00c8e7e4c28045e7dbef7593cae81839f6e22a030e1688997d4d3b7ab4b98155

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Size 1.7MB
Sample260708-kdg5eaet7k
SHA256 00c8e7e4c28045e7dbef7593cae81839f6e22a030e1688997d4d3b7ab4b98155
MD5 8b73dc13f5f9d7ff0ed1b36c6480d889
SHA1 66d165dea0d4a3e356becc2acfe688e54cc23ceb
SHA512 3220b9429411d36a1dcde2370132309f4f3215991c249a7a8a328b1240389a018365bbb615d88ce4a155449a792e0f10235db04cb8ea1138a1fd9c5ee17efaba
SSDEEP 12288:ggqz7jPd/DwIzE5jjXa9GXpgi+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJk:gN/PTS1pgiyxknw4FYnshx8OfVe247
TLSH
T1F485E01376D28071EDF219320DF497BA166EBD210BF389AB939426BD4E70DD19634B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2552	elevation_service.exe
4024	elevation_service.exe
5744	maintenanceservice.exe
2172	OSE.EXE
1956	PerceptionSimulationService.exe
4040	perfhost.exe
3980	ReFsDedupSvc.exe
4336	SensorDataService.exe
1176	ssh-agent.exe
4056	AgentService.exe
1436	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2f7a40b02468fd14.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_123281\java.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_123281\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a0f355dcb30edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000daefd41fb40edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eee9661fb40edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000224efadcb30edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d67e9fdcb30edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
580	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
580	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
580	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
580	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
580	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
580	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
580	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
580	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
580	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
580	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
580	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
580	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
580	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
580	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
580	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
580	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
580	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
580	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
580	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
580	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
580	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
580	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
580	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
580	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
580	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
580	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
580	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
580	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
2552	elevation_service.exe
2552	elevation_service.exe
2552	elevation_service.exe
2552	elevation_service.exe
2552	elevation_service.exe
2552	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	580	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeBackupPrivilege	3980	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3980	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3980	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3980	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3980	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3980	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3980	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3980	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3980	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3980	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4056	AgentService.exe
Token: 33	1436	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1436	SearchIndexer.exe
Token: SeDebugPrivilege	580	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	580	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	580	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	580	2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	2552	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 4688	1436	SearchIndexer.exe	99
PID 1436 wrote to memory of 4796	1436	SearchIndexer.exe	100
PID 1436 wrote to memory of 5044	1436	SearchIndexer.exe	101
PID 1436 wrote to memory of 4128	1436	SearchIndexer.exe	102
PID 1436 wrote to memory of 3740	1436	SearchIndexer.exe	104
PID 1436 wrote to memory of 2588	1436	SearchIndexer.exe	105
PID 1436 wrote to memory of 6084	1436	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_8b73dc13f5f9d7ff0ed1b36c6480d889_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:580

