cd7a83c0db190fe1c61d6e7e9a9415d480d39b4f4cbbcd1ddb9ffdc231700b43

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_682422984053f0713fdb6586e6e6f3f0_amadey_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Size 1.3MB
Sample261024-mcflashs5z
SHA256 cd7a83c0db190fe1c61d6e7e9a9415d480d39b4f4cbbcd1ddb9ffdc231700b43
MD5 682422984053f0713fdb6586e6e6f3f0
SHA1 316e9f7c391807318662034042f9608ef0f6aa44
SHA512 06cac51f1a875791fa171e2c54acb6df1290a8d7dbefafc802eac33bf28f929b3aa2afc3296520ce4fdcbe39833f752fa3805f625efe6e2ffbd5c9049ca55947
SSDEEP 24576:5jnT6k9lPBtwC7KEg6hMLFMGyY9xSjsZ9T74yU6dITiXLMkpdHrkhdcYLEwZLKPx:5/lPBqC7KKYFBRZJ7L7wmbHqdzgwRKPx
TLSH
T1B455F110F592E036D4072132552CF33DAA39A6054F708ED7D3888EADAFB52D15E366AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4424	elevation_service.exe
5084	elevation_service.exe
5076	maintenanceservice.exe
264	OSE.EXE
5180	PerceptionSimulationService.exe
1128	perfhost.exe
4248	ReFsDedupSvc.exe
2860	SensorDataService.exe
3064	ssh-agent.exe
3448	AgentService.exe
5680	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-22_682422984053f0713fdb6586e6e6f3f0_amadey_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\782c6c217465cd71.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-22_682422984053f0713fdb6586e6e6f3f0_amadey_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-22_682422984053f0713fdb6586e6e6f3f0_amadey_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-22_682422984053f0713fdb6586e6e6f3f0_amadey_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-10-22_682422984053f0713fdb6586e6e6f3f0_amadey_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-22_682422984053f0713fdb6586e6e6f3f0_amadey_darkgate_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_682422984053f0713fdb6586e6e6f3f0_amadey_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000041295420a163dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000025a13520a163dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000094b6320a163dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4424	elevation_service.exe
4424	elevation_service.exe
4424	elevation_service.exe
4424	elevation_service.exe
4424	elevation_service.exe
4424	elevation_service.exe
4424	elevation_service.exe
5084	elevation_service.exe
5084	elevation_service.exe
5084	elevation_service.exe
5084	elevation_service.exe
5084	elevation_service.exe
5084	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3292	2026-10-22_682422984053f0713fdb6586e6e6f3f0_amadey_darkgate_elex_luca-stealer_mespinoza_njrat.exe
Token: SeTakeOwnershipPrivilege	4424	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	3448	AgentService.exe
Token: 33	5680	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5680	SearchIndexer.exe
Token: SeBackupPrivilege	4248	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4248	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4248	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4248	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4248	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4248	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4248	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4248	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4248	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4248	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4424	elevation_service.exe
Token: SeDebugPrivilege	5084	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5680 wrote to memory of 4848	5680	SearchIndexer.exe	101
PID 5680 wrote to memory of 3600	5680	SearchIndexer.exe	102
PID 5680 wrote to memory of 3152	5680	SearchIndexer.exe	103
PID 5680 wrote to memory of 2872	5680	SearchIndexer.exe	104
PID 5680 wrote to memory of 4712	5680	SearchIndexer.exe	106
PID 5680 wrote to memory of 3936	5680	SearchIndexer.exe	107
PID 5680 wrote to memory of 5916	5680	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-10-22_682422984053f0713fdb6586e6e6f3f0_amadey_darkgate_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_682422984053f0713fdb6586e6e6f3f0_amadey_darkgate_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3292

