38f420116c42546d8a122a02cc141b9e87957690f8088962caa43501cf115bc9

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 07:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
Size 2.1MB
Sample260707-h41y4act2w
SHA256 38f420116c42546d8a122a02cc141b9e87957690f8088962caa43501cf115bc9
MD5 a7e84bf28d43853ac8ad8d16e7d4cbb4
SHA1 b885be9ebdfdf1a929b6be5454df11924e71ec47
SHA512 c89733479f5523135b127bcdb1085d6f28eaae3f0952870aa9f5c68dcc778b8e175b42f953bfa7051675b25393cda9580a17312cc8ce7823f3c8f67cda47600b
SSDEEP 49152:XbjPwITVMc5omSIzDC7W0/by+A5seTaInFUYe1:Xb7n5FV+A5seThNe1
TLSH
T186A5D0213946C031CAA121F1897CEBA9559DAF300F3645DB63D82F3E5E709D36E39A27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3612	elevation_service.exe
3660	elevation_service.exe
3184	maintenanceservice.exe
3644	OSE.EXE
2672	PerceptionSimulationService.exe
1284	perfhost.exe
5660	ReFsDedupSvc.exe
3432	SensorDataService.exe
2784	ssh-agent.exe
4636	AgentService.exe
2268	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6750c384ce3e03f1.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\TraceExit.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118546\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001fc340d1e00ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000419686d1e00ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000121c6f15e10ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005bc9b4d1e00ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4072	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
4072	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
4072	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
4072	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
4072	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
4072	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
4072	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
4072	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
4072	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
4072	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
4072	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
4072	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
4072	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
4072	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
4072	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
4072	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
4072	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
4072	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
4072	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
4072	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
4072	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
4072	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
4072	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
4072	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
4072	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
4072	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
4072	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
4072	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
3612	elevation_service.exe
3612	elevation_service.exe
3612	elevation_service.exe
3612	elevation_service.exe
3612	elevation_service.exe
3612	elevation_service.exe
3612	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4072	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
Token: SeAssignPrimaryTokenPrivilege	4636	AgentService.exe
Token: SeBackupPrivilege	5660	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5660	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5660	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5660	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5660	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5660	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5660	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5660	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5660	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5660	ReFsDedupSvc.exe
Token: 33	2268	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2268	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2268	SearchIndexer.exe
Token: SeDebugPrivilege	4072	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
Token: SeDebugPrivilege	4072	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
Token: SeDebugPrivilege	4072	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
Token: SeDebugPrivilege	4072	2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
Token: SeDebugPrivilege	3612	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 1080	2268	SearchIndexer.exe	98
PID 2268 wrote to memory of 5832	2268	SearchIndexer.exe	99
PID 2268 wrote to memory of 2880	2268	SearchIndexer.exe	100
PID 2268 wrote to memory of 1856	2268	SearchIndexer.exe	101
PID 2268 wrote to memory of 6112	2268	SearchIndexer.exe	102
PID 2268 wrote to memory of 4244	2268	SearchIndexer.exe	103
PID 2268 wrote to memory of 464	2268	SearchIndexer.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-07_a7e84bf28d43853ac8ad8d16e7d4cbb4_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4072

