 5c56b5f5f276264660d195e2094757d0455a20315f553a0929c875202a303bbe
MD5 1e451e95d11acec0a745559712e7b957
SHA1 794724ea73fedc337bac1267ec9d01f9d6f12d7c
SHA512 0c8634d1b410cc64cb09bb916e3a04ed5f7fef103a589b65db85a04f9c8e32d91ef4e61df839acc3e77582c928eef144c022dd157d992fbdd1735e17f0f0d9ea
SSDEEP 12288:vtfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sf:vtfJ4yL/tNCJPXUQrP0
TLSH
T17DC423AB60D5948ADE5587F81748F000C7047EC6672FA2E7EF42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 4265f74f3d9794011badc879352a5c02c8e9f29aae612b2c5e8feb27fa0c1ade
MD5 cf8a0b50fc2475f0638ce12120645895
SHA1 1642b7941b76c39f5bf489740cf6c9e9108412d0
SHA512 099238f49320729157f6ac9dbdca6026ea30ea85539de9b148a816cec4a535d69bd57f98d0f921b9b80a85c777261b88c656d6136f0a334c9ab7de3a508ad613
SSDEEP 12288:+iZwbDzzFEoS2cPvyVfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7ST:hZM3zFVSOVfJ4yL/tNCJPXUQrPI
TLSH
T19B0501A5B39018F8EC67827D8954D902D3B27C9A0B70C25F07A436676F773A11C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 7769848357598de8c33f275dc5c95fc9009d72e38a6cf2b3b07cd27aae7e1d01
MD5 b83e952417abc9705e5a7d65694b27e6
SHA1 8992da53651fd813cef2069eff6ac1a7dec8ccb3
SHA512 d3a88558e0a77ee013d65d57b720a12fd5bba490b0ba0130d4211ba4f7bcc0a0ccbd7eefe382e5a27f807b9ba5ddd52f6c1f73112e4159bb931b6fc2d223fb7b
SSDEEP 12288:/UfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SS:/UfJ4yL/tNCJPXUQrPF
TLSH
T16BC423AB60D5948ADE1587F81748F001C7087EC6672F62E7EF82B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 d7768e935e4a27d31012266971d6cd63e49de00449879771728858048399077d
MD5 fd721bac0132d72e947212d389b98a4c
SHA1 f9d66f3cde65541ed07fd29e52093fb28ec77a49
SHA512 8e127b935d13ddec9e149fb394e5030a2d080bf1ea6c59491317ab5b045cc5469a52a082593100b29152a31eff3390978e9e8bd95d6af62bcd5afbc972f02885
SSDEEP 12288:2YfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SS:2YfJ4yL/tNCJPXUQrPF
TLSH
T148C423AB60D5948ADE1587F81748F001C7087EC6672F62E7EF42B8427FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 f37800f49508e853dde00a1b56645fd06dc3f6c6d6b4040921cafb5461e1f536
MD5 2d7b07b16d21f76b18aaf5ccd95fb090
SHA1 b08f35acfa21054e87fd998d1809ef4ad78e8ade
SHA512 0641817749e82a35d37fc31365fcad23de1f493bb4c1b23188522962be73c9942e6b1739fd583d2bb3a2cf4e6f2243a1060677a93fa96242fb4be3c3ba334610
SSDEEP 12288:ayPz5L8pfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SQ:HzypfJ4yL/tNCJPXUQrPz
TLSH
T1B3F4125732A130F9D53682788990A502F331BCB2072587EF5BA056B63FBB6915E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 e98339f6d08ca5b7ccae6b628b310a48bf1a159cc185bc10e1ce574b2b1462a9
MD5 e5337b9cfb690e888b403fcbe3d07d3f
SHA1 ada53ad2a82709637bbb1295481210464cea3c2b
SHA512 86b11ecad7aea605ee257d94339c593eebc7e6b2a6e0cf0966b7aa95f0ccaf9b7c7e50978609d8dde6a94781447d68ea4f9602512142bc3921b1ccf8b8bc9f27
SSDEEP 12288:dUfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SC:dUfJ4yL/tNCJPXUQrPV
TLSH
T1A1C423AB6095948ADE1587F81748F001C7087EC6672F62E7EF82B8817FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 398335e2afc9701af2d387e11a7fdabf4adacd74cb34a3174f4ed46408fe7ca6
MD5 f3bee603686858a505ce76268e7aff2f
SHA1 f3168595c73cde1831789fb39b50fa3f46e3a38e