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4424

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5084

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5076

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:264

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5180

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1128

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4248

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2860

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3064

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3448

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5680
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4848
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3600
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2952 2956 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3152
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2928 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2872
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4712
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2952 2956 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3936
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2928 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f5ce3cdb33d5e9bd1714bb51e9d0028a14130bfd65b0d69072df74db5a7cca57
MD5 2beff566a70cb33f3e7cc79dba7c018e
SHA1 669ed095427882a329d0aace3ba4f59f8bbb4584
SHA512 bc162fa4827804d11e63258bcd1bad26bd9386fe53725aba40a3a40080eb6e72428c1b563a9d9df72f3a4b451dac85568d6adc24193d00d01a22767e626a66a3
SSDEEP 49152:sb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnbwmbHqdzgwRKPI75o/:W3q6tjBC5bKhgwcPI75I
TLSH
T14DD58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.8MB
SHA256 19c92299051a1bc38b42cf91a8fc9f6d6886e31e6a3daeeedb931e26eb79a7a2
MD5 7973ee98e696123f82e71cf79f612f4d
SHA1 033908f965dc447a67b45a0f73cfeaca0629b8ae
SHA512 f493e0ff52a78e110ed37ea903ce9715c3741a5e8de36b61ce0126035d85daa7706d214dfcdad4036c2c16929fec679ebae0e72373995bdfae8cedc1854303ca
SSDEEP 24576:6XYfDtczAOITiXLMkpdHrkhdcYLEwZLKPId55o/:htchwmbHqdzgwRKPI75o/
TLSH
T1DB850128B7D504F9ED67823CC8A28511E633785547A0E7CB03A49A7A5F337D88E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.1MB
SHA256 3e1a51a84f1041bc161aa1d91c3a55f5154a665c69798b3df345a68d4da75f4a
MD5 5ff7863690d845ddd424af525b142b37
SHA1 116d102698d4667bd6a31a253cabd2cdae79047c
SHA512 bb2ea3f9ab3daea467fe0ecb3a5667b8220bd8f3c7fb2563c30047e09341a5de2e6c11c3140c1a765bc6b3c3b8cece525ba62a1ab4ab9540fe1344370aa5b7f1
SSDEEP 24576:y0Le5ji0hmxHrMzITiXLMkpdHrkhdcYLEwZLKPId55o/:yPji0ARYwmbHqdzgwRKPI75o/
TLSH
T1AFA59E16F5748331D073C0B9C5D2A69AE97230865B308ACB4286D77C7E67BE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 daade9dded541161aa0e6db713133c156d4e63b3e2e18e7210c0270c11128e65
MD5 6bf49740d54ea21b1ff3752cf51014e3
SHA1 cbca3f4f280930a6eccd905c12cd537ee57738d4
SHA512 78b113e006f6fb8b9219d89321cc92ebce9df5d3c6824249673db589d20a3d5c35883b1233277b0965c6efa4de5738ee27fb6d17249e95a216a0d1800debf9b7
SSDEEP 24576:sa7/ezSC6vUyDZaqgrvWx6q8wyuxITiXLMkpdHrkhdcYLEwZLKPId55o/:L/ezSC6vURPvMHjykwmbHqdzgwRKPI7C
TLSH
T174755C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ba0bf2c30ef1587e01fe19d1c80dba5e0c6597eb002a8a8144754342a6511926
MD5 024cd1d4b64ca3e36d03a9879cf5c90c
SHA1 ca85bbf81d71ca38fa9adfe9d740f865cbdee999
SHA512 c85dd9677e42248923cbb96cc49e8adacfe9295fbbd0bf9d3805f6daf04a318caf97c3f6a999596b5129639f21941d94681bf36dc20885d930f26eb645a12acf
SSDEEP 24576:OVbqPb88hv/lV7SITiXLMkpdHrkhdcYLEwZLKPId55o/:OVO88hXlVWwmbHqdzgwRKPI75o/
TLSH
T1AE559E66F5B48331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677D6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 639b05f1a90dcdb411ee76b36ac7f4364391fb7f14c6f76754f3e5ca93d45642
MD5 17c008e5de73a800f971509200ecf747
SHA1 45351b92a7382c3428d35ef673bfa828cbe3817a
SHA512 0ff5e4d4a85d35b031cefa788448da4d29be58763fe22ea0a9eee909d50aced7f84cc7bd3d3740446bf9abb9b2af1fcc06110df54eb8d3f204ede3e4859b6d83
SSDEEP 24576:jPHITiXLMkpdHrkhdcYLEwZLKPId55o/:zwmbHqdzgwRKPI75o/
TLSH
T17A75232DED9EE016D3F60A38948157E195137E888A80C64ABA06F77FF83D6DCCD16066
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 b1957e2bc005d6b6f63ef419d6e22bc717e3714378c554d1c456b6fd21c432d9
MD5 40a45a31dd046797f7726a768a452b9e
SHA1 45cbd4c4f97931a7084e4e12a83c065ce7543662
SHA512 1268789d3e60fadece603280bc5a34e98689afcce7319a28836b206ca304114ffda19f48d66076d1874ae995452daaebcb7b0d26a9a1b6898859d442e572363e
SSDEEP 24576:PJIUKITiXLMkpdHrkhdcYLEwZLKPId55o/:PJIUKwmbHqdzgwRKPI75o/
TLSH
T1CB95BF3BEE28FCE2C27A4DB85A918740D77278704B5193CBE165C30EDE235E54E7A825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c5b462e02678eef080a1262e2f272cfd6e8c3dbb481b425aa1fb6d107f54156c
MD5 a69b5bfd19f8e8f11b8d094b9fc01b04
SHA1 c9daa3a1788978783641e758357bad920f2a9f32
SHA512 4b20ae41a744746b3131f50fcab84dbe51c408170cdc1ce75c6a70f7055ecb14577ba424d852f48f78641d743fa6d312bf0229f9a9f11159a6d1c27c384ea74b
SSDEEP 98304:MQvGAdlCEL8c/pRNw5CB5bKhgwcPI75I:xvyEYc/p3w8bKII7C
TLSH
T1D7266D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.9MB
SHA256 6c7c4b6b210d3bbce2417bf57f3601df7d8dcffc57318d075a6669273f92c38c