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3612

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3660

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3184

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3644

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2672

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1284

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5660

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3432

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2784

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4636

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1080
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-515251955-468707340-1782030364-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-515251955-468707340-1782030364-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5832
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 1872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2880
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2920 2856 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1856
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6112
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 1872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4244
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2920 2856 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 bd7a80b2fc5401ae407738733bbe664eb402e94f391780aa685c705b867103ef
MD5 41e3f0754bdf2b5e8745ae615850faf3
SHA1 48f8bbfbc04673f7ab4beda36f8fb33b7441d2ed
SHA512 d84eb4541cedb5bb05a9470485b5305ac190aa11dce6ad6be0af5c3f06a4848ab9e6ba0838da04ceb902db58f9a9cfd8302919de83ac352d99585507290b4652
SSDEEP 49152:3b+632BuPkFKRrdE6ohrstBhuXjfS4LWxnly+A5seTaInFUYe1:l3q60jB9+A5seThNe1
TLSH
T172D58C03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 eead3f33f3d839ba60e2a54d59f30440685a872baab12abaa686e397b1dc8b6e
MD5 ba6c65c99680e59f35dc0e95ae6dc943
SHA1 c78780dcbcef4eb904ab442829b200d3e4357944
SHA512 d4e9c675ee94cc507c3d76643505b976060291a2ca954e7090cb9611db96891f1aec921ad0a865fa901fdd67ce53d33b2260634ef2a9c28b5e6ff1be172266a5
SSDEEP 24576:NXYfDtczAWy+WT5supBrUMeqr4RWnFUQRKVJdp1ZN:Ytczy+A5seTaInFUYe1
TLSH
T1B465022877E409F9ED67827DCCA18512EA7378954360E79B03E49A260F333D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 5a61e28ade9cb6fe6f4b2e91e1df8fa76c04c6f0807f5ac75bfa76c21fa496a8
MD5 a776c3a219f61aa4648b7afb5a39ec34
SHA1 7fc698972bb27b4facdf0abf2469a69dc7e6d68b
SHA512 d9844e7cbee7e91e8dd5d6b07368ad1d92ba6cf5a19a3698bfef1fb4ca4cf77fffce0a6e430d62b2c08c7f35b846afd156bfbbcd910ecda14d3451b9b889a18d
SSDEEP 24576:40Le5ji0hmxNrM9y+WT5supBrUMeqr4RWnFUQRKVJdp1ZN:4Pji0A7Qy+A5seTaInFUYe1
TLSH
T1F4859E16F6788335D073C0B9C5D2A69EED72308617308ACB4286D77C6E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9bdb94370c14ec045c4d3b6481fae525c16ba0050ec825f9dc2b6e75617ad956
MD5 258d22fa18fe8a1926d408a79cc394f7
SHA1 2e8d09a3dde695596f14d51aa7f59df696453508
SHA512 eb41b1e49efbabb0c99064d3042ed1ccf524b3f4ad643dc18c69224b06f81044510f9757c016466ab95b4ec8c2d436927384c71631af80841024873dff77a440
SSDEEP 24576:ua7/ezSC6vUyD/aqgrvWr6q8wyujy+WT5supBrUMeqr4RWnFUQRKVJdp1ZN:p/ezSC6vUzPviHjyMy+A5seTaInFUYe1
TLSH
T163756D15F5788323D0B2D0BAC5D6BA9AFE723086573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b22c129e1e6f4f2d4d301d067f1a08c3f2256beba3f8a038d038dabbe29e335f
MD5 ed8f83c2fd8dcf05efa42546beffeed3
SHA1 6910ef352a7d266e90b0f843937d6fcaf13bc96b
SHA512 efd89788375890205a49b0eb724ad9df84e08ae8b3cef830a6f967ca26d3dd90aa68750da4a043fd9dd6c0a730dc842cab006dbc6ddb8983499457cda104fe27
SSDEEP 24576:IVbqPb88hv/l+bKy+WT5supBrUMeqr4RWnFUQRKVJdp1ZN:IVO88hXl++y+A5seTaInFUYe1
TLSH
T152559F66F5748331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 485f23a6e1f35b58ff6177a3bd7f9e4673d45dbd56a3329594bfce8d36de6903
MD5 7375f473ca7f93ffaa98a76efda73527
SHA1 2216349cd3c8f81636eece1bf61891aee45d428b
SHA512 11377f1cb41faab7d72ad3ceb7ddba60a145c73978c0b4d774c07751d92202217cec2428326b49798ee6886ff3bdd73ead4771dd3030b3a45d728c45d8f57f77
SSDEEP 24576:+jxy+WT5supBrUMeqr4RWnFUQRKVJdp1ZN:Wy+A5seTaInFUYe1
TLSH
T1534523426BAC76E6DF4F53B2C8D8681A68FF9FC52615A72103D23B4B4DF42EE851D048
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 0e5559f00393766bc5ebde5b32d43bbb1be535a03c7c8658733720190ad51ea3
MD5 37477839dfcf83635b077347d890da3e
SHA1 ec0d8f4ddf6241c87feed463353e351826019ae6
SHA512 d50300414dd2a23736de8d483ef5dea7a205835cc31f89cf73716d0bccc9e93ef595c45eb917fa5a4388ae8d98dae9e2f3598a15f9b00e13fb92746b14d116bf
SSDEEP 24576:tJIUiy+WT5supBrUMeqr4RWnFUQRKVJdp1ZN:tJIUiy+A5seTaInFUYe1
TLSH
T1BC65D03BEE28FCD2C67E8DB95A918600E77278704B21A3CBD165830ECE235E55E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 857786cf0d9ec996931c3d4ebe144ff36103347dda167e03d2bd5466921530d2
MD5 aa5aea88eacd6c64bdf599837a66d5e4
SHA1 268cf6246602f4d2ce2edd399900f026ef75a830
SHA512 9595267ff0003ed56338ebf5a39decb4117e9716b5325e508dfc675043939536ba0c58c89ac07968d58369365acf65355ead88318b61fa86723279ce93a86e3a
SSDEEP 49152:JQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THk:JQvGAdlCEL8c/RRNw5Ce+A5seThNe1
TLSH
