26291847e6f073c0ed614ce68a8d3f58284306e0a6c2d5b8994bf4a453fa47fc

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 17:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-02_07988da917f78aa494d68f1d87c71b78_adposhel_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
Size 2.2MB
Sample261003-whreesvt6r
SHA256 26291847e6f073c0ed614ce68a8d3f58284306e0a6c2d5b8994bf4a453fa47fc
MD5 07988da917f78aa494d68f1d87c71b78
SHA1 8017f5b9177c7082903eb0f06d38f4414c6852e8
SHA512 75662cb31bf5c2f04630f71e8b0457df626e9d34cb2a7e6ab68baf1d58d179459d4fba12e115d141a62bd9ce4e26b446b622f1f39ea50684aa7291ad110da1b3
SSDEEP 49152:kSy74I4qtZp9wlhcb9BO+Z/dGLMuLZHQ1EsO:s4Gp9w8O+Jb1W
TLSH
T18AB55BA3A52B8131D673483054776E168F6F3D290BB108E36189BE1F057AAD36B3F617
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4152	elevation_service.exe
1832	elevation_service.exe
3280	maintenanceservice.exe
4796	OSE.EXE
4772	PerceptionSimulationService.exe
3144	perfhost.exe
4108	ReFsDedupSvc.exe
1348	SensorDataService.exe
5196	ssh-agent.exe
4228	AgentService.exe
5784	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\68f415d77465cd71.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-02_07988da917f78aa494d68f1d87c71b78_adposhel_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-02_07988da917f78aa494d68f1d87c71b78_adposhel_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-02_07988da917f78aa494d68f1d87c71b78_adposhel_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-02_07988da917f78aa494d68f1d87c71b78_adposhel_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-02_07988da917f78aa494d68f1d87c71b78_adposhel_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-02_07988da917f78aa494d68f1d87c71b78_adposhel_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000001c3492716053dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004684fd706053dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f2a90ab36053dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4152	elevation_service.exe
4152	elevation_service.exe
4152	elevation_service.exe
4152	elevation_service.exe
4152	elevation_service.exe
4152	elevation_service.exe
4152	elevation_service.exe
1832	elevation_service.exe
1832	elevation_service.exe
1832	elevation_service.exe
1832	elevation_service.exe
1832	elevation_service.exe
1832	elevation_service.exe
1832	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2948	2026-10-02_07988da917f78aa494d68f1d87c71b78_adposhel_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
Token: SeTakeOwnershipPrivilege	4152	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	4228	AgentService.exe
Token: SeBackupPrivilege	4108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4108	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4108	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4108	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4108	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4108	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4108	ReFsDedupSvc.exe
Token: 33	5784	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5784	SearchIndexer.exe
Token: SeDebugPrivilege	4152	elevation_service.exe
Token: SeDebugPrivilege	1832	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5784 wrote to memory of 1244	5784	SearchIndexer.exe	102
PID 5784 wrote to memory of 4920	5784	SearchIndexer.exe	103
PID 5784 wrote to memory of 3376	5784	SearchIndexer.exe	104
PID 5784 wrote to memory of 2988	5784	SearchIndexer.exe	105
PID 5784 wrote to memory of 1372	5784	SearchIndexer.exe	110
PID 5784 wrote to memory of 3100	5784	SearchIndexer.exe	111
PID 5784 wrote to memory of 5260	5784	SearchIndexer.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-10-02_07988da917f78aa494d68f1d87c71b78_adposhel_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_07988da917f78aa494d68f1d87c71b78_adposhel_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2948