MD5 dfeb6cd681eb7b6152968dec04bad1ed
SHA1 75cc029a2360ac5fb1d66dc14080217ff3e8be55
SHA512 e348bfc3f8df3a36145f98759ea2398273bfef0ffdeb1fa41c1699b44dd5c10e0ac4c2739fb174227c66935f742c2230248a2739ae4332df4ecb3ff9c5e6b24b
SSDEEP 24576:1gewsAjoITiXLMkpdHrkhdcYLEwZLKPId55o/:uljowmbHqdzgwRKPI75o/
TLSH
T14595E031FE75E036C3BB0DB51B26C716542D7A204F911AC3F3A88E9E99342D25736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0ccf8ec6674a02f20a7829739c5698315a0f41837fcb1082e10a5cc7c36b1b21
MD5 bc4a4b908c4a51c57d8ce815e99393cb
SHA1 7a152294a03ad901de9578c29e71b646b8938e8c
SHA512 e0d11e91c79963a454b4cd85988c424744fd1c103f4ed7ad63b74b89af711e693f305e678cb894f517b55e558b30e9205fca0e6a32d746ec6caea65ef1919e9d
SSDEEP 196608:KUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHAKII7C:KUEtQevvqc2W1cpV29I32AKu
TLSH
T10D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9104ff664a1b71a8c8c4e5877f23040a0b345d397584a7b5011c4d3bced09c7d
MD5 b123f027021d0f80832d0c17a9bf017d
SHA1 47c9a776c78ceb75fa3a3d19076d2bb8d7639f3c
SHA512 751aaec33b08425ab0fb4cbf1755a429bb042273e1ec3df058a201d98b27711235fa3351fbd1633db3f8f77d814cfd4ccd08f2de952d5cc61d9f05c36a0da852
SSDEEP 49152:KCbRquA/m2yL5zifFiV+XenmE3/zIwmbHqdzgwRKPI75o/:/oqHVjnmN5bKhgwcPI75I
TLSH
T1CBD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 6248aa35bc5750e5f062cd4ecc60db9854775134678f8a6bffc151709bc72e22
MD5 8bc7e0d8179ec2eac36bb8e8a51ac4c7
SHA1 278ee9c9ba5971ad49e75b6b61fb7b9c77b97448
SHA512 e956de2f5f5011c2b9f0196425f706b41757fd770597cabe8eb05394c63e3520c53b9ab187f8d0e8ece02c2cb3a8d254f03f4578526810f7fe3be77b69ee799a
SSDEEP 24576:jAhGLmIFoiwtA5l7S53tITiXLMkpdHrkhdcYLEwZLKPId55o/:jAM1Foiq5dwmbHqdzgwRKPI75o/
TLSH
T185359D81EBF951D4F5B3AA7899B69571EA72BCAA5E30C20F2150D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.8MB
SHA256 6280ffe7dca4f2b01d3c76ec388f4f51d60231ca8dcf5b930784e8fd9e38bfc3
MD5 be86a5dfcfa8c3fdf30116f92afb1853
SHA1 47f2c21b7c10f801730861bbd4314345a8993b07
SHA512 6ab80c59915233cdea182e05ae74501249a8b220f8ce4101e436e7b85b7c3139e67231bf570e2d45941a58ad3285738c5fec4bf8bbf05a69b782b514a2c7de18
SSDEEP 24576:HwuXOWEITiXLMkpdHrkhdcYLEwZLKPId55o/:HwwOpwmbHqdzgwRKPI75o/
TLSH
T1CE85F10A76E918F9E5A74638C597C632E7B3BC052A20C71F1760C65B6F37361AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 40460652da8a5652e66081f41a4dd5ceee8117ebba8a5e97566ea577dd6faffe
MD5 a2a6548515b38718236631ab7b75df59
SHA1 106cfa26aea207db81dfabe6e738d010ea9ffc87
SHA512 7d57343a1a030ced20ddac4927072f840a8e412a207261a1348929cdf69d51fe5986ec5eba010a508c38af8184626a5a82d05b2d8d0bd5f2167ff48ebabdfb3f
SSDEEP 24576:PZurITiXLMkpdHrkhdcYLEwZLKPId55o/:wwmbHqdzgwRKPI75o/
TLSH
T13375122E36D970BAE2A7463CC8E14741D7723896577183CF2615826B6E37BC58D3A332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 998d30304c75719a83d57b2fce9d24eef8f610688e0412990b569c6700e1d64b
MD5 81915505f2be29de1dcd2fbb8364ca1c
SHA1 6faa65c9b8ff90f31f5f35ef3e026461f0fcfd8b
SHA512 165ba39846332ec6e07f03d0547a4c46198b2c9730f4ac1ab6fc4cf85f35e2156c19a13f452cb2a700cd9f075e96a9ccfc896c59e0f257a2d0c7e5514a1cc76b
SSDEEP 98304:DQRQyi36YOcPuLvw2gAf+PN3G5bKhgwcPI75I:SQyiKakX+PN6KII7C
TLSH
T1F8667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5dd281fc5290f1d8a3fd1b7a22f9f0feaddc04612ee4abfab01060b373c82315
MD5 5b6a2e85b59e45912c614a3d242febdd
SHA1 e53c64ea7907fe29776d5300d402d2c5ca8d276b
SHA512 785a95248c369acd7c3d5ae85b62fa3b570c4b7f934242a3406bf4851afbf258cb08420382232b92520ccb6f09d2bbd0ded01fa95f6350a8ccfcd04034fba2bb
SSDEEP 98304:SQRQyi36YOcPuLvw2gAf+PN3G5bKhgwcPI75I:JQyiKakX+PN6KII7C
TLSH
T1A5667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8082c11c3872e2b3775483731bb833a5164ae773eb5bc2f6acfe63aa2f515bd6
MD5 c30a343bde540aaf7778548effabcdfb
SHA1 0b8359141f6dcfb1eb529932da91c219265de589
SHA512 87dbf5c90123fd7f11c9c7afebcc681f73792e60cb8e2ecaff76c3e05158a6fbf3b064907d459f78cb47b851494c3abc9d4cc67daea966d5b4e1bf7c395a1686
SSDEEP 49152:668Qg55nhxeWu7PNU3/YwmbHqdzgwRKPI75o/:othGRc/Y5bKhgwcPI75I
TLSH
T1CCB54A33B2F600A9C44DE1769F46873196D27C758FE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f646749e92881585193596fbcdaab7337e2c9062e14ba23dddf559847c202f97
MD5 a486e4b35c7472a8cb1baef02dc3ae8a
SHA1 db4174454fce4d466a3e08a35606360a9d6779f7
SHA512 025ddfbf2b152253717fb4c18449d812fdd1975f62838d18f3942691f648693e4cc0679bf70c2d03182d6bac5a0b36afb0c79ae07b8b63f1db7180a6a883667a
SSDEEP 98304:Ry5112gYy5azzVvD69nLKnhZH5bKhgwcPI75I:sLIH+WhnKII7C
TLSH
T183167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b89284bf570c70a1d9b0748a1f0f1db0c9d142d5595356e561e39768d4ac1ea4
MD5 a990c90e4815b381758548d3f98f3e87
SHA1 b502abebbedc2c058b10fd9525c8bacb932e596e
SHA512 0b066baa97837ef38b9b80803a941dbd75c4dab4f60737314b1fc3af38bbea47b233364ee6cd9272c73d4137880dfd4f9c74a260235ae589c41b09c770add4a6
SSDEEP 49152:FB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gliwmbHqdzgwRKPI75o/:ru6JmQxd2di5bKhgwcPI75I
TLSH
T115D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE49B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 3419004b25287efa12251d4c7d4f99bf22964d5fbd78cdb56099ce9b83b5cf8a
MD5 fe2dbd27159ef26be4b781901221e039
SHA1 9fe2b2c423b09f4e1a6f4f87825c456553445eaf