SHA512 4cd9d8f758401e1c757e08de326dd52724c4238f2e4e827e20e7eccc31622906f90de1a73de03073cf3cbd1b5d75f7724e08963066089b15c17ec8b40a5c04fd
SSDEEP 12288:VUfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SC:VUfJ4yL/tNCJPXUQrPV
TLSH
T18CC423EB6095948ADE1587F81748F001C7087EC6672F62E7EE82B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 e9eace5af629dabd6c327369f0e99e33e7ff31d42ddee74f105efc52bbef57ab
MD5 7215b7291a8861ab3c95570226e2597c
SHA1 8f8da82e144353a2783d30f3f1e316096d7868ff
SHA512 94901609676c8fe6ff3450f770b1778b82613c435b7ee2f1cdb07fa6926827eb8a9cdd32507da1bac17ad1ae5b1835b27997abb9fa70d9d2cf9bd665b3fc76e7
SSDEEP 12288:dyPz5L8pfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sr:UzypfJ4yL/tNCJPXUQrPw
TLSH
T186F4125732A130F9D53682788990A502F331BCB2072587EF5BA056B63FBB6915E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 50764717c4aedf118fefb3d37deea9a76bc7a45e5a48b7fff4c5453fa9f2c53c
MD5 94fed61076c80f3c6c4f99d03e0228d8
SHA1 3a127e4253b674b0cfcb861aa41ab7c1bb4bd275
SHA512 caa210e5601bc00a4e2e8d995257c5d2eac01da35a89690c89c03354516236d2d7cb4757a9234f7c0f9673ad528f86b10aa93a11755bf3cdeb45f1421a5e7a0c
SSDEEP 12288:TCd91WYoaLHF3z0z04PDvhXfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTY:eT8aLl3z0zDXfJ4yL/tNCJPXUQrPU
TLSH
T18C0501A9B39018F8EC67827EC9549502D3B27C9A0770C25F07A436676F773A11C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 aafbd14e3a389ce2fb8288d9db180664fa395768d9e3122e3eafaa5c6779a861
MD5 055ce2c2cdd5d2082b3cb6ff6cb6b23f
SHA1 fa5e07e2d53596fd0062d74a80efefee75221cc8
SHA512 c1038284aa7b669edb6d771a9f41b29b85301b8e6595bc3f8a2ad515243068ba1ec075d5cf990582903c8d883173c946d8b866f93d57e57da6699ebbd3863a0e
SSDEEP 12288:Yi4e7+RdTfgwCHKy7GLbbdIv2fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGP:Y3rd9CHKy7GZjfJ4yL/tNCJPXUQrPo
TLSH
T10625CF91F3E410E8F0B7CA758D659502DA767C9A1B31DA8F03A4655A2F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 3766680d97029f73fe6b41723996d11fb3d4e5ef40490432c6885f26061e1d41
MD5 ebf9decc43d039dce73f747a6d765d34
SHA1 5c352d0ba6952a0cddf7f1724fd39353b4e7f708
SHA512 2fe83d312d3a2cf0a63b0db7e8367150389b3e87f5171987ff3b1c6efb4c38a961ca724d6e667dd250a2b503f046de055bcdff661f321f5bbf112249a9a5c2e7
SSDEEP 12288:InfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SH:InfJ4yL/tNCJPXUQrPw
TLSH
T152C423AB6095948ADE1587F81B48F001C7047EC6672F62F7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 c25374a34fa501da98ddba7e814413eb65c65c4ec66edaaca8e56c0cd8e556d1
MD5 895a6b440516dd1f19ee9b966ae023de
SHA1 a398daf2bf2251a1a201088c7ef5c5e887a67e0c
SHA512 112934e8a029bab4fad4dbcb52d2b62af1d6677ab279ed45ba9e7310d312470e27336899abf5c7e1bbb8242a69ca654937d6c8282ad5052780f5faa84837d083
SSDEEP 12288:bJfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sz:bJfJ4yL/tNCJPXUQrPg
TLSH
T1B9C423AB60D5949ADE1587F81788E001C7047EC6672F62F7EF82B8413FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 5504a0999739cf12987e69d671c24172aa05c761b26cfac95dff6508fdaa5bf7
MD5 7bbc92225378e253d7bd67530eeba65e
SHA1 ec7d7c21607fb6475d480924ce75b8ea2b67b070
SHA512 b53212fc238ec958b96cf7845392c1bca3b1ed2d1ac73b83e4218902d6836a9da9d699057d9a14de3dee407226b789f261399bb722fa21392be6679d39af69da
SSDEEP 12288:b2fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sz:b2fJ4yL/tNCJPXUQrPg