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4152

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1832

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3280

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4796

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4772

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3144

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4108

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1348

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5196

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4228

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5784
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1244
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4920
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 2776 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3376
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3040 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2988
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1372
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 2776 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3100
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3040 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 421c96576b7b6173fdb3b8e58793ae71b15b5b1d92443a5f7ff3b4166ed0c27b
MD5 87db21fd17120641bb3b4b3069cdbe1b
SHA1 f0b9dafdb7acf7404f728c31052ffbd50518afce
SHA512 74162718a1eb494501a6de592344ff14851097c027b26e35ef762b1a6ae0b2a5163601fde75dc3b06bcc9290b7845a08a4d9c72fe8a8816ecd70a24bfbe10ba2
SSDEEP 49152:Gb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnEuLZHQ1EsO:43q60jBp1W
TLSH
T1BFD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.8MB
SHA256 a23258ce84b233cb0bfd998b22b6d6fc6ec38f0179103698ed53ba224e8e1f7d
MD5 b43c4545907c256768542a254e6a557b
SHA1 71d8ea04d3827c52d03b6b44a4b40579f4c5c5be
SHA512 0457ed38791431f3a7d49b1c5670f707bd15c75079d946a9403bdbf043577fb6eaef3e1fde80528265665f166fa03b6568681bfe429bd3233eedb004db74893c
SSDEEP 24576:ZXYfDtczAfuRgKA2HQ1b/A+zwjVOOs5OLP:ctcOuLZHQ1EsO
TLSH
T16585F12867E408F9DD6B817CC8A2C501E633BC544764E6DB03E0996A1F377D86E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 c561bffd596bb71e01b935157b9e010c0c90c824fbc6ff535ed52ff3d026405f
MD5 527b4dee903dd5cb24a66a4c6c1ba585
SHA1 03beb7c5c8b42edc06b2b96c28b883069380cb54
SHA512 9f35a9cccee6e0d66e7d706bcb0d7aea352be0fb4742b414f90af775f9a30bb9b8968472a186871c45adcf86b62f6da0cdf6ec5660687522b0d02aea19a67b98
SSDEEP 24576:j0Le5ji0hmxNrMcuRgKA2HQ1b/A+zwjVOOs5OLP:jPji0A79uLZHQ1EsO
TLSH
T185A59E15F6748331D073C0B9C5D2A68AEA7234855B3089CB4286D77C7F6BBE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ea5f42d658f0012e49bcd637a9c43d75bc4a5471f7a033821effc9fc415d58c2
MD5 2667c2db54d6562b94c700e4f2938f43
SHA1 7a2a5dd902db2208f2e676f1c2ef88e1d84ed137
SHA512 6ffaa7c74f6404a7aaedf513266dc688bb2f5e603b0636d131fc54a5d34eb81e40940b484cbefc28b0c2f13417678eee874e7e29d449e869ce5568665cc7a4e3
SSDEEP 24576:Wa7/ezSC6vUyD/aqgrvWr6q8wyueuRgKA2HQ1b/A+zwjVOOs5OLP:h/ezSC6vUzPviHjyxuLZHQ1EsO
TLSH
T192755B15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 10f7e40817dbe25e085162b3b2757c10f4e8e912b24822d9a66bceb15a2727f2
MD5 b17d4be49af51a8bb8292bcd363f67b1
SHA1 10b87fb9eb1af31190cf08fa1d0c89bd343df7e6
SHA512 e7c6803a30566e11a139bfbef021d4611b7e30bf44cbcb67210eaecb3677ca5e8f4220d5b99795c9ae45f29c8baf63d350e913e7b86a5233fae67225acc614da
SSDEEP 24576:aVbqPb88hv/l+b7uRgKA2HQ1b/A+zwjVOOs5OLP:aVO88hXl+HuLZHQ1EsO
TLSH
T11C559E65F6748331D073C0BAC4D2AA9AEE3234415B318ACB1246D76C3E6BBD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 dd60a96bc8a894e01c5e0796e96dde8cd9030b9439fbc9a33f919ccc872fa561
MD5 24735be01115059666669123cf2e92c3
SHA1 600434918a68838bbe22b9dea7837737d3a19586
SHA512 7e5f10c1c365823dc12889872a1dc9a7fb71ead9629f8b4a1c4a29c341bf305d4a75074d56af1adf0a15bc39140dcfbfe323da95198b2c121c9d6a4bcf1182eb
SSDEEP 12288:XjYIFR8UYKA299QcQbJZjURK3z/ojVOk9scqVnlOq8H8cvP:XjYuRgKA2HQ1b/A+zwjVOOs5OLP
TLSH
T1127523405BA950A2C77F98784091F684E332DF2C6D5C6CE7E091BC8E7A3CE65F14929B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 bac3448fdb142ee270c686ebcd61f98d14ed2646b551be3080770e12a42dfb90
MD5 3a0726fb5ea1def69dc2f886e986d182
SHA1 c2d29701d9809d744b3addc13f740e3100178e09
SHA512 9b564ff6e04fc98b675e504cab21056cac09bccd3eaf1941de4a14e44ba74e068e6cfa5816fc5d1e125b68292c33793572cc42a6660ef2f5fb31af212e43bc5f
SSDEEP 12288:reBNUbTVO86UzIFR8UYKA299QcQbJZjURK3z/ojVOk9scqVnlOq8H8cvP:rJIUzuRgKA2HQ1b/A+zwjVOOs5OLP
TLSH
T19285CF3BAE28FCD2C27E8DB85691C640E77278304F61A3CBD165820EDE275E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 83b3017dee43de654c769844bf05d7eb9cc8dc276f4fd22ddc193128b2b53df9
MD5 5ae99c38a5bcc6b43f13615aafdc2e18
SHA1 76cbfc1778b6ef39d06b4ab725d99ed1919f5383
SHA512 8fc78737cc92f731ebaac96a03e1e4a6ba91330a11b8a0a57cac7c7b750a7d4ed2225d94c64edd8be82792da36fa693a255c98cb29787535c149fab1e91a6b71
SSDEEP 49152:IQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3TH2:IQvGAdlCEL8c/RRNw5Ck1W
TLSH
T1F3266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 a529ae898d769883a24c35bca7f852318c7749d0897d740ba0d56a1731c7596d
MD5 a208a5cbabca0d59195fb2d1aaed985b
SHA1 a9f56d31ec5daba85167c4eb86bb0a39c2f8af55