SHA512 a66820703d16dce8adbbc9c606c19331d57051b3e26a0cf90169dc2375cb847da2fcb63be31ba3e5cd7267574b15466f0f61620133a69d5946d5f403b3798d4c
SSDEEP 49152:o1hpsNoJpF1A6yU44CwH7R4xqwmbHqdzgwRKPI75o/:omifPVRN5bKhgwcPI75I
TLSH
T109B5AE13F2D900E8D06DD17887569632EA62BC460B34B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ae1551e48a89926ddaca59e6368106bf453691fe012c68b470b309034a76c935
MD5 6cf5b94a1cde89fac62e1ff6a894d1fc
SHA1 769e2e77043b99706200dca0111b454ae203de6c
SHA512 84cdebfff9ff8a75678ce7da77a2da1a0dbc88d90bfdc4cfabd01ed4bf667021d4ee38cba225b48bdc708f988167069de95b22945108271d42ccfae539e47054
SSDEEP 49152:XSuZQIY0Be2KIRVtOnks6NMHqrwmbHqdzgwRKPI75o/:N5dKOi61r5bKhgwcPI75I
TLSH
T167C5BF13F2E940E8E0BED67487659232EA72BC464B34A6DF064072591E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 27f7665493d2b58216c0e2104919b4c24861e0a56e6b19f9eb2d605ead115dec
MD5 fd709a70224c914e0bd7824e3453933d
SHA1 79c90d2497a7e0e508fee7200478a7b183f0ac04
SHA512 629f1f940fad63d87d9a33656a59a4e039aa15ccadf1b8df4629469b91b89cb199bc10c8d951e1a58945dca7b6fdeedb27ac39dcbe50450ffe78d037e22475e6
SSDEEP 49152:ehtSn8EApI0figGgiDn0AP5wOwmbHqdzgwRKPI75o/:/X2i/phJ5bKhgwcPI75I
TLSH
T14395BE13F2D940E8D05ED178C7468632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 fca08cf99ac2da93ec110536a49d648b91bc987f180b1447d8d165b94037355d
MD5 8e361bed4b6a6c2ea36d408854a20a96
SHA1 40e0ab9b186dba83bf4fcbeae031c5eee0665c81
SHA512 ed7a5d7fc0f38193ef3dc4ac61578e556d734c2c9e1f10eda24746b9a5134d52566e93f67f8ed356a73dfde7a336d622643e90cff4b1a5d9d0e73536170d39e6
SSDEEP 12288:B/Ix521fXLlglkpdHpBcjhdcYxl0xhjOewZuZqLPKqQINL55wemwk/I/:B/ITiXLMkpdHrkhdcYLEwZLKPId55o/
TLSH
T1DE75232DFCDFD056D1A54A78C44157E0D5123E8D9B80868EBB0AE23BF879BDCC91A069
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 8501535e2b895aafaa60264ba1dd88bb8638ecc450c86542542eed72e417e3ce
MD5 37f81f21e83d93ad5fd39d7da80392e8
SHA1 af7d562c1f726b155fd586ecfd51b3411a4be252
SHA512 dd300c075ae1fdcfb7a338ef6fee49512054c91b65f6435db74838c1ae0fd51ea775e2f35c1755446d2c76dc3435ef4a563d9ef71c70d501e1e2d84452dcffd6
SSDEEP 12288:MsIx521fXLlglkpdHpBcjhdcYxl0xhjOewZuZqLPKqQINL55wemwk/I/:MsITiXLMkpdHrkhdcYLEwZLKPId55o/
TLSH
T10775232DBCDFD016D1A54678C44157E0D5123E8E9B80868EBB0AE23BF879BDDCD1A079
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 f43d8cbdf307b8a1d4b235c441828f56d102e166e2f0cd09947696029e2d831a
MD5 541dce28835fa773ce82b1e44eebbbbc
SHA1 7082f62f6ab8ff137cbe7f7028a3c88fd890537c
SHA512 73f753a318dcd5844670f3b3f70684d865fddb6eb6455da450fe01e2c72701780f5da1cc5640cba229e5ca3e5300fcdba28babb0675a1ed61916bfe94c0ad130
SSDEEP 12288:ICIx521fXLlglkpdHpBcjhdcYxl0xhjOewZuZqLPKqQINL55wemwk/I/:ICITiXLMkpdHrkhdcYLEwZLKPId55o/
TLSH
T1D575232DFCDFD056D1954A78C44157E0D5123E8E9B80868EBB0BE23BF879BDCC91A069
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.6MB
SHA256 473631b8e1613008cfb77483866057d2372329295563fb19901e6aaf3ff8169d
MD5 75a4cf2964ed007596735038d184fdb7
SHA1 935586151d3eb2bba3fe48aacba2fecf97d3d6d0
SHA512 af9db28c3b7bac632c8b1536f330adb902e42943e4bdfa9bff106f8fcec2de6ced915b479548775adcc2ebf36a9e593c4c7b8b0ca090969cfec6d100b20bb8b8
SSDEEP 12288:EVNIx521fXLlglkpdHpBcjhdcYxl0xhjOewZuZqLPKqQINL55wemwk/I/:WITiXLMkpdHrkhdcYLEwZLKPId55o/
TLSH
T14A75232D79DF9096D1B68638C48187A0D2723DC9DB6087CFBB02962FAC367C8CD39565
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 0f172181efad725ccaa7812dfa36912f7cf8fb62bbefc9b502c65033b533f646
MD5 45c7cb591cd16259478c609ee88c5537
SHA1 7e9f29b595455d103863a61b73e8ace78c3cfe26
SHA512 2ef2269626478900ad8862a78ec86cd3c3788e87352a02ef2e63e7c5d9ee9cc911b360a88a7378ba189646ac34d54f0aeb1b1d5d4cd6704c00ca13dbfccc24dc
SSDEEP 12288:aVIx521fXLlglkpdHpBcjhdcYxl0xhjOewZuZqLPKqQINL55wemwk/I/:aVITiXLMkpdHrkhdcYLEwZLKPId55o/
TLSH
T16C75232DFCDFD056D1A54A78C44157E0D5123E8E9B80868EBA0BE23BF8797DCC91A079
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 2af5c8b6402feabf7753578a2c747c8d11568fa3bba5a8c16f9dc3b7a87a1d6c
MD5 bfd6fd2e6ea9f5cfca17b3e4a27aab29
SHA1 cda64b5cbf10f497c31ab0ce0f6303bd28194bdc
SHA512 ffbb93854b1f2d15558a026e6755e877f8e2ac3871b4cf674cbe7d56b6ddaac02184b69007576cd0d3b1a3b680f8a2e6d310a09f7b2db13e178ca813ce71bf6d
SSDEEP 12288:RgIx521fXLlglkpdHpBcjhdcYxl0xhjOewZuZqLPKqQINL55wemwk/I/:RgITiXLMkpdHrkhdcYLEwZLKPId55o/
TLSH
T17175232DBCDFD016D1A54A78C44157E0D5123E8E9B80868EBB06E23BF879BDCCD1A079
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 19bdfd01ad38585c25d484861abe301f7ea8554a9e080ee232fdab8bb0a56e5d
MD5 97986c6254a094d1ff98b2a0e44e25f9
SHA1 c10cef7d1b34804859a88cce01f483cb6fec55ca
SHA512 0f540b3beabfc4ed5c71f184c02787384d5b026217d816d3235387ab8a6b3bafd94e027e6f2843d6bf3c6a52044966af3043d4c3ad461b58353d42f84a2e8173
SSDEEP 12288:j0Ix521fXLlglkpdHpBcjhdcYxl0xhjOewZuZqLPKqQINL55wemwk/I/:j0ITiXLMkpdHrkhdcYLEwZLKPId55o/
TLSH
T10E75232DFCDFD016D2A54678C44157E0D5123E8D9B80868EBB0AE27BF879BDCC91A079
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 9e7e82a8cb72c9dbf87f34328301fa58aa218b51e421b0439f7b746f36dc66f0
MD5 5159beeabd77c3d82dda9705fb490a4e
SHA1 d7a6ca6999ebff580492aca3cdea85d148f6d862
SHA512 f7b2d67b06e4e250c0969e43d9c18b30d1fb5e4f76a05939693c16ac0652213ac8b9daacfc8cc25350221dcfd7c2cc433158e82d1062810660155f643fdfce8b