TLSH
T11EC423AB6095948ADE5587F81748E000C7087EC6672F62E7EF83B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 8ffeb725d0e8d99771eb119dbe2433979764dc414de984036d37fe9f7c9b1ef0
MD5 ed53d86af468c1eebbcbfdd4a3ac5dbb
SHA1 7a3bb505b4c90cee0079ad136f9dc3285ae5e787
SHA512 d4f09433aa5838c4cfd18b47b09e99f41350546e21cb6d5bb83a9d18574262970bcca07375aa2e2995632a21dcfdfb801524e788463e66f6df589200aa0b7493
SSDEEP 12288:lUfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sz:lUfJ4yL/tNCJPXUQrPU
TLSH
T115C423EB6095948ADE1587F81748E001C7087EC6672F62E7EE82B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 fdfc170a2899459e103fb28471f3e98a189cf000235d471990b683d0c7d59a93
MD5 0d6b34649384be836bc59d890adc8b0f
SHA1 b42ba201c8d7d7574e50b7dcb7c05afb995da195
SHA512 191152a70bd0bfa20a381ba2989bd7d58b8c4da680a89bb27e3bab262ce311ae291691484a55590213f4f80d4f65e10b10c54b4318b23f94b08ce24b564eac13
SSDEEP 12288:EnfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sn:EnfJ4yL/tNCJPXUQrPg
TLSH
T1E2C423EB6095948ADE1587F81748E001C7087EC6672F62F7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 0746131600f6599f409fb9bcef6fcff8a62df3c9ef3b3b228ea73fc0762a11c0
MD5 8b3b527a61d8c3ec195599b54c8c11ee
SHA1 38aad9a67ccb5f00d4a62504d92e9df0877cc9a7
SHA512 6b2e625b933cedb7ea2c1f7cdb84a9fa9655513f237215e85af598f14ef078673250e04522a23a5b0a0cdbc875f85a2694ee75b8387a5f294e3014a16de6942c
SSDEEP 12288:4MfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sz:4MfJ4yL/tNCJPXUQrPU
TLSH
T109C423AB60D5948ADE1587F81788E001C7087EC6662F62F7EF43B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 c60fba9d80b782663a10f128c3cd6ca09f3f75f5cb494a0815141a4fa95ee6b2
MD5 6ba8d2942171866ab14ed2718c841da5
SHA1 4efb5cdf8cddaa76c9387ee91fc4d6f7e032d194
SHA512 418ab3de7813bf8d48585e500de23c387c9564bf5b641a65490a9c4f646c7bd3366e8ee60cb4bd486bbde981a388718bdff1a74d6b5df968e2fd3ccadb191528
SSDEEP 12288:oafJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SB:oafJ4yL/tNCJPXUQrPS
TLSH
T1E1C423AB60D5948ADE1587F81B48E001C7087EC6672F62F7EF82B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 68b84b5dc50ade6892735f684557d55f462574d5f7a0f44a83915228db4fdefa
MD5 47380d7ab0f08d5459ce63b0a13cf879
SHA1 29e978b56f73c5f0e5f9b0fa0c45e78a03d172d5
SHA512 d77a3e0960d57f95ddab9c60e920655ca3247b749feb7e23f46f4c563dbf9806f6b79d3bcfb31ffe833cb87a15433a71b393599b1286798a70b5a42078a0630a
SSDEEP 24576:Lfwvzk9RX6wkyAIIfJ4yL/tNCJPXUQrPJ:eMnYIIfJ4klKXnx
TLSH
T13A35D02AEBDC44E5E177923C89A7860AF3B178591B31C2CF029A53AD1E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 9c09719cea0d8bebdd59ebaff937d81ae09017d3c9cbb753ae904b7cad895c6d
MD5 542f39aab153bee312cadaf8adf58148
SHA1 072be6f913b7f7a31ac90bd1557c5df7cbc45c50
SHA512 4142c1dec1536972b25615cb49229e87bf12f32fd8eb1fddfb04ef32be6ff29b8498c5d007db11674e6f39660e21d344e94485e3db16724fe8432ffb6dda8489
SSDEEP 49152:nYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0bfJ4klKXnQ:KySzPjfJ4k
TLSH
T178066C96A1A801D5C1B9C1B98B0BCC1BFB7134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 ccb55cd1650f37cfb197ac02a857bcce4b89be4f10159834dde81eb5057939c6
MD5 eefe15723088551a89d8fbf972c1eb8d
SHA1 f5cf3cda2f57cfd5be8fcc3c30054d40a882889b