SHA512 6643440808ff2a0d08260aa3058085ea48eafc2af81a6fbb8409b66e42721b9ff88accb9184c3b3190ec33c93ebfeda190b939ab6aa49ef088a99777a2fe6a13
SSDEEP 24576:mSewsAjNuRgKA2HQ1b/A+zwjVOOs5OLP:BljNuLZHQ1EsO
TLSH
T1D495EF30FE75E032C27F0DB61B26D706643DAA204F5529C3E3E89D8E59386D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 09c8b3313d949851291c1aaf62684e61825cdf5d872673869e8424f8d10cf6cf
MD5 e98e657a8f9d57be91524d3fef761afb
SHA1 23049d0d2bac58998ac6d49ab4f9f59d373f57c3
SHA512 c0235d68f645722596c94d6b8cc4f12c411cd50780c99282ddf22399e6524fb090ef7c6e924ef22bdbd1d281afa50e5b4aa6adb835a40beba52ab6386e6bb6ee
SSDEEP 196608:VUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJH:VUEtQevvqc2W1cpV2RI32
TLSH
T1F8474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5d516da70560b699552c61ede26c96708b1fc45036b7911dfb037ef80321f962
MD5 6000077020c735dc572ba7c4eb999112
SHA1 13aa6d60394b8709639e2baa7d3b8df4868b4662
SHA512 4972cc87721cd8c9b954c5fedb982ea0647f33410f3ffb59d92a01529be3f331a66dc0c9371681d8958ff9c884a76feb73c7ad5e4061bca37b2c218d23dfcf52
SSDEEP 49152:sCbRquA/m2yL5zQfFiV+XenmE3/ztuLZHQ1EsO:FoqtVjnmQ1W
TLSH
T139D58D0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d23f1f887581071d75ebe017929c95b94f77ca0b0d7edb186f512d763db56297
MD5 95abda5c6f2682f865f686cac80abb30
SHA1 ae6d26a486195fb9e47c0e688c6f8666e9fa1f87
SHA512 806ab7341142c045a7bb4e6f93e3c56e994c891d1e18226ab953299a741396ed92615d8c34fd105c1e9d2b18d249ee479f47d4268f635d8d6c994cdd0b2b5e0e
SSDEEP 24576:NAhGL2IFoiwtA5l7S53iuRgKA2HQ1b/A+zwjVOOs5OLP:NAM1Foiq5SuLZHQ1EsO
TLSH
T16835AD80EBF955D4F5B3AAB899B69170EA76BCA95E30D20F2150D10F1E37E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 e0a813dcbcdc4f53a5b3c510e7f5fc98e1316bd5307f720e2c31d26f39e442e5
MD5 eab24e783c17d1753628827032087af6
SHA1 310b6576958475cf9d4b4a5a3ee6aa1a96c7f064
SHA512 f2d3ba02ccea5a3d80a7135d662e0d911c2a47d1004fe76b93e1a735661760eaaf73366fe09d8902b1e5021f02d0f2d91b3602e5b4436e27661d83426683da1c
SSDEEP 12288:Fmw5HEjsChNSBFgl0WDm+C+IFR8UYKA299QcQbJZjURK3z/ojVOk9scqVnlOq8Hj:gwuXOWRuRgKA2HQ1b/A+zwjVOOs5OLP
TLSH
T14C85F04537A40CF9EA6781388593D136F3B2BC152A25DA1F53A0C65B6F3B361BD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 f9a17755be0dbf40ed5845a2669ddd7f7d086ed8caabe0614937370de9b16873
MD5 f183c4d2925f88e829015e2a73b6349c
SHA1 0b1b817c4079e7f1a588572b7859a54eed9fd18b
SHA512 23e331bb0776799b95e6b6b35259019e8df9f5264f4cd94daf972457159f39c6de9ecd92a904104d98be60d3377707f239c04223be853ac32ef8cea7ddb0998d
SSDEEP 12288:x/Z1IydIFR8UYKA299QcQbJZjURK3z/ojVOk9scqVnlOq8H8cvP:pZuUuRgKA2HQ1b/A+zwjVOOs5OLP
TLSH
T19A75124927E420F5D267917CC4E1A644E332BC292B3953CF5161A59A2F3FED1AE39323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 72ff0e8b437e2fed4801989d503e54ceda77ef1ea627ceb0f42a54ed8c4b11da
MD5 175e813ccd2292227389be9b36790107
SHA1 b47cb3039580efd0bb12fd5096c9b8c5b1f7f88f
SHA512 80bfbface28c3a6ec5024f85a4edb1377142afe13a72212c0ff9e72fccee178b8b1d3361e0052217fb4ce9e7c83c91d2ba1f051648a96f301ccd6223b5daeaf0
SSDEEP 49152:6j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Ua:ZQRQyi36YOcPhLvw2gAf+PN3t1W
TLSH
T171667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5a7571b70fe2900ae9594c315b8fb4eff99ef8713fbcf2363d75f1c2cdde3887
MD5 cf4171d3c2da67d011b0b6b8dd1243fa
SHA1 3f5e24594f40cec88b86bf50cdbc31a721e289f2
SHA512 4485134b5a7bd03dc198db49d8ac1064c9777b1f8010da3ba9004d9f2c32beee0645b41fc23c2b7d2430d96f6b2ab83f407cf53281eca291edcca8e17cde6031
SSDEEP 49152:Ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Ua:bQRQyi36YOcPhLvw2gAf+PN3t1W
TLSH
T14B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6c5102fb432fbd1a4d398a67c1538a91728adf0668b0ca5910134d16182580f2
MD5 e6c982c4b3a1dea5849903227e6c3df9
SHA1 bd67d84360b274b57e3ad77fdd8d57cd29fc77ff
SHA512 4fcc348407d4033b67165727eebc8bf5a678c0fd1cc390142ab920a2f096fc911fbd76f3d666f4faf1133917576125ab35d58dcb66f33e7388506a0c5585d1bb
SSDEEP 24576:2wvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0EuRgKA2HQ1b/A+G:g68Qg55nhceWu7PNU3/9uLZHQ1EsO
TLSH
T123B55A33B2F600A9C44DE1769F46972196D27C758FE0E3DB851172061BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6e1920c4f3625952358276282ea9629d5ab1510647b5d4af6eb2dd4c3f81b6dc
MD5 147f8265861894d94abb5c2da77f570c
SHA1 7b4724b0be671234e3f526af365976b20c36292d
SHA512 35d9c959d81495ba2afd00680cd0477f694a405bacc93bdd29a5ebe819e7af9f742a47bfbfb3a7566c97c253017d7a223a7a154788a34bbef67239422ce784a0
SSDEEP 49152:73aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99M:ey5112gYy5azzVva69nLKnhZa1W
TLSH
T19C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 fe9514a751b87726b5e1b1682989d227589238302578b5d6e2a54ca684326de7
MD5 f83c9af8bed8d2a730c08c95c66469a4
SHA1 5fbe1b311881441ff074cef9339516a3fc15233b
SHA512 782e8a8dbc02f0ef6f04862f619677b54c156ab58c7d08f01d9aff26759f98edd7bd74b40fbb7606d3b1254cb5ab190464068dcc3209c81934f95c3926cdd860
SSDEEP 49152:+B+taZ3usBWOBr4tEG20bqx0z+n217aau1gljuLZHQ1EsO:su6JmUxd2dh1W
TLSH
T1C4D59D13F1DA01E8D06ED478974A9233FA62BC490B34B6DF0A9072562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c8a6b32613bf200ee0d4ae6c081a7df3e28fccb293fdcee10353a65afccc9e07
MD5 c8d3e51e55b3edcf350d587b6c5c7d78
SHA1 afed9f83444cc84d0cf1c83f8b2876d0dea8ee33