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2552

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4024

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5744

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2172

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1956

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4040

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3980

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4336

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1176

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4056

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4688
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2626306573-1585762579-411806764-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2626306573-1585762579-411806764-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4796
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5044
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2580 2576 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4128
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3740
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2580 2576 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2588
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 dbcb905113dd7fdc51ceccd58e44f32f8e4aca0aa37844a60c968104fff0ccd4
MD5 d303c41404ad84889f072cd285a06c3d
SHA1 4c5f538a9198a6aa51db535f3f994a046723b89d
SHA512 5d2ebd26e92c9ecb9ccd5bb775fc5046b72ae3413a8620f3f43672a4a830db78deb07f26967ecf72aeb2801606251cab39068925ae2db92abe8257165e90f063
SSDEEP 49152:Jb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnMx4x8EVep:f3q6HjBfix8EVy
TLSH
T181D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 cefdc2845698f86a76494d76d7c1677358862e04e26976834486a56522631e0a
MD5 8df1288900d6d56258261d911d08219f
SHA1 74499c60b5ed735aeb2423e7b7422a55e42664cf
SHA512 01ee351456e3987e57565d1598bb72bd4861fed13a34da5a3b0a8874c016c832d41f31755be681e963ef4bcfd65f5081b08b78bd2aa8ff92c669eadbff6a82d5
SSDEEP 12288:q1XLsswWkxy2lRq2czAA+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:gXYfDtczAAyxknw4FYnshx8OfVe247
TLSH
T11875012877D508F9EC6B8139CDB28512E633B8554770E38B03E4A52A5F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 3ed29de01c50de7c7df25c88d63158daa041f0a155bb1b88ed6bad83289cfb23
MD5 9f955b71dc1fb175f9d409a75888baf3
SHA1 780e144c5afef9eb2301413d354b79d16c940fff
SHA512 505de66cb0e5bb2fbd155b81638ee47c66081ba41d5bdb85ef58278600be8306a9ab3f31658f2a650128a601cc118c84c7b5d92723003261c08c758da8cd3778
SSDEEP 24576:E0Le5ji0hmx1rMhyxknw4FYnshx8OfVe247:EPji0A7Jx4x8EVep
TLSH
T10195AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5606217e22ba4aeed304edfacdce6a4bbbe4944a53e6603ea49788d19c8e7e6b
MD5 1bed72e1ad15a4adedd43bc44480c5ff
SHA1 fdb3c4e37fe65241cba385b2b638a583da6f0f84
SHA512 f1c3087871233db1903c8efc868be20afbc0014126e0c08b8012cdee72fd910bb1a0f8e8a0c45c972e395e5aaf1d64e991ea37f742e42a3fa4f9997495d56535
SSDEEP 24576:ma7/ezSC6vUyD/aqgrvWE6q8wyubyxknw4FYnshx8OfVe247:x/ezSC6vUzPvxHjy9x4x8EVep
TLSH
T170756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 63c6de54b6f741444c4f2c85e372441572d78292ce6a00bcbb34e7f6d6688cb3
MD5 7f12280130c7eeb1a68f3cc681f9c931
SHA1 49266c2cd074baf457c04553589f1b2fbbf32ae0
SHA512 d9278a451e6b0b04259f22c07db53b068569b2c9ca3e84609caacba59ee9d80a2039ffb2541ccfbcb34cd6ce0cce2633ffed4274c3779255a4fd102643ba667f
SSDEEP 24576:9VbqPb88hv/l+6Uyxknw4FYnshx8OfVe247:9VO88hXl+Yx4x8EVep
TLSH
T179559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 89fac587a98e0c57f32bd6f74dcdd430bf96c0bd88e729d7f2296ce10af4aa08
MD5 084808ae5a26010a536f894abdf57953
SHA1 6fb507dfa754aad47cdba8b7cd80cbcf5b30f41a
SHA512 79ff55aac4690514ca58d123cb951c94195a784c9f8fc78d4cf8a52e5db44ac0f60b5aa66bd4bd310cae6e7bfd2a7bea858b2cc83bf08cb049ec41c6631c8f26
SSDEEP 12288:PNV+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:PNVyxknw4FYnshx8OfVe247
TLSH