SSDEEP 24576:9ZMZzFVSOMITiXLMkpdHrkhdcYLEwZLKPId55o/:9ZMZzfwwmbHqdzgwRKPI75o/
TLSH
T1A2950269B39118F4EC67823DCC518A51D6B27C5A0B60C64F17A4362B6F333D14D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 60b676829f443c2e899ce83c11512a98bdf3e1560261d55a11d24d4cea1469d7
MD5 2305ad95a7882bff7d6f55c9aa07290d
SHA1 8ac27e2b136500670244a0e11bf690ade40ced8f
SHA512 e9879361e11d51f9c7123336905ccd3e2ccfb47679d18248c9e4b4cc6b92cd5da0ff9400a4cad825fc7d808a23f2c2d09a51717b291aeb1ba54cff924ae35ce0
SSDEEP 12288:w7Ix521fXLlglkpdHpBcjhdcYxl0xhjOewZuZqLPKqQINL55wemwk/I/:w7ITiXLMkpdHrkhdcYLEwZLKPId55o/
TLSH
T14175232DBCDFD016D1A54678C44157E0D5123E8D9B80868EBA0BE63BF879BDCCD1A079
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 18efc3eb58e9dd3fa7b8c18dbfdb178107d52d33749f547fd806d2cfad522412
MD5 2027dda372c0db1628f4bf14ee01d2f0
SHA1 054674ea910ee9b6e28a84ec0e9a3f262c3c2538
SHA512 2164b5a1dde3b2c89090cf72f5b0ff2365fea5e50631ef8fd940dc590ab6e5b8a6d2bb116f0789b53ef86d615cefb5e58e28474811c029dba7a847f8864d0b94
SSDEEP 12288:GXIx521fXLlglkpdHpBcjhdcYxl0xhjOewZuZqLPKqQINL55wemwk/I/:GXITiXLMkpdHrkhdcYLEwZLKPId55o/
TLSH
T18975232DBCDFD016D2A54678844157E0D5123E8E9B80868EBB0BE63BF8797DCCD1A079
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.7MB
SHA256 6587ac0056eb48af7bd80cd05868fd3e8f51302cc8c7558150620366fe522c55
MD5 a6ed44ae4d27d5460db5013664f7832e
SHA1 9fcf34182ede70ceae9d02faf0cf209ff19a9303
SHA512 662a7d60ad4b32599ebeb75a58c308f45b907da8f3b8285c6baccfc3dd843401324aed02f1f8b15fb6c0a5d7b0ec05ecc370aebd8cb97e05ba8458be31c1bee9
SSDEEP 24576:rzy4ITiXLMkpdHrkhdcYLEwZLKPId55o/:rJwmbHqdzgwRKPI75o/
TLSH
T10385121B76A630F9D1768238C8920A51F37278764B608A9F6754437B6E377D08E3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 59a9d871d9c51a35b3b6e75f2ad15d4b36fe499a311e00088ad14b5ff42d00dd
MD5 54a7a5d7d700734b4ca0ccfc4aded641
SHA1 daecc398a8be663a8d8bd2a87df0ef9d541983b5
SHA512 d8a82c15fa7ee915ff5946581ca36b1ca3f58caf08ff9e99cb4b80982c895a940d04ccc335344253e565acaeee720a8e6b838a189d3a29d17d5a0c7f6df1071b
SSDEEP 12288:m7Ix521fXLlglkpdHpBcjhdcYxl0xhjOewZuZqLPKqQINL55wemwk/I/:m7ITiXLMkpdHrkhdcYLEwZLKPId55o/
TLSH
T18475232DFCDFD016D1A54678C44157E0D5123E8E9B80868EBA0BE23BF879BDDC91A079
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 30656b401f0289e902d35025c1b2fd6be50bbbe02943a535983d04f7c81a7add
MD5 908e7373c9504ac5b14c1b616a4e8266
SHA1 ccb60862e502a3aea53fa9adcb7ea61f5e9bd066
SHA512 0e421173e30e8aa3b35a0682dae7d6015ac91bd2a3574f662d596f4f476ba8677ec4cdc06a46373fc5b79d52bb17c008be654e8f08bc086e4acaffda4177995a
SSDEEP 12288:Z7Ix521fXLlglkpdHpBcjhdcYxl0xhjOewZuZqLPKqQINL55wemwk/I/:Z7ITiXLMkpdHrkhdcYLEwZLKPId55o/
TLSH
T17175232DFCDFD056D1A54678C44157E0D5123E8E9B80868EBA0BE23BF879BDCC91A079
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.7MB
SHA256 b66a31b24652cee6d29b00aa42b57b1970fad97763e564807521b7beb015a445
MD5 5570c76d1bbe8bc0595b5552ae8080ec
SHA1 2e5caaa11b485c2a18f993beab4bd787c4e04eee
SHA512 11c4be0e3a262e1ca78710f6b5c9d92163ad63a103269ae6847b5d47a1269591fb19bd4993a4472ab6e77dde10c2d1982e1269507f7e3ac42acd10539dc97e35
SSDEEP 24576:Uzy4ITiXLMkpdHrkhdcYLEwZLKPId55o/:UJwmbHqdzgwRKPI75o/
TLSH
T13085121B76A630F9D1768238C8920A51F37278764B608A9F6754437B6E377D08E3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.8MB
SHA256 9c368d6c3cfd06fb7329f287bddb21d99a6e466ccf9fb543a3288dfd1dfdfa90
MD5 9832810593a79b0e975cb5d5c885c61a
SHA1 1f1b0978a4c8e5443d8d6a8eec1094f74a7c54b4
SHA512 f317196b016a248ecc3e5aabd96f64c6d607262a31b4f398d81189469a2b9ff48b9afff80724091f6875305be40a8ba4e4af144e8d39a8b765e0c178f9440dc6
SSDEEP 24576:ZT+aLl3z0zDyITiXLMkpdHrkhdcYLEwZLKPId55o/:ZTNLljxwmbHqdzgwRKPI75o/
TLSH
T146950268B39058F8DC67823DCC518A52D2B27C5A0760C65F17A4376B5F333A14D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 2.0MB
SHA256 61a4ec56842cc79e7db43ffd13a43cef06276627e3fb1a831967c5b7e10a8034
MD5 9e172e31073354c771f9f4fe81b1b424
SHA1 9e5ace481ba9e5c1252d589539422b9bbedd52db
SHA512 b872f59646a1be93d497e18f45e5d5a22eede1752daa29d249ba29444551c970e244b21d76083e548d73705641207ed15a3d7f1ded86e91f32a6a44ccca109c8
SSDEEP 24576:y3Qd9CHKy7GZmITiXLMkpdHrkhdcYLEwZLKPId55o/:UQd9CHKyawwmbHqdzgwRKPI75o/
TLSH
T14DA5CF90F3E810E8F1B78A35C9764511DA767C9A5B60CE8F13A4661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 ee6be6da6d47f96be70738a77f4fe24a78da2622492eb38ddc2a6367e5beb8a3
MD5 e242659c2ebb3418a7de15fa4e5ecdd9
SHA1 18e1a2bd19d5d8d00b4cd80b9f7397b6238cef2d
SHA512 fcb3b863e15677ccb09f6cdb569fd81b75d88fad228bd526bd85f2532e1759060dc9648b13d69a3187156bcf10a89f8224a9cbf705893fd7971309509e0a82b7
SSDEEP 12288:MiIx521fXLlglkpdHpBcjhdcYxl0xhjOewZuZqLPKqQINL55wemwk/I/:MiITiXLMkpdHrkhdcYLEwZLKPId55o/
TLSH
T19775232DFCDFD016D1954A78C44157E0D5123E8E9B80868EBA0BE23BF879BDDC91A079
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 e5861c49df5ed6a3fd721d9767dacaa5a689061250cb6d979398f215dab17c9b
MD5 3034aca283abe8573a7d4db755fd973e
SHA1 8126ea96a4e2ea909e67032fe03f86df8bbfc8dc
SHA512 e543a3f146135567dd05e627192e26d99bb610bb1fcecc91732941680f85fcac9982148b7c276e8a830f49d9b064b2ad13faff0c1a109e0155887d8544d28fd9
SSDEEP 12288:FYIx521fXLlglkpdHpBcjhdcYxl0xhjOewZuZqLPKqQINL55wemwk/I/:FYITiXLMkpdHrkhdcYLEwZLKPId55o/
TLSH