SHA512 8e3bb0cdd5b1122fdf838cd18e48e72ce7ac754006e80f9027ea0919ba680a484a881a7363a5f0c1c44330fae7d402c828a5ef8f3100758f2fa1b2a47cd14e49
SSDEEP 24576:C47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYFfJ4yL/tNCJPXUQrPo:C47JUQjqirIhCnDHUPfF/LfJ4klKXnw
TLSH
T1AB65AE1EA3EC01E5E1BA82788515861AEA71782E1F32C6CF1270837D6F67ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 5bfac21ecbe43d9bccf3318eb3af7d375e09490760c5ac7f59628c85876ff576
MD5 9feefb2de031efe922b1334523d296a6
SHA1 248f40a7db83f2e68355e1321c391921a1e3b495
SHA512 bded61ca6768f4ab555a6c370f571be2f1baaa47b893037d74b1aa9fc71a5e3d0d25f0217bb5efe7fe3e1e549973b07981b5fdd42f5e5b99e49b77f25de20265
SSDEEP 12288:8psfkfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SV:dkfJ4yL/tNCJPXUQrPG
TLSH
T180E4015AD29841D8C46E92B8CB449201F3237CA593E2D3CB97C0F47E2FBA6945DE9743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 7303cf3bc1faab37920bddbdda3d2354e1b45140bf11583059a0551e7f67213d
MD5 cb591ca2c430d643363a9ff36c220c82
SHA1 d027342675339c4347cf3b699568b1ca2ecb1cf6
SHA512 2a54531ca59fb76fff1c3f721b73dd6faf7b6311a5ddee85ada2c684e8cf6bfb83dfa49a222a307c6e6e476b6483b14cf5e4e20b8911c9ccd1ac06bab850500e
SSDEEP 12288:VP3h85QU3fq6F/OCAIpwWXxVzWlLysFb4VrGqz:V6yUPTHBpwWXDzWBysd4FGqz
TLSH
T198350710762ACB4FC66940321E77D6CCAB707D01EE44AF0773C9873F9576659BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 263c19beb2a8dfe7354c844f08e64491a3c5d8a3454c45dd4d414f188d770679
MD5 af4b7bcaebfb7e7065675c7d389c3a22
SHA1 42dc928c19c8daa899d41df2875547e9a539d9e0
SHA512 f3e61af758c6ebc326ff00dc8f1ba552b7a0a27ac218712086a3ba4110ee17ee56cab45a7710374ef998d2592b33c139536b15443f98f68005b37b9107651f48
SSDEEP 6144:KhiMphbMrfkLK7W1V9paKtfEGP3JvMGTbm2lo9+0gGbsEaRlXmlPnWtMxynWtMxZ:KhVhaqhlfP3JfBsq
TLSH
T1076509805537A7CFD0B72072076A5F8C7764EC0BB6496F26B3C9053AD86AB11A0BD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 149265c6d1dfdf28f76feba61b852537bf613afc1c944c609673e4dc138c1e29
MD5 17b6602db9c3f1f7945513aac5c9f4f7
SHA1 3fc39777afbd5be2bfac46b69444238f621cc70f
SHA512 af0ab0db4ec5e23f67aeddbb1fcdf0c398ab834071860a6ea99b554294fcfd6090f721014cc20366528c23cede75b4a6e1402811ae446fbde513e2ee4c81e9ff
SSDEEP 12288:LM7cfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SP:QcfJ4yL/tNCJPXUQrPo
TLSH
T139D423A751C89846ED7987F8164CE000D309BED55B2B92E7EE42B4853FFC98A1DBC352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 199468f23f294f7798cba7ccb61d07bc05a55c295c5d1c81f7d389654c4b3932
MD5 e9a79c92cadf0531ddb298b6403fa2d0
SHA1 fe646ac2e5f3d7dba0cfd38ab0d95a265b7682c1
SHA512 3774ff011d45750fee4bd1552634c07f713e0dbfc72c15f06c82f5e8442518c1c1ff81b31c9cc104cc0c9bb178ee91e00ca06374fc8d2d50b1e4ff6d51e522c1
SSDEEP 24576:Lgb6bmBIi49WNNFpg1rSvFv7bY+fJ4yL/tNCJPXUQrP3:Lgb4mBIBhGFFfJ4klKXnv
TLSH
T14965AF1E22EC02F5E0F9D2B89DAA4417D6B278160732D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 c63826113d7039b0d5103f66d58b593944eae98b49be463104027b20125b0be7
MD5 06a682b7b3a83c378428eca2d50985f2
SHA1 734d390cc89ee1556a2495919b07cc4192429381
SHA512 be18bc03420cfeed561cc05258d97455ddf33a049e20f64d5dde72bc5652b414467c6f1fec0cd64cee8d2da3bcab8953d0a1c8a88253fa9f5764730eb7e69d91
SSDEEP 24576:KG88u8FpJqH1vzria7/mVfJ4yL/tNCJPXUQrPh:x7ZFPqVya7/WfJ4klKXnp