T14065237CA7DDA4E1FB5E14331B7172622616B9A4DA74C11BC778B14EE4F0CA0E06E623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 055d3250915e319283cd736f2e1c317ace4345497f87f0033eb0d3404263a0b2
MD5 02e6c46ea188d23159788bb2d6ed51ef
SHA1 8c584129d8662a8ed6d6fd130dff4cff65d8522d
SHA512 314e554de9fb2402bf2f708412a6a54df6373c8c2b22292cfe39743be2e13b4a7fff9a43750b2641ea02f2d6c54f7468c3924fb3b73dc4f9045d9cd629ca762e
SSDEEP 12288:4eBNUbTVO86Us+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:4JIUsyxknw4FYnshx8OfVe247
TLSH
T14075CF7BEE28FCD2C27E5DB95B918200A77274704B6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3b377e42122a291981f7170d74c31bd85e9c8e74306a4d7cd9c00b335c23177c
MD5 02109c33c7867520e3ea2032e869b048
SHA1 3046464859c0720788e0fe84a8e89973695a8be0
SHA512 8cb709bcc9099306d6c4375c6067da3a5a9c34c346d02a84515ee3b6933392441b0d6cb14a0710c6fbb4d19d99b8b9811bc5602dee99246b64ca21c0ce7f24c7
SSDEEP 49152:AQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THH:AQvGAdlCEL8c/yRNw5COix8EVy
TLSH
T15D267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 e637e44c8833c63b3657da1b91ad0c96b4e24f00f44f2005d8114bc78960b416
MD5 116728eb78b7e05bff6e2774d32b7d65
SHA1 5545fa937028363fc84138108f569727dca0254a
SHA512 d61bf46762ad2805c5f6c776d535f6dbfb043cfc8aa0886a530441e95c48b96ccdd39b3a355b64eda7421177d8614b68e5b3be4f6fa467d73c13c03d23e2c1f3
SSDEEP 12288:UAwSfxL/2Dc3LDLLmt0LDQewsAjm+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:p6ewsAjmyxknw4FYnshx8OfVe247
TLSH
T18785E030FE74E032C7BF0DB21B36D716142DB9604B611AC3E3E89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 acde702c0c7dc9614e33cd4a9b67542b9d39edfdc3103cfff3f32f0ad436550e
MD5 836b5f1cd4aeea6069f8a4841d7b3289
SHA1 5ca67a9f485a848d229f92752377437a16817bd8
SHA512 e9992d4e9fdc5661ded55a98df3ed85a44547ecb90dc725e7aa2867e313087542181fd32c5bdd2e0a7857cf3dd4623befd47ea32f3ae5343d857d8957f55a3e2
SSDEEP 196608:MUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHs:MUEtQevvqc2W1cpV2EI32
TLSH
T1CF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 312b8ac809c6305028406142094ce2400e626a21c3e568e303b1f6dbde024044
MD5 e8134ddce58e29d0bc1d27c067fcd232
SHA1 fbf0858a502495b55799b422aa4dcf606aaee447
SHA512 adfbfb631610e1b0d73fcf39d0d95382303a2ad78988bfb336d0d2d0510a5beedc4f21e26378d41b05332a592aa445552793915d786c2277d77d3566c4e1b7b5
SSDEEP 49152:KCbRquA/m2yL5zQfFiV+XenmE3/z5x4x8EVep:/oqtVjnmiix8EVy
TLSH
T1B5D58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 77a4d0fd8b6f251000e066d82a6dc9d97df4ca8171c4798df46336cca27c79cf
MD5 28b59b2895ae36b97c2c2f031fbce5aa
SHA1 3b183388cdbc8399b656ebf19ef4d1c3ece15cdb
SHA512 ff1e2d410df5d8ffdc188267f025318728c9257eb139479b8329b4e4cf8850484f7b0eef69921cb18c622c5a6f8c19a8bd0254e043bb8ffec176ebbe1dd8626b
SSDEEP 24576:cAhGLJIFoiwtA5l7S533yxknw4FYnshx8OfVe247:cAMyFoiq5yx4x8EVep
TLSH
T16935AD80E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 828b1923eb077e8650441609c858e63d4f3ef456adbc21b25954ef975cf81aaa
MD5 b0628f3593618e5ce43b55a6f168d230
SHA1 39341ab6cdbeaf8d6fa8be6298e54e111afa43ed
SHA512 09747dd2cb418ecc105330ccd1b1e6fc96f2f21f46a2b64b5f04a7d76c50cbdcc803b7248f42a446073011ff8cfa1908db923570370d4beee57dfc811cf9b069
SSDEEP 12288:umw5HEjsChN4BFgl0WDm+C7+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:nwuVOWiyxknw4FYnshx8OfVe247
TLSH
T13175F14977E91CF9E9A741398657D132F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 9ef4e8b4dcac903792f5e9be099b600c5fe1ace90a33ee651f03348cd47eb039
MD5 a54364289169c7be915cc2659c0260a6
SHA1 dfb2318325d651f5d8406f3633cdd5880b9bc0df
SHA512 fbcceddf9fcd38154cad3976569ed0626c2390f4052615d39672c67151276fb3fc89ea3ba71344f49cfd71be3fbe30345da24c1005dbf5fa16f43fbf7df04c0b
SSDEEP 12288:9FZ1Iy2+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:fZuZyxknw4FYnshx8OfVe247
TLSH
T11A6512AC33E860F1E1A7113A89F15205A7627462677183CF4768A25EAF72DD09D3E723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2096547cc69ab39aa8d5e332564ee6814ba732b6dfce1431abf348876e26e9b7