T133267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 6c24aad4cea8f725f56134a54495809910d9192b009e3782cec80a8516cf94b0
MD5 9dd93a1567f53395ee33fb046e76b9d8
SHA1 4df437523b7869b13b0df653d21f52eb7f521d99
SHA512 729b906dd22b395daccd0c2bf2144f8537f9a79c6f8a273a325d517cce098051264258e5ba540a0e89db81f747c6f47fe799ab0cac4cefad8f7a804e3fd965a3
SSDEEP 24576:SSewsAjAy+WT5supBrUMeqr4RWnFUQRKVJdp1ZN:tljAy+A5seTaInFUYe1
TLSH
T15475E031FE74E436C77F0DB21B25C716187DBA604B611AC3E3E85E8E59702D2233AA16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 beafb228b9fbfb0a1d5a51ab8239bf4208d8fc4a63addb3aa8257311cefec2cd
MD5 40a366aa8588c7e5259d76b8f768289a
SHA1 b29d7cfe8a66df6db565549714cbcb1389a388f6
SHA512 d859fd59f54c56af44aa855816976cbe6ca27e47afa801bde5bbb7f7c63c008c1de9983151c0d3ae2980329060d6308192993c69ac7f5703da50bab0c6e11c0c
SSDEEP 196608:VUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHT5sIhN:VUEtQevvqc2W1cpV2RI32lsQ
TLSH
T181474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9dc1b58ac7e2a5c26a1dcbb29b6df1e9b2ac04916091b6c5f4ad0da27ad3822a
MD5 7477b3faa0c318c284d18ab9b04c6132
SHA1 9cc0f7dfa13589066fdf0ac0c7f0f7221f411260
SHA512 c45fb245fe1268c46c1bd9ea1338fcd82e7bed81df6aebe8f1a170a9ed4b3758908002fb003ec94c4e7a691049ccd7e612687909ed3191ab9420ac215b75f721
SSDEEP 49152:iCbRquA/m2yL5zTfFiV+XenmE3/zgy+A5seTaInFUYe1:noquVjnmq+A5seThNe1
TLSH
T178D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5951cb52a6d8c417dd3691fa7d54a1fe73de441a1abc4a30651647ca0990538a
MD5 47354eef2065622e15e4f90a330406b2
SHA1 93fa4d42a4d567fc88010f00d82b7295636d440a
SHA512 91eba60b8817a88abfe0dfdbccf3736185f40abb590b12e02872ca6f7648ff6b916abe07e3bb544acd3eae574c7fa18c13ded64c5c6129624e213c99cf8b4a1f
SSDEEP 24576:jAhGL2IFoiwtA5l7S53fy+WT5supBrUMeqr4RWnFUQRKVJdp1ZN:jAM1Foiq5vy+A5seTaInFUYe1
TLSH
T1BA35AE81E7F955D4F5B3AAB899B68171EA76BCA65E31C20F2150D10F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 f4dec398890c7f0f99e731761d770ddbbcea56d30ff483180d911468fb9dacb7
MD5 5a54d8aec0ef062816d30b9b043286fd
SHA1 9c24f9137fdd936d10258503e015d42a6507ff0f
SHA512 b13ebc29543e193b861025d485380314eaf6883fb9895701ee49ffd08a0e7cd8020d1a6aa9a602f2761584ed947e818251906398894183cbd2f5d76f0c3eb8c0
SSDEEP 24576:8wuXOWsy+WT5supBrUMeqr4RWnFUQRKVJdp1ZN:8wsOby+A5seTaInFUYe1
TLSH
T12465F04677A81CF9EA678239C5978536F7F2B8422A21D71F03A0C65B5F33361AD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 67182502ad8c129bb97a5af29d69826a92d08bfa618130a4a7898cb829ac5566
MD5 4591cc0447fa372632097fbbbc36c0a8
SHA1 9b81575d99de025082cfdd0123747fd82ca2501f
SHA512 bc842a05d81f38bd7cf4133b8e3dba99e0699b544c7591e5bb17ab477fadce9e0925ef5926a04fa7f0092fc23b06e1a6ff855fc91c588222c4047483fd2ecfc7
SSDEEP 24576:SZuVy+WT5supBrUMeqr4RWnFUQRKVJdp1ZN:Vy+A5seTaInFUYe1
TLSH
T14F55124637E831FAEA975279C8E45606E7B27892233293CF0361175A1F736DA1D3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 cd6ff81775ce9c298125a2201c2a369abe3a4eba9cfa6f1c9af6435f93c4807d
MD5 ed8b82d7a9ae184fdc0b6417568b0a0e
SHA1 3690edbc093f9dce95fb187f3b08a408f42d0a79
SHA512 baa08d65aecc11490863642799e3823068e2c4fae4c724f9f6203313ff9e4a2b38b8db18706c0e316e2baea62423a97859fbece4f29b7f153ff7d40934e4064c
SSDEEP 98304:XQRQyi36YOcPhLvw2gAf+PN3x+A5seThNe1:GQyiKahX+PN95sIhN
TLSH
T171667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 de27bbb0b50a93d979a3a66b7923c4a5a3836b66081a31067a861ced7aa87795
MD5 e89543e8eab3d324969859e0918106e4
SHA1 8c5533cc34880ed3ee7847436f9afa356654e679
SHA512 6195070c808ef170d4f99e111e78d0450c70357060aa93e0fe178fea9e47872379de1311971682d3ab1df5d2af221cef0ac9732e6e593c3444bc7ac35d6e55f0
SSDEEP 98304:+QRQyi36YOcPhLvw2gAf+PN3x+A5seThNe1:lQyiKahX+PN95sIhN
TLSH
T193667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a59bcf435fbb0f54d2fb4cd89bd59dae39ff5dd6ded1de3d816e86c03d243587
MD5 cb8c27f329041caf4278ebd37c7e667e
SHA1 53743c403de76989093a086d27ab35ffc4eac98e
SHA512 ba178a0cb8292076742447a4f9269ce3b91ddaaffd5e5ba8aa4f31e9dee42e871d3eb04b324ef18f2a6762c7aa94989df0c55445d1e9c622f906751b5c5ef5aa
SSDEEP 49152:J68Qg55nhceWu7PNU3/Qy+A5seTaInFUYe1:XthLRc/D+A5seThNe1
TLSH
T1ABB54933B2F600A9C44DE1769F4A872196D27C758FE1E3DB815172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 73f74c8a508c0121950957d61b623f9b4e7e78dc67365a83ab11da35c3fc7311
MD5 2b518bd7a0cd9dc1c8f30dc691733235
SHA1 fd0d3850c7b95fdc3c50b7c322a057236f1fe202
SHA512 c1057d13a9c97375bd8db8c58c26e6bf8a9a54ec278fdc00f5467721a3c01d8341874833529d33c3ab8ae61047d0a7201c75c45b52414eb7ab172fce4df6e909
SSDEEP 98304:yy5112gYy5azzVva69nLKnhZM+A5seThNe1:7LIHjWhE5sIhN
TLSH
T171167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 afe21f96f891f2a6ddffde977fe6181db05253752323f988dde4f19ffe0dd54a
MD5 a9108b6b25f290aaf909eb8dd8f33450
SHA1 6a5fc1119b368597ec017b134898e003f6575091
SHA512 ea8b8856d4214764be15a2ac10121535b2b5e04e581099d276a1e05dd9766a37f81f983544e7368854eb59087fff657f365335edeed0dd48843eb037370c46e0
SSDEEP 49152:JB+taZ3usBWOBr4tEG20bqx0z+n217aau1glmy+A5seTaInFUYe1:fu6JmUxd2dJ+A5seThNe1
TLSH
T12BD59D13F1DA01E8D05ED178974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 903d6aea90dbe21fede4db67a5030b2736955f1c9c224561ef70994b5e8ab2cb