T15975232DBCDFD066D1A54678848147E0D5123E8D9B80868ABB07E23BF879BDCCD1A079
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 003f981ca20d75348ac07ee3de16594bb7f2f0ccd90347c95e0c8f01d7ca57db
MD5 8fcaf7ea1fb0aa3bdd6ffc1612b1e108
SHA1 79d2282ed068290fb85ab89e84db6e8f86fff15e
SHA512 ff2e8a671af647ec8fb33b5da0716a361d42f2420bc29a55760f1df246b7d9ee76c4679e3deee2237493e0cc10ec96197d867f3ca8a2686800b0ab733e191da6
SSDEEP 12288:nZIx521fXLlglkpdHpBcjhdcYxl0xhjOewZuZqLPKqQINL55wemwk/I/:nZITiXLMkpdHrkhdcYLEwZLKPId55o/
TLSH
T18D75232DBCDFD016D1A54A78C44157E0D5123E8E9B80868EBB07E63BF879BDCC91A079
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 b47326dc2c657822809cd2d860e6ef227836aed28f7a67edd62e617ce517f9ea
MD5 8e7f3a4469183c52fc4330f96e6c3b9b
SHA1 19e33ad1c4c89bc67a8eedd83df2bf4b015292f9
SHA512 dc432c9485998505f3abee3f6770addbcac7fbcbd412b0d8bedb729115960a7bc993aa44a3979fcb2dd36e03e793c5342e43bf44f0b05f5a3c7ee179b7072da6
SSDEEP 12288:/7Ix521fXLlglkpdHpBcjhdcYxl0xhjOewZuZqLPKqQINL55wemwk/I/:/7ITiXLMkpdHrkhdcYLEwZLKPId55o/
TLSH
T1D975232DFCDFD016D1A54678C44157E0D5123E8E9B80868EBA0BE23BF879BDDC91A079
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 c993ba2219a1a255df0bc10137ddda88d9e2560d21d40f90e803042449f36052
MD5 03d6a3f391e8b41d0a49088451a21a65
SHA1 2e72b76508085ef5a101eb5309dde9667aabaa20
SHA512 600c0b236f4df9d33aae58216cc50de7d8213455d10ee2b4a0039cedb9419543b585f41ef7835d67c3de48416428ce1ac2a2034543f57c46db1d08b57289d786
SSDEEP 12288:ViIx521fXLlglkpdHpBcjhdcYxl0xhjOewZuZqLPKqQINL55wemwk/I/:ViITiXLMkpdHrkhdcYLEwZLKPId55o/
TLSH
T12875232DFCDFD056D1954A78C44157E0D5123E8E9B80868EBB0BE23BF8797DCC91A069
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 8d03c70943f5e72eb2621c425a3877107288dea88c2c2ff0773d8cc86bf59fec
MD5 0ab487a7cc9926faa60d5789a432fe2b
SHA1 703da47ab53f97e691726c4bbef7fd8ea5585458
SHA512 9ac0de56fc31f52a23eebed0fba91ebf2690e048b627eedcb65a6449a5993d59bebfb4242a8e857e0d682f8db3bed1f52bb40d7915583e32fcd3f11c88a0df23
SSDEEP 12288:PjIx521fXLlglkpdHpBcjhdcYxl0xhjOewZuZqLPKqQINL55wemwk/I/:PjITiXLMkpdHrkhdcYLEwZLKPId55o/
TLSH
T1C475232DBCDFD056D2A54A78C48157E0C5123E8D9B80868EBB07E23BF8797DDC91A079
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 be47c3be96f5485e1fefc6a88372f9d55975320e9d4bdd3b8fadeb79746d3050
MD5 d53fd00b7c08b495110da371f165eedb
SHA1 30b138577599e2a25a6f7986bc65aa207cad95d5
SHA512 7e70df0e8984f28a30c0e2831491d17137bed39f82d157e06582de300109b8f7f975c09b99ff6473157974fa31dfbe3e9626f3255f1299d3366149e35577f2b2
SSDEEP 12288:ZVIx521fXLlglkpdHpBcjhdcYxl0xhjOewZuZqLPKqQINL55wemwk/I/:ZVITiXLMkpdHrkhdcYLEwZLKPId55o/
TLSH
T19275232DFCDFD016D1A54A78C44157E0D5123E8E9B80868EBA0BE23BF8797DCC91A079
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.0MB
SHA256 3f1e13249c05b5d8354582afedb42a2f44db7d5b79b03b3c3b6bc34479d170ae
MD5 8199c9e2fb077cc00146afb145c29bba
SHA1 7315e7e3be85b30051f3fb2b92b6d21713304e06
SHA512 0f48975d3026d56f7f4aef1cebd1de2168f400cc9d3fe44284995d21a64525d0bcc32d82d1f66c27576db2913d36ef2e412c6e616c7f9bb9bb84cc387e0e39a3
SSDEEP 24576:Ofwv+k9RX6wkyAInITiXLMkpdHrkhdcYLEwZLKPId55o/:IMnYInwmbHqdzgwRKPI75o/
TLSH
T137A5DF2DEBDC44E5E1B7923C89A3460AF6B178591B31C2CF125A536E0E37ED49D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 60adb9d3ff5d994cfc49132a82c755e11f2aa65705cae4bbed8aa4166030183f
MD5 fc5b42d6dbf58b90d3e7cba1c5055520
SHA1 c75fd46a582185fe49c315b8252ddc47ffa34af9
SHA512 d913c4595f66781b0d5288508ab2fe25e12af42021eba066cdfdb17eff77e201fe8aa25c306cece3bfd76eef8ea7a5c0d6c55cff09f358934180257cc787885f
SSDEEP 49152:OYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0uwmbHqdzgwRK5:GySzPm5bKhgwcPI75I
TLSH
T1A8066C56A1A841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 acc7aca52107e404839c5fd4de653daea2aa7194db68093155f3147e674ec684
MD5 64e4dc00517eb21735c03cf740f85b49
SHA1 62ff51d38e4cd7744e1616a507b66dff0feede30
SHA512 8e5448c3da1650a716bee84120c6c1e343a0565cdff99a0fb5cbb20a61f2ca5a56a12092a445c20b07d6b3a00022c892954651d888356e871f0178657e259823
SSDEEP 24576:B47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYcITiXLMkpdHrkhdcYLEwZLKPId55o/:B47JUQjairIhCnDHUPfF/+wmbHqdzgwU
TLSH
T10D65AE1DA3EC01E5E1BA927885154A5AEA71742E5F31CACF2270837D6F23ED48F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.7MB
SHA256 d185342bb5b46958e63b092fcb7f4cb67f41db91f1cd17063e63fc751c488ab4
MD5 3cdb75c67a63e2176ed44058964d37fe
SHA1 71a834b3e405cd66e55359b168003d0bb241c4c4
SHA512 650e76d346b83207d5410d996886dab8dea4ab3139dc2bb36d0fed980f613234af707df40db58e40614ebea8962135b8f5afdc1bf4e041a2ca4ade31d97d2e14
SSDEEP 12288:wbsfrIx521fXLlglkpdHpBcjhdcYxl0xhjOewZuZqLPKqQINL55wemwk/I/:zrITiXLMkpdHrkhdcYLEwZLKPId55o/
TLSH
T1C885F119E29951E9C0AE5278C7424A81F3233C6587E0C3CB67C1F53E2F7A6D48DEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 0bb47452779ce63e7b4ba357ba2183155cee0dd8ec06c49a5a29b78a48eaa39b
MD5 1548f3c8e35272056cf5e0831e812171
SHA1 2d92aaf9a0c0fcebf2caecdc8e325b2ba2fa384c
SHA512 4de03163a715bdde0940f6d5b3fb7dfafacd7d3113218b36bf7c63e496a60f672ebf9f83fa2d681dc74c8c7693f8a5e62c818ba817c7c81c6a3eae765774bee8
SSDEEP 12288:whrisXkU3f72hRW0KOaSKAY7P3XTkRMwsRaK:whrVUUPsXY73XIews1
TLSH