SHA512 24ddf5f683c3f1cfcb01c73f1c2bf62bef859a891d836ed429d4c745a709fcc62119b06d69bc0d252b054cfd1e602b88ee472e34bd9d5e3fcdf00da8a9cd4c60
SSDEEP 49152:y1hpsNoJpF1A6BU44CwH7R4xTuLZHQ1EsO:ymifPkRQ1W
TLSH
T100B5AE13F2D900E8D06ED17887569232EA62BC450B34B6DF0A90B6961F7BFE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5a237f8c7ba785b83fba72eb2884973ed24171d39e58eda5a0cb2f54b5decc89
MD5 f8de4fe1829f6f9c3c69d159a288f7a7
SHA1 8f4b9c20d02aae17ff57b67ea91778c5517da239
SHA512 d4194bd91a05d12c028fc28100038e702cbeadaa425651118fc5aaff216ddd8ef839c6b00b204eb7ed684b9df2285ec5091d90a1137867b23714f54f60966964
SSDEEP 49152:ASuZQIY0Be2KNRVtOnks6NMHqUuLZHQ1EsO:a5dKvi61O1W
TLSH
T172C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ce6a6e17a56da36dc2198b196e40bb880098a47f92178bf341f36bb315018481
MD5 098dbfab776bb27c705ec22d09a2daba
SHA1 d6cde3cae059be6615577243a8ecf6b5d253c641
SHA512 dd3ac33f47ded8c7c252f0cec3855791f6acbbf5f0bddcb7f646287b520aea9ffdbe115c8037d1aa280ba25c29384833b4da26895ccfc6367c959109e364ee52
SSDEEP 49152:lhtSn8EApI0figXgiDn0AP5wfuLZHQ1EsO:UX2iyphM1W
TLSH
T1D395BE13F2D900E8D05ED178C7568632EA62BC150B39B6EF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 b95b9c88e9932e40995c01ae278bb1164e709f820f0b1fde66c639fe1fe932b6
MD5 5558a066310b2c2d96cde4c67c756ee5
SHA1 0447094efe6b4eab48fe83901c7166bf3770dd21
SHA512 81876372859ac54eec0957d0e396fb0d0e743d0cf3ba9e13af579ef68a3f52729cfd217410888b052aeb6c1e9c5e35e443fea07cbfa5a6909fbff8e80df0a9e0
SSDEEP 12288:dwIFR8UYKA299QcQbJZjURK3z/ojVOk9scqVnlOq8H8cvP:dwuRgKA2HQ1b/A+zwjVOOs5OLP
TLSH
T10D7523045BF65192C22BD8B44091F284E332DF2CBE5D64E7F182B84A7B3DE61F14969B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 039354f44d82121d3b8bb34b5380e260af9ec7a75968e7826a3a0bc67dbffbc9
MD5 11df61eae5b618eaa4a5ae2396d2b9fc
SHA1 a5d13371c01e2633875a58ac7a1cf6ffdf66c7a5
SHA512 9af3eea76a534dd37420ab0efa95f8cb0345df568d46f8a26c9e43f378e679e752a99c2c9c2233f5a48dc2f22b874a0c858e94db1e9e6c7f29d3e8d407fd629e
SSDEEP 12288:LZIFR8UYKA299QcQbJZjURK3z/ojVOk9scqVnlOq8H8cvP:LZuRgKA2HQ1b/A+zwjVOOs5OLP
TLSH
T1307523045BF64192C22BD8B44091F284E332DF2CBE5D64E7F182B84A7B3DE65F14969B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 99226c708eef785580e0ade9597d664ab639d885b3f4ae26f80c1d7e923db1df
MD5 a76a83b1c41be0531c2af0c24b50bca2
SHA1 c3947790170b4e25779cb1724506c9f86e2c0290
SHA512 4f5b60f9945f86e4b49b1fdf04562ec0983fbf1e94db00c2cafbdf216a30c940a91b43830708b43417209bb090448908fa923b2be871362901d5f3186a813725
SSDEEP 12288:PrIFR8UYKA299QcQbJZjURK3z/ojVOk9scqVnlOq8H8cvP:PruRgKA2HQ1b/A+zwjVOOs5OLP
TLSH
T13D7523045BF64092C22BD8B44091F284E332DF2CBE5D64E7F582B84A7B3DE55F14969B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 744a524d2764596be2464484d36e4fc7372187a2032d4fa95871deee72c6b3d3
MD5 e7d5e44aca4d01e5c777434a2b8b6e91
SHA1 199d7782fb33447d9d89a1478c1adb94959b2324
SHA512 a4a0d052884383ade0f626e08b52ccd76c08cef0290bf78431fa9e15ac57af4fd2dd80ea28fbed0084c35a7f0eeb6802759c6726c95ae135f4a510c96d86f031
SSDEEP 12288:dVCIFR8UYKA299QcQbJZjURK3z/ojVOk9scqVnlOq8H8cvP:6uRgKA2HQ1b/A+zwjVOOs5OLP
TLSH
T1F57523042BBA40D2C52BD5788091E244E332FE6CAF2964EFE541784A2F3DF90F565797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 6146d465948d50c32c1e477aa6a6cc134db4c93b3b8aa6b59d98c75ff2482763
MD5 8668895604fc7e9808a6dacc9c6ad800
SHA1 83e0fef2c90faf679da538876121a22ed4ab621b
SHA512 26d44920f06018cbcf99dc638f93c8e546851e0e05e13666319e0781d8dc346633ca0a7eef65c7e2c361f2d7bebeaf3b442730fc45bfa80270edff121c353c4d
SSDEEP 12288:MqIFR8UYKA299QcQbJZjURK3z/ojVOk9scqVnlOq8H8cvP:MquRgKA2HQ1b/A+zwjVOOs5OLP
TLSH
T19C7523045BF64192C22BD8B44091F284E332DF2CBE5D64E7F182B84A7B3DE65F14969B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 35e49ada9fb17827f27b66c32cc893f2c1f2bffb0b93b43b768483441b3e9196
MD5 6722ad3045da51c92fc8698d9189db16
SHA1 3eaac9d7cba6336fb110f21f2d4f824cafd8ea0a
SHA512 9eb78bd0a6ffc14f3f2cd3f4b5fe3b34d78a9ff3018feda0532db245ce183d636410631476cd647e8eabea9f6d7847b53fff176779e84320659a0ae435f011a0
SSDEEP 12288:jlIFR8UYKA299QcQbJZjURK3z/ojVOk9scqVnlOq8H8cvP:jluRgKA2HQ1b/A+zwjVOOs5OLP
TLSH
T14F7523045BF64192C22BD8B44091F284E332DF2CBE5D64E7F182B84A7B3DE65F14969B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 c55a2d170922f022290901ebba9373192234d6e6f162e060ab72253c4ea7eb6b
MD5 9d31a2cf8f599cbe265efd176c722f49
SHA1 c2ff6a29e98fb421e289dc093d3f8e4e8aa91c84
SHA512 3edeac7355bfb1424067a05075f892907be01f856d78104de4e1aba3b9bdadaeb979cb40b3ca37d31b439e3e2906a5015f991e204dfde39c2183dd4a2920243d
SSDEEP 12288:SBIFR8UYKA299QcQbJZjURK3z/ojVOk9scqVnlOq8H8cvP:SBuRgKA2HQ1b/A+zwjVOOs5OLP
TLSH
T15F7523045BF64192C22BD8B44091F284E332DF2CBE5D64E7F182B84A7B3DE61F14969B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 65fcb12b96cc487710444534645c592033aa46038f785269c2f98cf340999700
MD5 09a35a39c60ebc8c2cf0ee8c40b526a2
SHA1 f739e8f052d1b016cac85ce3bb4cf0dc820a87ac
SHA512 1a44e7433fcf91209e1ebbcd1d32775ba29357a8fd7bbf6239cead61a61a2eda7713b3000d56a7f7318923a2f668d334d8544effe5950fdcae3e71cbb549a47b
SSDEEP 24576:+ZMMzFVSO5uRgKA2HQ1b/A+zwjVOOs5OLP:+ZMMzf1uLZHQ1EsO
TLSH
T1B6850294B3A018F4DC67813DC8519905E2B2BC290B70C55F53E0366B6F377A16D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 76ec129535935b36732d29efec150c23fcd04a590e21969c661f8c59b0256a6f