MD5 d98e211ea762d6b053c833709e549311
SHA1 ee3681d368e6c779b3d8cea1454b1ecbff21003d
SHA512 902b138d04b47181ba32e84fe82cd6d2695d7ab64ef908f5fd40c90153b2d1bcbfa4720a4ae7dee739a52756b504c2e2c234bf9d2f216fece4ee3297efe0f0e6
SSDEEP 49152:31hpsNoJpF1A6BU44CwH7R4xCy+A5seTaInFUYe1:3mifPkRq+A5seThNe1
TLSH
T1B9B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a3c3b7b826d5021fe39f286bd187e9763f8f0f88180aaf01b3c6bce20b0321c1
MD5 c29109d2bfd48e1f4690f932ee5261c9
SHA1 b8c6a22ac55b76bcda0bfab7b097f79a74fbd4a1
SHA512 94d206f219123322d087a194a1e43cc36e6fddaab55087e3d1b1f9792a71705ba13a34b071dc095f18364a3f600cc300ba586ff6db23a560043e3a4936535d5b
SSDEEP 49152:zSuZQIY0Be2KNRVtOnks6NMHqVy+A5seTaInFUYe1:x5dKvi61g+A5seThNe1
TLSH
T1CFC5BE03F2E941E8E0BED6748B659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 646c1e1c3778676fca7e1993e84dab3e522cec89bcdffc7b928659efa419d624
MD5 1b7f802f1b9d9cdb57f892ebe265659b
SHA1 463ab199e11d64f8ddc09135ba640901bb633def
SHA512 655bb653ea717c052f0c036252cf6d234cdc4b141f4f5f934dbcac83d970102d712bed9bcedc35699ad74494a989ad549ccff1220fdf73126dd08e14eb825b8b
SSDEEP 49152:ZhtSn8EApI0figXgiDn0AP5wWy+A5seTaInFUYe1:oX2iyphG+A5seThNe1
TLSH
T16295BE13F2D901E8D05ED178C7468632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 fbc70f3376e3a8102ff67c30ee04a3c7d345da742fc1724cd2a5f18c40563575
MD5 fba41acd2a1785520cc7e66d47e989e5
SHA1 7195154971ddb56e5e197a2f38fb0fd881ba27ee
SHA512 f4f420530a9f859b305d9bb56bec98ef3db05eab7056e1b438760ae880dd9950c04981140f014b50f8a27abaa125f6b39b5c21b7f3470c3561dd779152110dee
SSDEEP 24576:1py+WT5supBrUMeqr4RWnFUQRKVJdp1ZN:Py+A5seTaInFUYe1
TLSH
T1464523026BED6BEADF0B93B2C8D4551AA8EE6FC73316632513D636064EF12EE150D04C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 f6807b08e4c98cc8d8203927d476ba5dd65b57082fa8ce44577001520cf7f000
MD5 f727f25b94ec6c08cbfb01e130ef4527
SHA1 beeec46f5aab02c96ffa144d37984b8f95eac929
SHA512 54750c46a3fd6b866edc544175fbce8b49730c0ea114f1d5f7c025fcd414319f324bf5800873a12b579315da78a2051255c2041ebd1d8d8fe5c425879410c147
SSDEEP 24576:s0y+WT5supBrUMeqr4RWnFUQRKVJdp1ZN:py+A5seTaInFUYe1
TLSH
T1F44523026AED6BDADF0F92B2C8C4555AA8EE6FC73316636513D636064EF13EE150D04C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 cb52a1e27181cafc47ad3147430da33b14c1f04deb45815fa9bef212dc2b0f5d
MD5 55d088805621811fbc113d7448ba39ce
SHA1 172fc3a8702d00fe434ed3b112dea72b247fc9b2
SHA512 ed3f646e062b7ffa333c4e4f2efd3f3e73cf15e30455039ca236c6493277c03584482319b0306449fb6ae1aa4079f6b0cb850636cdb8a407df588461182cbee6
SSDEEP 24576:Uay+WT5supBrUMeqr4RWnFUQRKVJdp1ZN:Hy+A5seTaInFUYe1
TLSH
T18C4523026BAD6BDBDF0F52B2C8C4555AA8EE6FC73316632613D636064EF12EE051D08C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 e969f0672ec1f24c5b51b19e51a5feb091001b1e2cfd206a3ac93360fb7c0215
MD5 a3adb158e10ea0390151dcb0e52f5d2b
SHA1 164ec83cf3a16e32f28c9e0b0bc8369f44f690a1
SHA512 9b2c4298e4d00a38469f0584cd88bb23b17e4ffa3191278afad264b4dda60e3a7769d818cf3eb983b0f7a274e6a5b0be6fa86146e11ee4bd15055b8e0879f9d9
SSDEEP 24576:Gy+WT5supBrUMeqr4RWnFUQRKVJdp1ZN:Gy+A5seTaInFUYe1
TLSH
T16A4523023BAD56D6DE1BD3B5C8945516F5FABEC67332A36F03812A0A0EF13ED192C644
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 1bfa2448582aa641197e9811776444ad4146847d3aebadc51a4d67f9226a7c6b
MD5 c3e562e1d955f5247c7c7ac426a15d41
SHA1 61283dbc27f5661da7838b3d58ba5dd3fbe4dcc3
SHA512 dcaef6d7e467ff7949547a8dcdefbb0f8f8aacce40ef45f808f202820fe6bbea81c160abff3acbde549b6dfc583290aa775abb5fea986d6da7262b77932d8273
SSDEEP 24576:qny+WT5supBrUMeqr4RWnFUQRKVJdp1ZN:6y+A5seTaInFUYe1
TLSH
T1034523026BED6BDADF0F52B2C8C4555AA8EE6FC73316636613D636064EF13EE051D088
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 03b9eb5756a32601cda54fed56cc31aeea2637c5737c8d94d53c6938507c991f
MD5 eb4dc08dd25b2028689020d1b548d164
SHA1 cfa2cc6ac1503e14b3f4855286e33826770012e1
SHA512 e3e947aadad311747c56a471b62361908902278af73cf7fd610f4c6472e5aca42d13c5dc95993769f70f849c6ea033011f91adf2688404210266b85c26b5d8eb
SSDEEP 24576:p4y+WT5supBrUMeqr4RWnFUQRKVJdp1ZN:Oy+A5seTaInFUYe1
TLSH
T1214523026BED6BEADF0F92B2C8D4555AA8EE6FC73316632513D636064EF12EE150D04C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 fcee4ef7fda0159d1a78c8a0c4e952c8fa5a8d9a1e17f8328b47b2f4108ca00e
MD5 47d4308f3069f07498b2ef234c506437
SHA1 ce5aa47af2c2e9c1975910da2889287c982ef608
SHA512 0b6d464781b86e982f5b2c9b8347f90c94a5e1698f93db84451c5350c3a2a425d72015eceef208cf12cccdefeb4e963da10ddcfb05a723a0b8b7dcfb3133e6ef
SSDEEP 24576:I8y+WT5supBrUMeqr4RWnFUQRKVJdp1ZN:Vy+A5seTaInFUYe1
TLSH
T12E4523026BAD6BDADF0F92B2C8C4555AA8EE6FC77315A32613D636064EF12FE150D04C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 b0d27e5e655c292a0a704b349bfc5f2933f4445231f00de1eed9f2563b6fe8d6
MD5 10b499400298c26b3c48175c36d4e296
SHA1 44b7f44b83be5250b0987e113bd84db03dc13ca6
SHA512 df05e0ce97e07d1ea783e71f0a6847d5f9263734fb83b2ebef9705cf1c5c7f3c12806eaf23637a4b99695f79e05cb5e34f28e91d819194ce3e0113067a3cb854
SSDEEP 24576:wZMMzFVSOUy+WT5supBrUMeqr4RWnFUQRKVJdp1ZN:wZMMzfoy+A5seTaInFUYe1
TLSH
T1C8650195B3A418F8ED67823ECC558906D6B27C9A1770C61F03E4362B5F733A11C2EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 06c58944d936f8a82b65d04f8350ab4e85ed66dda66dec81551af56def6c2eb0