TLSH
T18635026676E101F1D47BD1388A858663F771B8150335FBDF0BA88A512F23AE50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 ce51ed0c6c3ccafabf7424203b6602c8a5238e6fbc7550715aa7a58ebe7ea454
MD5 5908cae7c6d87f79c6a818dec79abcc0
SHA1 77b63c0d14da65aa3fb8600dfffed1285064c859
SHA512 26ac73bada528a8835ac5dc1f598988d9d8c41a5c27a730b12c344f56f10e9144f54302a35662530d5a391e9d86af18408b2e52c04d8e4984a57b186cda418ed
SSDEEP 12288:9HvUrBFrEjwaQxfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SJ:9PUr+NQxfJ4yL/tNCJPXUQrPe
TLSH
T1BC05F16F22E818E5E676E17C89858209E771B8A21312D2DF02D1817E5F77EE87D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 22d908f45c42c57d1259fdccacd021531d42ebb7faca9626a1605d13f8b2e549
MD5 1a36a3ff66f524f80e96419643ab06c4
SHA1 8940bc7f4fe9ab6e4b6907b3b27e0dea4c32a465
SHA512 b64b0c52abfb1f8cb3998a666f4b41eb7b1f41ce9b3e1d2c206df748f0e0d0223cc7bfca2ba572f1da27dc192da87239382415cfb27c3bf3123bbaecf344220c
SSDEEP 49152:yBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjBfJ4klKXn3:9G05lO43bgfJ4k
TLSH
T170D5CF6E62EC11F9D1BBC17CDAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b42f44d3b07278eae37559c9f69d890f4f166e8f22a17f3fcfe37da64560d7fb
MD5 5435cb2760ad57db6a349ddcac26ae2a
SHA1 b200dd474a3bcaa37991a32e4da464d37f37a3eb
SHA512 84b1da966501eae17b2044e153070763c46540799976463b8e9a552d6d33972fb9bbc7a22234793abefde5025b334f5ea278dc8f319776fafa33e87fe6487fc3
SSDEEP 24576:Xfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnbfJ4yL/tNCJPXUQrP4:va5POZ3lJt2pasx2+mJfJ4klKXnA
TLSH
T1EC65BF5EA6FC01D5D579D17CC583861AF5B1346253329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3dc6640dcc6d2072af8d759b245666e93339540368d060c21697e00909e6b8a2
MD5 f7ac06fd0d052124c6ccd1c07cf71ed5
SHA1 c65788937a70973a921f7acc961277e632cc205c
SHA512 ae9872b753e80f2a4d8e9f56f38b28dc517cd46d6754f7bc2274ed84bf0bbfedc1d45052887842fad3d9a4b13e0d6d98aa7edeaebea8c1c7c70a8aea51a3f975
SSDEEP 24576:oNcwHdjbyQ4nLC18lb/EOjowL7Fk9fJ4yL/tNCJPXUQrPd:oNc/zEOVHF2fJ4klKXn1
TLSH
T19C858B2623E901E4F5BBE1BE896B9546FA717865133486CF0291811B1F73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c6eaa7c8eab5c4b1140079f3d65b56ea084d2688c161f3e541e84dd0cf763cf7
MD5 f014a846b6f38b67e6e43f49a3f2a9e5
SHA1 95fde1a50feb09aadd47944c9fb03517e05bd12d
SHA512 3ede2c8db52934bbbe80fa5ec1efef0ce2e0d64c2e3459e2b6c5d801f1c24a9dc8c9b12d25caf5d1be425e51b9ba4af7ad39f8b4cb5651b2f801238aede1ebd2
SSDEEP 24576:DzkNvNnaFeYhJNtmZBmAfJ4yL/tNCJPXUQrPS:DzMwBtOmAfJ4klKXnK
TLSH
T19855AF6EB6F845E4D1FEC6B48E238112E6727861073293CB9290C13F1E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 9ab5a8bf5128144f231b317e8f66e25a1ac6d2b433c8f4660df2dc6b344fa017
MD5 d5f0bb664e25b03444ff715825349a54
SHA1 083fe32a06761e1fab562ff29ea384f72985275f
SHA512 ec767b9632f12b031f91a109aa5c0a76eb235d5ab3927e26abde9dcc3838597adfd9af9b402a0dd4f867dc0bdb9460972d759f94a414beeb0def53eab221d389
SSDEEP 12288:4QcMxWDXN1Dp/fshBItT1IQgAQfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+Ge:aD3FHshBIYQgAQfJ4yL/tNCJPXUQrPW
TLSH
T1D625E17EE69C04E4D57BC2BC9A538506E77138A9032266DB06D0D1B62F6BEE42D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1616-411-0x0000028854050000-0x000002885409D000-memory.dmp