MD5 eb47212f0f0e9f87c3383850c3ea6e0d
SHA1 ece088492374e3b6c632950f431d0cb15741e817
SHA512 96be6d10bf5b53d7b9cf36508d236d252b244a37e7b0d17e182a0faf5b70f345027927f0841900a6aaa18fe560789f40879d856bc1e8a15272a63a8a29b4d229
SSDEEP 12288:AkIFR8UYKA299QcQbJZjURK3z/ojVOk9scqVnlOq8H8cvP:AkuRgKA2HQ1b/A+zwjVOOs5OLP
TLSH
T1037523045BB65092C22BD8B84091F284E332DF2CBE5D74E7F182B84A7B3DE55B14969B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 97dc5a79a79b916700a2c208bde5f74f9b0e53d53acadcbf752a161f614f69ea
MD5 9bd6b45f918925bfad3313fc9b151bf5
SHA1 a54e9b322e3430a43cfa77566986f9979cdf7c15
SHA512 b87699020c997e6e9d459215339c9c612fbcbcbd3b002282e702f658e7b0552a7e3a7f5c5f682015335de6eee3ae73ffb3156e947d3f1a4f463ef8233a08640f
SSDEEP 12288:boIFR8UYKA299QcQbJZjURK3z/ojVOk9scqVnlOq8H8cvP:bouRgKA2HQ1b/A+zwjVOOs5OLP
TLSH
T12C7523045BF64092C22BD8B44091F284E332DF2CBE5D74E7F582B84A7B3DE65B14969B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.7MB
SHA256 5990c34488ffa2a4d64da6db1577259470d43c8296c413ca228aafcdb4bb51f2
MD5 ddc10fe2acc45bf57b5838584acea415
SHA1 d448c57263fbeb2e75a927cb2fc1231cb8effd78
SHA512 c422920f3c8fcc819c5e7ef469d9367d04ddf6669d5cdc55360fcad78996484184c087c1f91bc215d0557540bd743f4a6df962def2fcc9a236e3b4a1277fe875
SSDEEP 12288:wyPz5L8dIFR8UYKA299QcQbJZjURK3z/ojVOk9scqVnlOq8H8cvP:BzyduRgKA2HQ1b/A+zwjVOOs5OLP
TLSH
T1CA85020777A530F5D137913884926A01F332BC355B2499EF53A0567B2F3BA90AE3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 a656bb38dc283b12927abc3c403e490d06e09ef438f84e555afb069c748e3389
MD5 d7c160dba1a590cd431425580c3ec319
SHA1 19359a926484dbb3a4131900bc42ef90847dfac3
SHA512 cf4bc17c28c960db46b7035a71a134c2dc00e339c46f0b5fb7ba3ec5db9d5c76b4325d27b65a6763cba1171340c10f9b3fefd8e7704900d55399a563f527a78f
SSDEEP 12288:pkIFR8UYKA299QcQbJZjURK3z/ojVOk9scqVnlOq8H8cvP:pkuRgKA2HQ1b/A+zwjVOOs5OLP
TLSH
T1F17523045BE65092C22BD8B84091F284E332DF2CBE5D64E7F182B84A7B3DE55F14969B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 42b1fd1ff16e299518839deef2fb9d1fb68bd6d0d137f1dfe6a0bf0fecbd6b81
MD5 d4702c8efee2942e5043c86811dfb5df
SHA1 3d68231957f0e0af48c7aa434970d7bcb5648f8c
SHA512 837921213cd0956b2b7a84619ffac769bc2ba82f892506c27fbced11be96a2907b6223bb933ee94d30fee4ff1aa9cdb14aac3075a6949e501e680dd8b6f3cb0b
SSDEEP 12288:6kIFR8UYKA299QcQbJZjURK3z/ojVOk9scqVnlOq8H8cvP:6kuRgKA2HQ1b/A+zwjVOOs5OLP
TLSH
T13D7523045BB65092C22BD8B84091F284E332DF2CBE5D74E7F182B84A7B3DE55F14969B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.7MB
SHA256 035ce864d7ca448e4293c8ef8452d64751a517aaef5e1414b9b35b218866a060
MD5 6f78d403be0cdde2eeb0a0a1a01fae06
SHA1 4d817ac9ce75bdddd9ca1e7122e5602b6b581485
SHA512 8501b6a4efd5622e55082e157837de137735b9cefe4071813a0852ac2ec8f3e3c3b48514d4e6a7b9ff6ea01f4c065ad2264eaf5017572915dc9c5d29d9e33f0f
SSDEEP 12288:pyPz5L8dIFR8UYKA299QcQbJZjURK3z/ojVOk9scqVnlOq8H8cvP:IzyduRgKA2HQ1b/A+zwjVOOs5OLP
TLSH
T14E85020777A530F5D137913884926A01F332BC355B2499EF53A0567B2F3BA90AE3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.8MB
SHA256 eef7a96cd2ed8eb0245dfcace86b327c3a4fdd1bcc4b76c190ae8b5a6900a735
MD5 42770ef37df204147b4c1b20fb6d8b6f
SHA1 cded17b7eee586a3f58d9ba317877df849fb0568
SHA512 0203712a4ebb7b307decbc4676efcd9814209dcff494230bcb0bbd0c0dabca2b1a2f9bb399d7682b86c8152f785d56d4ffe4dcf63c6f397395a574a030e9a7da
SSDEEP 24576:vT9aLl3z0zDbuRgKA2HQ1b/A+zwjVOOs5OLP:vTQLljeuLZHQ1EsO
TLSH
T14E850294B3A018F4DC67813EC8519905D3B2BC290B70C95F13E4365B6F377A16C2EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 2.0MB
SHA256 0e87f6815124d9deaf4054fc45f16534076477e31606ef758fcd2d230265298f
MD5 761d8a32ea005a0686a51f3a84dbe19f
SHA1 c49aa2119bd7b0491db5baea08bb2ad2262f553c
SHA512 7dd448bb3b19c4c8fa4fe4c9fb6c06b2d4f2f034e1983681b3a882541f5a3e8aa63215903b7ef4e9c9457ce46980b5a60c29c0e39205cc829204fe8eab263cf8
SSDEEP 24576:w3td9CHKy7GZ3uRgKA2HQ1b/A+zwjVOOs5OLP:6td9CHKya1uLZHQ1EsO
TLSH
T18E95CE90F3E410E8F1B79A3588729501DA76BC691B31DE8F03A4655A2F33BD19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 2d9617f8df053bc56d7a9241ed2d981355875d6162ba2f5149e919affed5cb8e
MD5 9f0ad053c9b2a7671c582f8daaf5d97f
SHA1 5b084ff8027269124a57f25f50a7f56ba1f6f882
SHA512 df59976c0dc354216ce30974e0c1a523cf1fb5368e15415ba759c4f56c6e1eb994a2fdae8b6aeef7cf350159d6c8cf6a70e6f3470302db4252be219e271e79b8
SSDEEP 12288:ALIFR8UYKA299QcQbJZjURK3z/ojVOk9scqVnlOq8H8cvP:ALuRgKA2HQ1b/A+zwjVOOs5OLP
TLSH
T1047523045BF64092C22BD8B44091F284E332DF2CBE5D64E7F582B84A7B3DE65F14969B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 44681a6189dd4fa23e3a1a1ed4f218238f859cbcfb4462227427e2a4b743bec3
MD5 944ba48966062dcb8488108c5c14948a
SHA1 05ce9f055f8e5e4ccc9eb6bc2a8166c5607f28c1
SHA512 cb1a7fe7bdb89cf361645fd1d349f8a102fa90ceaebd3c69e9cbabd0058581cca71bbc4487ad03f6fd8f02a4031ec1d978c29b627b3e8770c6d08ea65e8068d5
SSDEEP 12288:E9IFR8UYKA299QcQbJZjURK3z/ojVOk9scqVnlOq8H8cvP:E9uRgKA2HQ1b/A+zwjVOOs5OLP
TLSH
T1207523445BB640A2C22FD8B44091F284E332DF2CBE5D64E7F582B84A7B3DE55F14929B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 64fc4abd587d77e89a093d22f1f6e6cf1f51017199afccce3d3d95304c5749c7
MD5 99128d752762e221c427b4a0d0271f50
SHA1 4eba71d1a027413c92f86c74dfe8b4333a6bb128