MD5 fbacecc0b39776528a2f359dc3f30c82
SHA1 196e89673ed4f4d71e58b3542abb7a96604e6ba4
SHA512 a72c6a5ae983eb15a7e6c21796eba5cb98d7b8bb0d805224cdbb8474ced94245b2cb1f80dd3fdbe13087b3f0c5bbf2b775ff0fe0b020bee9f08e02b4da47f1b4
SSDEEP 24576:SFy+WT5supBrUMeqr4RWnFUQRKVJdp1ZN:8y+A5seTaInFUYe1
TLSH
T17C4523026BAD6BDADF0F53B2C8C4555AA8EE6FC73316A36513D63A064EF12EE150D04C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 2c5bfb295deddab1a83dae0bd2001a9c5afe5cd37d558c84e3474be200a138ef
MD5 0ca188b49a3a789d66e219a4abb7cfae
SHA1 69adaa07ff6313cc00dad641bd6afb0963b04e27
SHA512 39d12eda1a674db00ffbe3b5c009a402d1022084db98c8094fa8292e4edc7e0309d381df42c0a0292236a1c747ec551250ad14cec413866c53da735ba6be3049
SSDEEP 24576:ehy+WT5supBrUMeqr4RWnFUQRKVJdp1ZN:gy+A5seTaInFUYe1
TLSH
T1B54523026BED6BDADF0F52B2C8C4555AA8EEAFC73316636513D63A064EF12EE150D04C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 aa94033187b30bad885e7968ee4869086899c7948c8cdcdc5da02ba1ebc22d4d
MD5 b30ec371e3eab8f3ad9c04c0616122eb
SHA1 3f3a9619fcf689721def6606c31578f63dc43791
SHA512 f526ead94420ecf1f738ef1d3564d17fce267ddf7066536f267391dae2f88611a2017ff3c2e9bca403a5fe9dc7c19ce07fa755adc8ff7c06bbea7c04abd9d9c7
SSDEEP 24576:qzywy+WT5supBrUMeqr4RWnFUQRKVJdp1ZN:q7y+A5seTaInFUYe1
TLSH
T18D55020777A531F9D62B8235C8911A06F7B6B8B217209BAF13A007761F732E55E3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 637d76d1fa55b0b68f8fcfde4ed9bb1904c999c8f38b819d9c64989f2a44d072
MD5 af3c749e39aa5a0f31b2657d0ae9c81b
SHA1 7ca9ec419880cb082ec39c12532368e2c027d0b5
SHA512 cc3b53a4769dbcfa6a2c5d4c74bd4f83b9e4d380d6c43c459182d2de78aeb0f65771173c368d03d44ee61d3e22fd99845ea7b5b4992e598b1e3f941c16ed0de3
SSDEEP 24576:2Fy+WT5supBrUMeqr4RWnFUQRKVJdp1ZN:Yy+A5seTaInFUYe1
TLSH
T18E4523026BED6BDADF0F52B2C8C4555AA8EEAFC73316A36513D636064EF12EE051D04C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 928ce72630fc2b29ec50b7dbe0e201e2b785bd160dbdf16a25ad8144ec34a276
MD5 71095c8b39913be97ba85c0b32daad7f
SHA1 a3aa118aa04e74c33b3dc4b44eed075e1604f613
SHA512 15bb0dc71c54631e47775fcc91e8fcfdfdb2a0d851d647c079376522ee9fca720590de37fa0d53246117917b4bf2d1fd46329b4c3bfdf45e31a778906230b13e
SSDEEP 24576:4Fy+WT5supBrUMeqr4RWnFUQRKVJdp1ZN:Oy+A5seTaInFUYe1
TLSH
T13D4523026BAD6BDADF0F52B2C8C4555AA8EE6FC73316A36513D636064EF12EE051D04C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 bca8b19ef3b378ff47a4bef8e25d64159803349949d448375d303c81193c2382
MD5 2190206cc2483962c181b17ac8f179c9
SHA1 2870261edf096c43ddaee3861cf4013e76a98354
SHA512 36f5860d7b0338331b41091b501a0490540ec9b40356a57e182e85da70d0f9d6f8f72fa3c0dd2f5f16645a7eb1e9ffd2073e24bdb5f3ab036969507c43b9c036
SSDEEP 24576:ozywy+WT5supBrUMeqr4RWnFUQRKVJdp1ZN:o7y+A5seTaInFUYe1
TLSH
T1B455020777A531F9D62B8235C8911A06F7B6B8B217209BAF13A007761F732E55E3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 f5b478093f8a7a58e9a8c18d93f4d7b090dabf41da86d9ee1790c621f5b0fa35
MD5 e4cc486edde1c7b0cf3b724f05b360bc
SHA1 2b6aa63707fbb0593a52c0da9b1d417803986282
SHA512 155c1926bf7bbbeecefb36cb1b0a8820f7b38959248cb5fd7ee185a2602193febef934a6cc027f9a2379cbeadd1c29a46186f0b6476f6058bc3c88dc7bdd13dc
SSDEEP 24576:+T9aLl3z0zDqy+WT5supBrUMeqr4RWnFUQRKVJdp1ZN:+TQLljjy+A5seTaInFUYe1
TLSH
T197650195B3A418F8ED67823ECC558906D6B27C9A0770C61F03E4366B5F733A11C2EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 6d00c1ce0c332d08c402f5b9d4a67601b60301bec5a0f9574d79d4e3e20ee26b
MD5 cbc4029788d4a321b0d2ef64bf992077
SHA1 c6f129a2d4e2630f49d0ed3487bcab67d5172b55
SHA512 1d973037939d3f41f4543ce404529a145033d283b8440ca88d7145faffd7684646589bc279d4724e95af42bc9d59fa6688cf2267545581e27d99c4bc748739b5
SSDEEP 24576:s3td9CHKy7GZOy+WT5supBrUMeqr4RWnFUQRKVJdp1ZN:Wtd9CHKyaoy+A5seTaInFUYe1
TLSH
T18A75CF90F3E814E8F1B79A35C9754512DAB67C9A1B31DA8F03A4261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 0565ab97bc05ae0ec305a8a01ecf3ee66db08a2b22709c396d884fb1fb2ce778
MD5 69e701a5b03c76d2c634147f9b19dfd5
SHA1 0c19a03ddd11360caa6f3c400512bae6aa7f3966
SHA512 a02e70aee181cc123722be4999e36fb156dd3ca6f8c7faf336cd9988a6b35518cd871719ebf966ad87cab4efa60e860612b1c4b2c949fd86262de039c6a2687b
SSDEEP 24576:Y6y+WT5supBrUMeqr4RWnFUQRKVJdp1ZN:7y+A5seTaInFUYe1
TLSH
T1F14523026BAD6BDADF0F53B2C8C4555AA8EE6FC73315A32613D636064EF12EE151D08C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 e128a900496e7956ecb82e85a1b067ad795edc5cde8f606dbdf179c138280f9e
MD5 461e76f874ce7632e6ef5ee49d74d382
SHA1 7bc67d0510cbd3b58e5f3fa2a553290ccee4d359
SHA512 a76ff964575d7594499a027e0af4f49345d12ae1e1f593d8d1c43c6cb4fd9440d6461c7b6a060e894e3ee1b9007ff74939d1bff8b5fbb60cd3d107699a5bda7c
SSDEEP 24576:oQy+WT5supBrUMeqr4RWnFUQRKVJdp1ZN:By+A5seTaInFUYe1
TLSH
T1474523016BED6BEBDF0F52F2C8D8551A68EE6FC77216A32513D63A060EF12EE051D048
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 fceda3097992b522df9886eeb7a3233e0d130819b4c12a2bcae035063b503b18
MD5 0a5c2dc74c2e6af576e696aa21b85bf7
SHA1 f691ab3f45314f1e7a10e14bcc85a2d8415264e2
SHA512 fbfd5f5b6a04061f537c5051c955682f4637abc472c8436da98f6b4e84341bc364999c918a14036b26fb3bfe6118d0d783cbe0b9662e318b6952ddea7ef640b0