T1793539417626DB5FC6A980325E33C5CCAB707D01EE05AB0372C9873FD576658BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 219b05f056ee9835de4e8d71b32ccd50187a3495ce05c9e307a5f652433fb145
MD5 14e0b3597258bbada1309287adb6b2ce
SHA1 91c475e0a7824a7b2f371a5bcafb92069f7fbecd
SHA512 87b3a4b7e95968475fe7f1dc1454aa6f451119fcf782dc9d7f1349d6629a4853c124ef565f67f0ef77ed6f6dd1d8eb768de25e9da300c6cce5ac98794f5cca48
SSDEEP 12288:0QS3y4mDsFBC4oeOXKANEsgH8+73Kw+Ge:0QSi4T3CKdB6L
TLSH
T1FB650881A136E7CFC1BA6032072A5A4DA774EC53B7046F2673C9457AD87A741B0B93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 d9c11285569de095700e1ecb77c4ba64dbce2dd4dfeed6b27ab79ed72c3a310d
MD5 4493c9ba6e4238be3e570864f08355af
SHA1 1eb08b67741c4d8857f81333a3d1d28a24988307
SHA512 8d5f0667aba1422b3f121e48dfedc2b0d6fc78990e6756a4c178f7eb64dcfa2324760e76b969ed9baf103ef3a993cbbe4e8c6354545be7860901adbd3be6c562
SSDEEP 12288:ZY7TIx521fXLlglkpdHpBcjhdcYxl0xhjOewZuZqLPKqQINL55wemwk/I/:qTITiXLMkpdHrkhdcYLEwZLKPId55o/
TLSH
T13075232DE9DFE016E1B54A788445977095137E998F40C5CBFA06A36FF839BC8CD3602A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1def38f5c7ef64450a2bae13fdc7b8041e99e3d40b7de8a7f3e15ddaf2db9c8f
MD5 b8b0fc4a4a16376a4ee99d4438d8cc25
SHA1 8e4f8fcfd216931d6dfcf80fe73aa064dd5aaa91
SHA512 fa269d839468b8a1d6456c8628b8dfb6690045c3f9d0476e904135f53b6f923838fe7bd2f5a2638b4403b94405e2f32be386616914fb5159f0cdfd8338cd10ac
SSDEEP 24576:Pgb6bmBIi49WNNFpg1rSvFv7bYxITiXLMkpdHrkhdcYLEwZLKPId55o/:Pgb4mBIBhGFcwmbHqdzgwRKPI75o/
TLSH
T1FD659E1E22EC02F5E0FAD2B89DA64417D6B278160731D2DF1251427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.1MB
SHA256 d95b28f820c886bed0f22a2acdd8f50ee98eb280d659f4e97b0fadea496893cb
MD5 fbe25853403fc63084571f518db72904
SHA1 ff393c76db03752db2438f04e433fde9684e8ff9
SHA512 f330f04250045083ec8f29a090dd2b226ad0efb0e64a717b4c93be1aa96d9f4e70c9da0f7f42bb96e5188ad4f88e99a7ad59708afa52281f578a3241e023a2e9
SSDEEP 24576:9G88u8FpJqH1nzria7/mMITiXLMkpdHrkhdcYLEwZLKPId55o/:Q7ZFPqV6a7/5wmbHqdzgwRKPI75o/
TLSH
T1CDA5F12576E501F1D47BD138898246A3F6B2B8250364EBDF07A88B561F23BD54B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 73e226c84e3a4ac19a77807c9d55fbe30cdecdd281096b0dcd244d756563c846
MD5 28864cafe47fe95f9424e03d8fafc49d
SHA1 632d2e81dc1a5d281d61b7328feda909f51272cc
SHA512 59000cdcb8f9085a498081d3329cd00f14702398b42de57aa673507e2579c2ab00b48e13681783d32ef90877b36a3c6717fd8761e7e35e94abee6f73155c7deb
SSDEEP 49152:kBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjgwmbHqdzgwRKPI75I:HG05lO43bP5bKhgwcPI75I
TLSH
T137D5CF6E62EC11F9D1BBC17CD9C64A0BEBB23815032556CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6775e6e8e77bae5aeed5b8faabbd46d2f3de417f83812e03c03d8d8a7b09d0e2
MD5 319f7b25f5faa3d35f2ef6ce48e8a4d6
SHA1 4ee02c045ead61091b28563fa07e4ecf941ef8f3
SHA512 01e4c6d79e66ce396581395eb592d33147edbaf803dc0728dbeb8b3a6242032a2dd90aa77ebcad75d3842483e99b9256400d34305c8f1d8d2a216b8391224c2c
SSDEEP 24576:wfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnuITiXLMkpdHrkhdcYLEwZLKPId5C:Ia5POZ3hJt2pasx2+mYwmbHqdzgwRKPx
TLSH
T1E565AF5EA6FC00D5D5B9D17CC583861AE5B1342653319BCF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 92de828dda98c80ded1d1e2280be2774854dd000070d85748b96c1be6d86273c
MD5 1dd7c1ee9c9da050a706e291b37fad01
SHA1 2a0dec673155ea68800d023ce28f37443ae6182b
SHA512 74b8261bbbddd8d879d637b63f7743a6a17a1f4994ad553d7ac8a59641764008c99952f8dad1c96d57d26f10441ca9878420b81c47b44c0fbd7611500f4a926a
SSDEEP 24576:0NcwHdjbyQ4nLC18lb/EOjowL7FkkITiXLMkpdHrkhdcYLEwZLKPId55o/:0Nc/zEOVHFZwmbHqdzgwRKPI75o/
TLSH
T129858C2623E901E4F1BBE1BE89679646FA717865573086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 bba52d072ccbaf0ea39de26dfef43649594ecdbf7154c3fa3e8a21944ee134eb
MD5 5d620c0cd791894e99d37154b05c3064
SHA1 e69b7827f4f34c21efb00441b1a259572f87a47f
SHA512 5075fc326a4034e7d554ff73eacafc805e9ea2aa0f0eb76d72a9890c50e36e9e135c24622d66546665a34c6897bcd0f73df973a36abcf49c9b016742155c7af5
SSDEEP 24576:H3kNvNnaFeYhJNtmZBmGITiXLMkpdHrkhdcYLEwZLKPId55o/:H3MwBtOmGwmbHqdzgwRKPI75o/
TLSH
T10555AF2EBAF845E4D1FAC6B4CD238512E6727461073293CB5290C13F5E679D89E3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.8MB
SHA256 b5dd988d3b96e537d5e043bb6bd9a171aefd17756da728d18aa177c1555fb843
MD5 c6cedbf964a69820e3cd5a6cc4b43da4
SHA1 4ae4c5f8e64e2aa33314171783249158453addf5
SHA512 fc57d33b55c569b0021f974389af476449680388a101e828cd60f64d9856fc75d086e24b5bf507059efcd6e098157d6d93d42c1dba7c2ba0d6e863f065318492
SSDEEP 24576:+PUr+NQwITiXLMkpdHrkhdcYLEwZLKPId55o/:+JQwwmbHqdzgwRKPI75o/
TLSH
T15085F12F76ED18E5E676A17C85828719E77278620711D2CF0291817F5E37ED8AC3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.9MB
SHA256 8b5dd64e58b3f436bd5fae14e88b12a8112f6120fdd753f665a3394a179e5aa1
MD5 dce159005f3009d1340253041054dad4
SHA1 2055e8807fe141c724dbdb11541566dee26732bb
SHA512 0ccaa50e8716ff667ae54181071c608a69fa1dcd1202c9f94a91e3bb9e95f125bdc6b5f21ccdecc8a44f6042d5c16a326ae60330ce4b44ef65022226056839a4
SSDEEP 24576:dD3FHshBIYQgAfITiXLMkpdHrkhdcYLEwZLKPId55o/:dDVHeBIAAfwmbHqdzgwRKPI75o/
TLSH
T15A95E13DEA9D00E4E57BC1BCC6538A06E77238AD032156CB1694C1BA5F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/264-66-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/264-288-0x0000000140000000-0x00000001401C8000-memory.dmp