SHA512 bb59e3048536a8ca46715d443733c47e49f239a843234fc01d549474e8866776d715945c6ed8e6c5cba5a3b33bdbb893ef7dfa607ea13abfd8c00115070ceb0b
SSDEEP 12288:2mIFR8UYKA299QcQbJZjURK3z/ojVOk9scqVnlOq8H8cvP:2muRgKA2HQ1b/A+zwjVOOs5OLP
TLSH
T18B7523045BF64092C22BD8B84091F284E332DF2CBE5D74E7F582B84A7B3DE55B14969B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 709e0321011c87202ae60aae77856322488f12d1b760934951ae53526f55b867
MD5 c5bdd65eec98b08f2c3ca1cff6a4da8f
SHA1 517ff086247a1db7b502b287ae3e4b0d061721e7
SHA512 45b6d07b8ad7cf9eab287f37ed5e501fc954e2a73e974e8f018b707b0b903eb8002b8f851d200e93fa476a3317c99905511afb70530bd977bfff0c6bc18e6736
SSDEEP 12288:LkIFR8UYKA299QcQbJZjURK3z/ojVOk9scqVnlOq8H8cvP:LkuRgKA2HQ1b/A+zwjVOOs5OLP
TLSH
T1087523045BB64092C22BD8B84091F284E332DF2CBE5D74E7F182B84A7B3DE55F14969B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 7db35a5bfe2b3c0569f83735e3d6905fa7e123b2adaf94e0a770596c6ab80264
MD5 38b085acce7e034ccf2c922c426c19f0
SHA1 189106910f11f8a813bd3aa54743a9e89ce72662
SHA512 2453577836344e0c94747da3480e35317b568c38d70283663056b95f7fa045c8b8cebff1d2bbb22ea8292fce19627e0de7d96312626536fb3a27a24bd9ab3e0c
SSDEEP 12288:yLIFR8UYKA299QcQbJZjURK3z/ojVOk9scqVnlOq8H8cvP:yLuRgKA2HQ1b/A+zwjVOOs5OLP
TLSH
T1027523045BF65092C22BD8B44091F284E332DF2CBE5D64E7F182B84A7B3DE65F14969B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 d476e35e2d5ca94fa1fbcd5739202f5cde3f490604bb4b3f8be98f8373bb7384
MD5 e70e1831dbccabdf654060efd5357091
SHA1 45b61e5d40fbef8fe8b7ce2ece94afa0863e97c5
SHA512 2a3318e564df06db142e8cedbcd399029c6023f50e7c504c596335929fa5781500259e0493b9318e3548789e1fef52c0dbd6be6a1cc8a6742c6e50b5a168dc49
SSDEEP 12288:HMIFR8UYKA299QcQbJZjURK3z/ojVOk9scqVnlOq8H8cvP:HMuRgKA2HQ1b/A+zwjVOOs5OLP
TLSH
T14B7523045BF64092C22BD8B44091F284E332DF2CBE5D64E7F582B84A7B3DE55F14969B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 8586d29e001fdde61563bf8a9bc8a76e60532b47e55b6b42d8757067936333ee
MD5 5c8ae42570e33b962d49f5f7a3355173
SHA1 d5fa087d5d8dcb8e0d5218d9ea6f53bc7d4e04af
SHA512 9908b86c676513789e9b83dc4350551bb2d54c746934f6f0a5da160135bc6843364b695d0e6e003a74fc645500199c06e7100f57b7e5514a60fcada6eb39088f
SSDEEP 12288:lqIFR8UYKA299QcQbJZjURK3z/ojVOk9scqVnlOq8H8cvP:lquRgKA2HQ1b/A+zwjVOOs5OLP
TLSH
T1087523045BF64092C22BD8B44091F284E332DF2CBE5D64E7F182B84A7B3DE65F14969B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.0MB
SHA256 2a03edfa6c13be69c12a85c1272935462fa451bef20cad82c6a81b5814faaae1
MD5 b3d680407176f0e8554950ece237eee8
SHA1 6076d0d052ce63cba27caede62dc5bf5476f68cb
SHA512 479be346df1f573e130970c3427067b96c61d8ce799e0f906205f05b6d13050afabff84e5aaab326cd5612be0a3803dbd79483c838fd2cd26ff4c4e0920d4cad
SSDEEP 24576:xfwvok9RX6wkyAI4uRgKA2HQ1b/A+zwjVOOs5OLP:PMnYI4uLZHQ1EsO
TLSH
T1E9A5D029EBDC44E5E177913C88B3460AF2B1B8681B31C6CF1296536E1E37ED4AD39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 67dd7534bcc5cbde395a567cfe07db431ce119f7236fe6d9f8803c0f5de1133c
MD5 a58cd27d2bc7b608374eefe9f0d9acff
SHA1 70a97b00c700698c3f45a2d3885927a284481beb
SHA512 f05413d19d46e95535d61584dd895fb98e97cacee9edcab970b1c1af42b6d48beca6e834be2b1748d960acbc410348d67c1862d21f62217d56cb4ca4475c47b4
SSDEEP 49152:2YvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0/uLZHQ1EsO:yySzPN1W
TLSH
T151066C56A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 78346d90751032fd6dfa341cfd44db95d9207eb4ed8e0024494ab8c5ce04a5f8
MD5 f4326fad644a68eec71e193b767ff310
SHA1 7bfdfe6dc414a9c2838e7f4be17cd24fb3d3a7f0
SHA512 cae6a9586ff9130025522f00713fa3a13d740f8999034fee00c51cac85e7c459873f7c2734596aa0916881253a857fbc257a81f64cd790dcef1d2adc82bf275e
SSDEEP 24576:/47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYJuRgKA2HQ1b/A+zwjVOOs5OLP:/47JUQj4irIhCnDHUPfF/PuLZHQ1EsO
TLSH
T1A665AE1DA3EC01E5E1BAD27885158A1AEA71782D1F31CACF1270827D6F27ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 f369eabd98dbbd54888c53f1f2400d08d1c4064c7754624a4e8d26f34876eaa6
MD5 fd70044302469aba541e131386539d84
SHA1 5357c5ce6b2b8d85c37bdc46f6ef3c64895522ab
SHA512 16865d4c8dba9caaa4aaca31a4e9a5676f0499849e935963d2e03468656ecc508a97b53ed51f0c7b6929f595e3ccc829edcb2f8125c319e383b6d94fbdf097de
SSDEEP 12288:fGsfUIFR8UYKA299QcQbJZjURK3z/ojVOk9scqVnlOq8H8cvP:tUuRgKA2HQ1b/A+zwjVOOs5OLP
TLSH
T111850109D39801E5C16EA178C7519640F333BD2997E5D2CBA2D0F83E1F3AA90ADE9753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 967996976637993ad9a1ce3daa05634a6d027065790cf2741dbfd02ac5bbc313
MD5 ad88d41b2afb63e5d1c970b9a27aeae5
SHA1 e80d2e8530e3196578361e5f748016984d40a7b2
SHA512 ecd40a2495be0c8945f7fa87ef599ca1a5ef0589fe23483e087011245a0d0855bc2e003664ec5efa36cdda9c4ccffbddfd9cfa48475cd9665cb832b9d00459f6
SSDEEP 12288:Beb4iXFU3fqhli2bUW0KEESHAXRMTKT6e:BebVVUPIi24dIiAXRMT26
TLSH
T1633506017626DB4FC66940322E32D5CCA7707D41EE08AF07B3C9873FD576659BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 9d8b8996bafe75fa3063dbc5ccf0718010f87ea7505e6eb75b8d7abfab89e899
MD5 6a1121582a316abfc32c5afe581362bf
SHA1 9207b8aa9d08600b739ed53b8abfeafb238429f3
SHA512 a9b9be0d1eabb8179a0ed2e05941b846e780f4a622c7893986d86cf6e8919b9064d3019f1941eb7e632b124547f703dd174077c9bbd698186cde2777675c014c
SSDEEP 6144:tHryUzcR5+FtQbTrwZ+a1QpJ/3YFM/SWYRQytMxSQytMxkavCtCT/DKCRkS3yY5Z:tHryUzcRpbTkTQb/wdgm785JD
TLSH