SSDEEP 24576:2ry+WT5supBrUMeqr4RWnFUQRKVJdp1ZN:Sy+A5seTaInFUYe1
TLSH
T1BC4523026BAD6BDADF0F52B2C8C4555AA8EE6FC73316A32613D636064EF12EE151D04C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 02cd3eb927b8892dbaafbd6c451d96733de9e04454c27b979be71ef2d9a8e20d
MD5 94efbb095273958ada70dcc24fd1e166
SHA1 aa415b7327ad4e11c936b4ee01b39ccdecb12ca4
SHA512 d655f2daf0371098a063667b2286a4adaae06a27565ad9f0efb1328fa8b28d9eea092b2204e1b2fa8c759dd070394dec420baeef1cb4c5193d6514f464dc1972
SSDEEP 24576:2Fy+WT5supBrUMeqr4RWnFUQRKVJdp1ZN:Yy+A5seTaInFUYe1
TLSH
T1EA4523026BAD6BDADF0F53B2C8C4555AA8EE6FC73316A36613D636064EF12EE051D04C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 9a38ef0ac4c166d4d3aac6e5259f2060b210efd906f58a0ffaf1c83e46d0eb76
MD5 f978e7d0e35a1da9163cf3ae1ac87f64
SHA1 68b10d843de1d789d2a03527da72f172d5a4e872
SHA512 ee6ebc1c7ff6b96532f0474b97a4e6a94e0c695d708bdfdc1510a434a8f779bd3fd3de20e7f4d903a4c094fa019d38d246761cc0e52c6e99c43afc8d22afefb3
SSDEEP 24576:c6y+WT5supBrUMeqr4RWnFUQRKVJdp1ZN:vy+A5seTaInFUYe1
TLSH
T10A4523026BAD6BDBDF0F52B2C8C4555AA8EE6FC73316632613D636064EF12EE151D08C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 c90017d65c12bf459a17da79e1f259ef472d0ffa3863c4be4ca44ee33433090c
MD5 fc0704afc1c6384ffb2237fc11446a81
SHA1 3586998ed698db8446b892f8d599857855e49763
SHA512 d619c03313250f5c9a95ea3a6def112af7e03407034790508987c2b1ab0a218bf886a8ef94089e37b172a8dad93b87930a8b5bd6f8bb4d57a4033a3f5c587228
SSDEEP 24576:wNy+WT5supBrUMeqr4RWnFUQRKVJdp1ZN:ey+A5seTaInFUYe1
TLSH
T1424523026BAD6BDADF0F92F2C8C4551AA8EE6FC77216A36513D636064EF12EE150D04C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 a5228d373f5152eb22e9a6efcce5ec7b3c7a5800b7da249b7d96b4f367247b38
MD5 4d233fedefbf3de7d8e1f1287fa47410
SHA1 a09afc261e38652a62e5c49731bc7cb074bbb315
SHA512 1e7e848e68346ebdd30615d98649c0de143008955a109ae30d634d099d2a31db72bea09204c01afca7e3250637eec55a91f82a92e83aaf79a47bada1a71e3752
SSDEEP 24576:Pny+WT5supBrUMeqr4RWnFUQRKVJdp1ZN:vy+A5seTaInFUYe1
TLSH
T17C4523026BAD6BDADF0F52B2C8C4555AA8EE6FC73316632613D636064EF12EE151D08C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 7b5a070a2bde33b80520e3b5740e56ba359a14e3f7ec2f64084364e4a03bc130
MD5 b9b89ccf86befb1731beeab1b63e5fc5
SHA1 e43374679f42b236cc16aed987233cb348da3a89
SHA512 dab311187a09d3fcdfb7a3fb60d341e75f90214b5f405e5340e6c2d2a99682f05336644d142a7f6a442a14052f4c3d2b3d0ba89686369456fc6c913b43757178
SSDEEP 24576:ffwvok9RX6wkyAIRy+WT5supBrUMeqr4RWnFUQRKVJdp1ZN:ZMnYIRy+A5seTaInFUYe1
TLSH
T10B85DF29EBDC44E5E1B7923C89B7460AF6B178591B31C2CF029A536E0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 f413c2f6bd91737c27c72f3b560773e60beaaeff3ca1a672ce4081319bc6fd71
MD5 007f912b210d6971fbda7b335917b45a
SHA1 a9df200d78328121ffceb39ecbb3e725f033619d
SHA512 e070af51b78f51e9b4b9291706024c08eac35254d12e6704c8338964b9dec8cc5b1cfe8e7d6d258417130d06121bc3a1236c7c2a2261f4adf7e080b65ef0f7dd
SSDEEP 49152:UYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK02y+A5seTaInF2:cySzPR+A5seThNe1
TLSH
T18D066C56A1A801D5C1B9C1B98F0BCC1BFAB134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 a205ee5167c9db215ab5fcd9eb6dc6d0893881d1de1e713ce49c789d4476b4d6
MD5 23e1615d9f5a007cdbccad4e33a74068
SHA1 6ca66bd5929663d56bc039a0bcea609de08d841f
SHA512 1a1ffbeb296e0792e45f6b45b7cde9d18d6091fae3a2b49d158c588519d1a5b13edd750a12cc8bbf21a8e74224b20570061454d01f4f9f50556072a534a1120d
SSDEEP 24576:i47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYEy+WT5supBrUMeqr4RWnFUQRKVJdpB:i47JUQj4irIhCnDHUPfF/my+A5seTaIE
TLSH
T11365AE1EA3EC02E5E1BA927885154A1AEA71742E1F31CACF12B0437D6F63ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 9058ffb1c46f7cb549cdfec908ce1bf8c862c45227fec9c890b9ba2019fb2816
MD5 d89c094fcc2dfb90692263767e7911b0
SHA1 c63197f2008f1e13a82dddea83cbcbb9d51ae062
SHA512 2af2df8b281ab5638f3c34e4a4473f8f0584fb88a39af6fbdf680482b7a30bb134c454d91abd50f70d5f616ab78af68b1506fff31197797b58964876cc2743b1
SSDEEP 24576:hVy+WT5supBrUMeqr4RWnFUQRKVJdp1ZN:ry+A5seTaInFUYe1
TLSH
T12F55010AD29812E8C56E6275CB954A01B3777CA693E1E3CB13D0F63E0F762D45DEA603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 0e820593437a70168e26f14d8d455fa5bd0cf975bb85474511b366ea341cae50
MD5 0cfb1cb11a7c9ebab68fbd4138b530d6
SHA1 7012f09b116a920c990e8f1ff12d97ba89ec7409
SHA512 c5dae405a3a41f1e62a3e0e07d9f4e87ca7e446e91fc12cf7d5b426f2544898e862ec1da9b1347b48016a8111b6d60be0825b08a7b06c447c3b11e3bffda0531
SSDEEP 12288:D9B2gVXSGj4zUfEmUkt2Ph0r0OiQzRSZlQmtjzG8KGmqluzdBf:D6JGj4QJDtbIrQzMbQmtO8xpOBf
TLSH
T14A5527407626C68FC6A940725E36D6CCAB707C42EE056E0773CD873FC476A59B6F6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 8KB
SHA256 05da47cc05f59a12d3a6383603a2d7d20eb343269973d20ab5401ef621317489
MD5 1a23c3976b7d2ffdad44a7dff132012a
SHA1 c7dd1b54ba30ded9bf59fdf3471575d368369e56
SHA512 2d60ffe9001975ec8a86629a4448f931f918886c941d5cc619fbebb76f7573bbbd70b97870ce32e8368fbe4951d84219e32c821226acf3138a0184dc644f53a8
SSDEEP 12:K9o8lfPEWEEEEEEEEu03EzBRMtrC0EEEC3Uy7En8955RvMvsMlE3UvkNb23/:K95lfPfxu0vCql88HREs0skB/
TLSH
T136022B7AFB618E51EFF25971C887AF818F75D01D95495383215471286F055D58C2CB18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 794a1c9103ddd81ab065ede5e57903ca6b484a9dcf727e3560d35c7a4cc2d81a