Download

memory/264-59-0x0000000140000000-0x00000001401C8000-memory.dmp

Download

memory/264-60-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1128-83-0x0000000000A40000-0x0000000000AA7000-memory.dmp

Download

memory/1128-88-0x0000000000A40000-0x0000000000AA7000-memory.dmp

Download

memory/1128-82-0x0000000000400000-0x000000000058F000-memory.dmp

Download

memory/1128-313-0x0000000000400000-0x000000000058F000-memory.dmp

Download

memory/2860-112-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2860-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2860-106-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2860-317-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2860-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2860-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2872-331-0x000002425C100000-0x000002425C38B000-memory.dmp

Download

memory/3064-316-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/3064-118-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/3064-126-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3064-120-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3292-7-0x0000000002530000-0x0000000002597000-memory.dmp

Download

memory/3292-6-0x0000000002530000-0x0000000002597000-memory.dmp

Download

memory/3292-1-0x0000000002530000-0x0000000002597000-memory.dmp

Download

memory/3292-0-0x0000000000400000-0x0000000000558000-memory.dmp

Download

memory/3292-25-0x0000000000400000-0x0000000000558000-memory.dmp

Download

memory/3448-143-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3448-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3448-137-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3448-131-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3448-140-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4248-93-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4248-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4248-333-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4248-335-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4248-99-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4248-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4424-14-0x0000000000E90000-0x0000000000EF0000-memory.dmp

Download

memory/4424-104-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4424-21-0x0000000000E90000-0x0000000000EF0000-memory.dmp

Download

memory/4424-20-0x0000000000E90000-0x0000000000EF0000-memory.dmp

Download

memory/4424-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5076-55-0x0000000140000000-0x00000001401CD000-memory.dmp

Download

memory/5076-42-0x0000000140000000-0x00000001401CD000-memory.dmp

Download

memory/5076-56-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/5076-51-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/5076-43-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/5084-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5084-30-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5084-31-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5084-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5084-117-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5180-70-0x0000000140000000-0x00000001401C3000-memory.dmp

Download

memory/5180-78-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/5180-72-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/5180-311-0x0000000140000000-0x00000001401C3000-memory.dmp

Download

memory/5680-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5680-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5680-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5680-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download