T17D55C6815136E3CFD1BB6132072A5F8C77A4EC06B7495F26B3C9053AD82AB51A0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 c27eb18528c6d685e10624fe6ce8349be7434355f30c91d224493e79d8a1c6f0
MD5 263ceef63d676e969704deffd6f9fde3
SHA1 58a68b740cb918157ef7a8a2ffece2ff8027c523
SHA512 5bb75086ade0f1f01948427bec62faf414482dc3819e5be86a082aa2da8c02d2fa39725490a5b274bc1e75dbd7abfa5e1e455508271d9aa7ccba51cf6307b9f8
SSDEEP 12288:hM78IFR8UYKA299QcQbJZjURK3z/ojVOk9scqVnlOq8H8cvP:68uRgKA2HQ1b/A+zwjVOOs5OLP
TLSH
T19A7523005BA95492D53E98B44092E204F336EF3C5F18A4E7F481B88A7A3CED1F97575B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 380f647fed8dee923a08c793a3916a414a05a7be9c11fd28f02dbbecbcf2880d
MD5 3849da3a7ec94c366b7c91fd0549c696
SHA1 7e3b4de19b062cd9f635bb5b5ca0c23b040000da
SHA512 700a8c5e862f5356092d047887e9cd071cec145ef4636d0c46930c24275c948f053050bb1ce3b8655fa974f78eb36f5a8cf0be5d8d359b3ab86afe41d594822c
SSDEEP 24576:ggb6bmBIi49WNNFpg1rSvFv7bYeuRgKA2HQ1b/A+zwjVOOs5OLP:ggb4mBIBhGFJuLZHQ1EsO
TLSH
T12065AE1E22EC02F5E0FAE2B8CDA64417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 7353dc9558e04a8cc429ad7bbbd5cd7eb04b9eb13e24b4aebc366317a1a2dffb
MD5 591ae6cde83bd72a5fffbbc12fa27a3d
SHA1 eb45bcfe620cced13f4adb2b32d4c8efaa4e3628
SHA512 2cb3df89cf05421dc3137ec01b78455c5bb0b73c98fa3e6458a5b336a74094a992acb5649f19ac9ebec1874b7fe99c31d8d66814a9728f304c73ba49d4b23b0e
SSDEEP 24576:JG88u8FpJqH1Wzria7/m5uRgKA2HQ1b/A+zwjVOOs5OLP:c7ZFPqVha7/GuLZHQ1EsO
TLSH
T166A5016577E101F0D47BD13889828653F2B2B8250364FEDF06A88A561F37BE15B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 e9dae1e2c4bd7bcb481934779f8e68932c074ae0d655ed40d9a2b01e3022fc19
MD5 3216b0845032d4167114b5f8a00a18b1
SHA1 88989e0b93d7f54c00cafac89e61c97eab873410
SHA512 8903de4209c90a7e56129e6af616a88fa5f18c4c5313026b17ef20ad5f1f249d1e99dc7210fd5863558155089d8d8d845c60df359064be04d935b6ac014768c5
SSDEEP 24576:UPUr+NQ1uRgKA2HQ1b/A+zwjVOOs5OLP:UJQ1uLZHQ1EsO
TLSH
T1DA85E11E26E918E5E67AE17C85828709F372B8661711A1CF02D0817E5F37EE8BD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 021318c05bab395fbead46272ecf042733745d92965d4d4a23ccb09af8ac92ab
MD5 7615bc39d98021eb056675931fe3b201
SHA1 16127db9c47681d71639736ed2733d119a9d6219
SHA512 fa0a07821ce6d5e59836a64877f5d72fb59752fec961ac4a23d127d0f71b1712e35c522c5c87bb4b996f133a507bba2e02f349d2264266ad2d1ae57cb093bf84
SSDEEP 49152:2BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjluLZHQ1EsO:ZG05lO43bi1W
TLSH
T1CCD5C06A62EC11F5D1BBD17CC9C6860BEBB23815033556CF02A486A91F27FF4A57E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3ae3989a6f130468216dc39a1f77eccdfa44b4317dd14d75ab83ec074b7e78da
MD5 f2e92f84769daa39fde2568257ecea55
SHA1 35501d5b3ca3405dc5556b936c590bc60122ba9f
SHA512 7c4cf5143f49e5014399a72c1f87ac7352cdbddd28b939fd00931a1cf78c4fa69ab47a46a81898bd972ce4da3aab79409f589a00923b5da6a3ab7bddbc5277ef
SSDEEP 24576:Zfa5POZ3dpqWVM50JicR2hG0lasx2+47eidn/uRgKA2HQ1b/A+zwjVOOs5OLP:Ja5POZ39Jt2pasx2+m9uLZHQ1EsO
TLSH
T13665AF5EA7FC01D5D179D17CC583860AF5B1342553329ACB122182BE3F2BEE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 660c3378fb620e63440922256bc41bac365e93359699878e08953aacd5efd50e
MD5 98fa5588e42f7ef6722bbd6c97c4961f
SHA1 94d23eb419b54b599197f1a4e4a25d2831b9ab8c
SHA512 5da57fa50b543b5cb289e68bbefb884aeca7171b08eb6e52a68efabe7a72f7713b994889eb5816a6e1d9f201c48dfe26792eb67c167f0be876ce565e6461ff1a
SSDEEP 24576:JNcwHdjbyQ4nLC18lb/EOjowL7FkxuRgKA2HQ1b/A+zwjVOOs5OLP:JNc/zEOVHFmuLZHQ1EsO
TLSH
T128858C1623E901E4E1BBE1BE89779546FA717869173086CF0291851F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4ab7ecdc9df4ae0856f9f011bc5040fc11e5804bdec546f447f6967f3455e96a
MD5 ccf7bcc170bb415722fce579ed2c3d7d
SHA1 0a6057bf926e0a1481bda964b1ca87ec757ff010
SHA512 3fcf4c3af8615483d6868e167e6429c3f7f0178975811683176a334e1a254b69f3097ec2eb4256f5a33375442d166306e0abea63cb22e5bdb3db830338b7ea08
SSDEEP 24576:ytkNvNnaFeYhJNtmZBm+iuRgKA2HQ1b/A+zwjVOOs5OLP:ytMwBtOmXuLZHQ1EsO
TLSH
T10055AF2EBAF845E4D1FEC6B4CD238512E6727861173292CB9290C13F1E279D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.9MB
SHA256 34f9613f94f57b687d5389cec9630411dba6e6d63a0a15fa43c2b4c8d5d0d4fb
MD5 c5c42d33c52aa5424a8dab6c958a3ab6
SHA1 bd6b59b089ba5689dafc55cf0a124c11dc6f56cf
SHA512 5e2542ce2e7e3cfc238b348d313687646fbf8c20fc86e1a7b960c5d693de104ee98d04710c61b85098883150803acfd78a016fa02a94164b3a6c9f0c4ae7e2dc
SSDEEP 24576:aD3FHshBIYQgAQuRgKA2HQ1b/A+zwjVOOs5OLP:aDVHeBIAAQuLZHQ1EsO
TLSH
T13395E02DEBAC04E4D57BD1BC85638606E37278AC072265DB12D091BA1F2BEE47D39B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1348-109-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1348-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1348-315-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1348-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1348-103-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1348-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1832-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1832-30-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1832-31-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1832-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1832-144-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2948-0-0x0000000000400000-0x0000000000637000-memory.dmp