MD5 8b910a3ab0cb7ee94a82fa2f94927600
SHA1 fb04aeda2cc8f71739068183e835b34c7e112efb
SHA512 785dad40d2d398746acdccedf994b01661b722fe154424947bc89396726e6301ba3034c8add7097251327320c966dc06422a3d9b0ca75ce4336a2de871ceeb58
SSDEEP 12288:VZ4q2QJOVJcUNbTDx7Y94CUY3S3YX5NdgikR:HchYXJpkR
TLSH
T1D6552900A5B7E34FC97E40B7463286CDBB746C43BB453B05734C893D9867A6EB5E6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 52d80514205afacbcf595736fdfc0ff7ad0ba167f4afd7d477c764600cc5cfed
MD5 f99217aea180819143c43c693fe35c93
SHA1 08246a6a1b15fd29b3c387b2871b070f17c4450c
SHA512 399e664e3976d39b8eed72a52b3f1a7a25aa05226e1e7afd57c8318ea13a8a2e263990bbd4e5a84d283452add6411fb7afb965e43611f40f1e813fb4f5ea7b01
SSDEEP 24576:ddy+WT5supBrUMeqr4RWnFUQRKVJdp1ZN:ddy+A5seTaInFUYe1
TLSH
T1A145231267EC6ADAEE2F53B18498552974AFBFD62710E2E36381374A0DB02ED4D3D10C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f9d691a0653b231e9c2926126fb864d021ccdebffaecc91b9ef3e7634f961f6c
MD5 f31266e2e080dc7f23f4d98a1dcbfce7
SHA1 cc8e4a2f7962e2c6920254d6b0fdfaa0782b014a
SHA512 6aa3e267620eb880b4766d6199e5a391cffb46b2d10f9d1f38e3c0b63dc76cc6cdfb4181585bfcf8d2d2e99ab1e1f73905ea673c41ad651fa21f817fc0b5281c
SSDEEP 24576:fgb6bmBIi49WNNFpg1rSvFv7bYjy+WT5supBrUMeqr4RWnFUQRKVJdp1ZN:fgb4mBIBhGFEy+A5seTaInFUYe1
TLSH
T1FE65AE1E22EC02F5E1FAD2B8CDAA4417D6B278161731D2DF1251422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 9e96e4b89496ed1ae7719887b156820174389ee5331976d0727bf5497eb21588
MD5 2a040e325f731a58cc870aaa62e09b7f
SHA1 e14d905d66bbda8c4ca0de1e72047c25a56dd046
SHA512 406a830f74613e9ab895915740b05f9b12e892857b25c020384a2d8447ea68b0955e5ee17eeb6bb90d1d5fc326372020369f8899c9eae095cdd236b302342503
SSDEEP 24576:BG88u8FpJqH1Wzria7/mUy+WT5supBrUMeqr4RWnFUQRKVJdp1ZN:E7ZFPqVha7/Ly+A5seTaInFUYe1
TLSH
T10085F16577E502F1D47BD13889864663F6B2B8251324EBDF07A88B551F33AE50B3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 83cce44edf01cdc38568381c32f5f03e741ba0e89a898f99aa250705879d1471
MD5 137421d1f1b98c92b6e9ce2cf31f16ca
SHA1 64513d5170b1845078b01d6b2bedcbef599607b7
SHA512 5251f113bc842f2df393f5976cd6f15df4b4869c9fd6a1b8a0f2d936b553e45f8586bf71bdea87417e03280e7b1459e6b4fcdf521316245465e04ad2b91f7318
SSDEEP 49152:jBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj4y+A5seTaInFUYe1:MG05lO43b0+A5seThNe1
TLSH
T14DD5CF6A62EC11F9D1BBD17CCAC64A0BEBB23815033556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 039e86e33ad37e6c58549d62e322f5f40ae67d9313a63d06655b44f625e8e7d4
MD5 18f8fd2d84ebc9d4aba8dbfeaa70f567
SHA1 543af4b9295aed68fc60a175fb62c356a923d948
SHA512 27a60835107810f8c308df5f588a7aa9bae55db30241d0ab7fc3d98ca9319e83ebdc1abe7610bf024dd9bddb4c5312c5703f52356780e5297901266829c39b26
SSDEEP 24576:wfa5POZ3dpqWVM50JicR2hG0lasx2+47eidn2y+WT5supBrUMeqr4RWnFUQRKVJd:Ia5POZ39Jt2pasx2+mQy+A5seTaInFUz
TLSH
T1FE65AF5EA6FC01D5D579D17DC583861AF5B1346213329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 562dba9c6d239708f7256d3802a725f3f10140d28f9162b3a41552e8c2dc29b6
MD5 c14f88f736465c4f999c7e7bbb570dae
SHA1 a606a37fc0542b24099b05a1dce9adb2e35dced9
SHA512 a468ec5b0d705226d5fcef979b35bd399762d5487e91bb7571663fb8ce43802cb51090162ee3b5ecd0c9281d965837c9e3179fbb34e55425aaa0b40a26a23eef
SSDEEP 24576:UNcwHdjbyQ4nLC18lb/EOjowL7FkMy+WT5supBrUMeqr4RWnFUQRKVJdp1ZN:UNc/zEOVHFry+A5seTaInFUYe1
TLSH
T1E7857B1623E901E4F5BBE1BE89679546FAB17865133086CF0291851F1E73BF85C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e23f1e4330222d5403fa08be4b11968a09e4e3c5d0dfab58473e59aaae945e4b
MD5 cdb155961042c75936efa6c075020742
SHA1 50e025ff5975c8992a439280ccfd45239c95f91e
SHA512 1c1850f53b9bc4094fbb31c95090a5de0aff6cca7187c97422f84b00d38ce39a77e03206d401dc27e7d2b4237605496e95143777c94e94822bf045d8fe85c1d4
SSDEEP 24576:5tkNvNnaFeYhJNtmZBmSy+WT5supBrUMeqr4RWnFUQRKVJdp1ZN:5tMwBtOmSy+A5seTaInFUYe1
TLSH
T19855AF2EBAB846E4D1FEC6B5CD238512EA727461173293CB5390C13E0E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 ec590ca0f420c7ee027cf3f59fd787d96deb3a0f6dc606fe3823b5348f3f5053
MD5 f81bd4d2ad2fc23747156cb5deba1b1f
SHA1 ec1f348580dd8ef8848bd6c7f9b58d2266edf338
SHA512 320cfbf80f6788ba6479e543edae5d9c019df803fbc22730f356c4749623c17f0c346d0ef8c36ce5ac5433d7a00acff7169861c9901b02b27879d16147138715
SSDEEP 24576:qPUr+NQoy+WT5supBrUMeqr4RWnFUQRKVJdp1ZN:qJQoy+A5seTaInFUYe1
TLSH
T13A65E11F26EC18E5E67AE17D89854619F772B4A21312D2CF02E1817E4F73AE86D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 46729f14520a4ba29d79d22a5fc0e2e3328289b26c6e6ebba387e2e525f03eaf
MD5 977d902997e85fbb836f9c459b6f099c
SHA1 2b07ca79c1205fdb2b2b15e3dbcabe3278dad851
SHA512 8096d582339577e044d38221f95acf6348763bdc8cea06e3f41caee780d5e65bb1ec9a58aefd5b0e200c593095d593ad8c3f48f97028d322fb660ab46e576613
SSDEEP 24576:zD3FHshBIYQgAJy+WT5supBrUMeqr4RWnFUQRKVJdp1ZN:zDVHeBIAAJy+A5seTaInFUYe1
TLSH
T11975E17DE79C04E4D57BD1BCCA538A06E67138A9032266DB02D481BA1F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1284-76-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1284-258-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1856-321-0x000001F9CF830000-0x000001F9CF9FA000-memory.dmp