Download

memory/1616-330-0x0000028854050000-0x000002885409D000-memory.dmp

Download

memory/1980-135-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/1980-128-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1980-129-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/1980-325-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2440-26-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2440-34-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2440-25-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2440-113-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2440-33-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2688-64-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2688-71-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2688-65-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2688-308-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2952-32-0x0000000000400000-0x00000000008C5000-memory.dmp

Download

memory/2952-0-0x0000000000400000-0x00000000008C5000-memory.dmp

Download

memory/2952-16-0x00000000031C0000-0x0000000003227000-memory.dmp

Download

memory/2952-9-0x00000000031C0000-0x0000000003227000-memory.dmp

Download

memory/2952-7-0x0000000002980000-0x0000000002A05000-memory.dmp

Download

memory/2952-1-0x0000000002980000-0x0000000002A05000-memory.dmp

Download

memory/3460-127-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3460-46-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3460-40-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3460-48-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3460-47-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3852-59-0x0000000002380000-0x00000000023E0000-memory.dmp

Download

memory/3852-52-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3852-53-0x0000000002380000-0x00000000023E0000-memory.dmp

Download

memory/3852-60-0x0000000002380000-0x00000000023E0000-memory.dmp

Download

memory/3852-77-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3852-74-0x0000000002380000-0x00000000023E0000-memory.dmp

Download

memory/4320-324-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4320-326-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4320-328-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4320-114-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4320-120-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4320-121-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4488-420-0x000001E75F5F0000-0x000001E75F63D000-memory.dmp

Download

memory/4596-110-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4596-343-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4596-345-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4596-107-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4596-101-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4596-323-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5176-322-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5176-97-0x00000000008F0000-0x0000000000957000-memory.dmp

Download

memory/5176-92-0x00000000008F0000-0x0000000000957000-memory.dmp

Download

memory/5176-91-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5404-156-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5404-157-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5404-163-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5404-329-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5888-79-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5888-321-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5888-87-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/5888-81-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/6116-149-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/6116-151-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6116-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6116-140-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/6116-146-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download