Download

memory/2948-6-0x0000000002510000-0x0000000002577000-memory.dmp

Download

memory/2948-8-0x0000000002510000-0x0000000002577000-memory.dmp

Download

memory/2948-15-0x0000000000400000-0x0000000000637000-memory.dmp

Download

memory/2948-1-0x0000000002510000-0x0000000002577000-memory.dmp

Download

memory/2988-400-0x000002830FD80000-0x0000028310400000-memory.dmp

Download

memory/2988-329-0x000002830FD80000-0x0000028310400000-memory.dmp

Download

memory/3144-80-0x0000000000400000-0x0000000000680000-memory.dmp

Download

memory/3144-81-0x0000000000AC0000-0x0000000000B27000-memory.dmp

Download

memory/3144-86-0x0000000000AC0000-0x0000000000B27000-memory.dmp

Download

memory/3144-311-0x0000000000400000-0x0000000000680000-memory.dmp

Download

memory/3280-53-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3280-55-0x0000000140000000-0x00000001402BE000-memory.dmp

Download

memory/3280-43-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3280-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3280-42-0x0000000140000000-0x00000001402BE000-memory.dmp

Download

memory/4108-97-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4108-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4108-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4108-91-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4108-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4108-332-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4152-23-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4152-17-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4152-114-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4152-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4152-24-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4228-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4228-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4228-135-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4228-137-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4772-68-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/4772-70-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4772-296-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/4772-76-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4796-58-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/4796-64-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/4796-57-0x0000000140000000-0x00000001402B8000-memory.dmp

Download

memory/4796-275-0x0000000140000000-0x00000001402B8000-memory.dmp

Download

memory/5196-314-0x0000000140000000-0x0000000140327000-memory.dmp

Download

memory/5196-115-0x0000000140000000-0x0000000140327000-memory.dmp

Download

memory/5196-123-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5784-146-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5784-152-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5784-145-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5784-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download