Download

memory/2268-141-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2268-134-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2268-135-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2268-310-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2672-64-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2672-66-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2672-221-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2672-72-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2784-107-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2784-306-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2784-113-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2784-105-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3184-49-0x0000000001600000-0x0000000001660000-memory.dmp

Download

memory/3184-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3184-51-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3184-45-0x0000000001600000-0x0000000001660000-memory.dmp

Download

memory/3184-39-0x0000000001600000-0x0000000001660000-memory.dmp

Download

memory/3432-291-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3432-92-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3432-93-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3432-99-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3432-307-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3432-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3612-22-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/3612-14-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/3612-104-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3612-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3644-60-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3644-180-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3644-54-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3644-53-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3660-133-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3660-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3660-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3660-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3660-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4072-79-0x0000000000400000-0x000000000062A000-memory.dmp

Download

memory/4072-0-0x0000000000400000-0x000000000062A000-memory.dmp

Download

memory/4072-1-0x00000000023C0000-0x0000000002427000-memory.dmp

Download

memory/4072-8-0x00000000023C0000-0x0000000002427000-memory.dmp

Download

memory/4636-118-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/4636-117-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4636-124-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/4636-129-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/4636-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5660-80-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5660-81-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5660-324-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5660-87-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5660-276-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5660-322-0x0000000000760000-0x00000000007C0000-memory.dmp

Download