MD5 fe8da1d53be5e15c7db2b8ff85159442
SHA1 0ae63575bde8ce3a69422977cab04e2a5f3fd28d
SHA512 f86ab4fcec7653afacd9adfc47642ca201a3c453ac50960e26fef1a6aa6169a6a1decbb9ee5bfe0cfffa0eeb51dcddd1d96ee5c8f4e2295aabafc73ed6144b45
SSDEEP 49152:ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uz:tQRQyi36YOcPQLvw2gAf+PN37ix8EVy
TLSH
T1EC667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 edef64522e734dbe711d48f15e076b382d55c3a1123ea9557ede038fc2a43344
MD5 3b751e35c71a6097feb9541a7d352f41
SHA1 1f722660a511802855b3d15fb9e56e77c6cdee42
SHA512 1b6410723ab544079c25e17faaf8bf63ca5d285cfd4bfa2efe355e4ee9b16ef8fe5dd9cc1f0bf17427da5a55f7b285a7f6802c92b10d6d9d1234600cd47f1f36
SSDEEP 49152:Uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uz:LQRQyi36YOcPQLvw2gAf+PN37ix8EVy
TLSH
T190667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8a06a0ee96a42fc1c1883d326a9436dffcb68026b84c7567cdeb9b064b47f11a
MD5 0753dd4dd04cfbec7a353d97c9f5dd09
SHA1 a1c9b6131972e2463979171e870e63af13473f5e
SHA512 b762780cb1212ec904b6ccbae58fbdc6a60fee554721c0c7f662a4058bb92f314d0a6ca57e99e7c515dac554c10380605ae7271723485b3f1f39e97d370a272a
SSDEEP 24576:6wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0Jyxknw4FYnshx8Z:068Qg55nhheWu7PNU3/Jx4x8EVep
TLSH
T12DB55A33B2F600A9C44DE1769F46873196D27C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 acf66ef09e0674c17ce1f40e8f6de368eefdf8444c3ce9963222390beceda5f8
MD5 8fd5ec49a8695695bba2e26177b36d46
SHA1 c9deaa0da886b4237e570a418796996490322e67
SHA512 b740f089d519dbd3a6e162e3d45e002fe7dd7b3039ce051fdb76d859cf275a84660b9a965b3aab0141b66c0b585a8d4ebb0533c8d68fdde661c3221a7e71b59b
SSDEEP 49152:Y3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk995:Vy5112gYy5azzVvL69nLKnhZgix8EVy
TLSH
T16F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 725d2b841927647979834b32886d87009136488c8cb59fc644bda7551be5654c
MD5 31b036d54cd2a1ed92f4fc6b4cfaa58e
SHA1 d4328e85b19bd905942e0af5b5689c99579a6468
SHA512 263219188f7de2492204f758df8e5fb7faf756a71e343045e214993538e2df9c2d8a319126470a5382a30b30e5bcfef71b5095d9face49a00195a3c1ddec8524
SSDEEP 49152:mB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glzx4x8EVep:Uu6JmVxd2dzix8EVy
TLSH
T17FD59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 36d61417f76b7a3f93a5a19d6e911ebf7667c1bd7df8ec30ab1bb2824600674b
MD5 b38f22fb3fb9742902a39ca4441893f4
SHA1 38a83fed2fb9a4b930f9e22e176c1bc6531163d9
SHA512 7ef6924cbc16c41529174fbb25501e6a66dd7c4bcaefac0f8824b696dbd328afc92a24bbadda9161805d58602f2a8f9223ba429393e2976adf661b8e0dcdbcad
SSDEEP 49152:81hpsNoJpF1A6UU44CwH7R4xnx4x8EVep:8mifPbRiix8EVy
TLSH
T127B5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 320089593f4c9fdbbe8daee281a9ef6cf5d87a7ce9e49e6fb386e9ac7a14fe8d
MD5 ea66337484347c6b33af9bbe1613909e
SHA1 02ff23f39e0bc3f3cd887059413cfea482add366
SHA512 b2bf69677d7136a584d1df50f389788031f7dd42da66244be17fe1e95357b9084bf0761e7b14723b82965830568b3f08c503e7ca61f1c6d018cd42d3a24bf0c6
SSDEEP 49152:nSuZQIY0Be2KRRVtOnks6NMHqcx4x8EVep:95dKTi61cix8EVy
TLSH
T1A6C5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ab53bd8143305f8894a789880a5bcb91f138733f8e3385233d565f7e399a0653
MD5 3a5c4050056d469b6e73289d5ad51e59
SHA1 7a43e68ed2ceb4fcec661821b4c025cdbed61d9d
SHA512 839872db75371893bd7154fb1944f7d1625a7ed3b668f62423e957e3e5634345fb530e08bd222240621f732a141f2df25df3b0267e5e6fb3a7e0af07dac74065
SSDEEP 49152:LhtSn8EApI0figngiDn0AP5wDx4x8EVep:KX2iyphWix8EVy
TLSH
T17395BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 7a8f7edca9053529f196edca7b7598a77e01ea4f0ef5d64ac870799b52fe9401
MD5 9879dd79c1a546ef2d749054409e22b2
SHA1 3229fa97187a4dbf73c258442dc783b17a0dd078
SHA512 ed41c799d0f1e478413971442e40d5105bc7d96852b2761b14927a659e0a875c0cff001e4a3a3419047613953aff87c5297bf60f151f12b9c0de39f7922ffb5f
SSDEEP 12288:Vt+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Vtyxknw4FYnshx8OfVe247
TLSH
T13165237CBBDEA5E2F50D11734B7173626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 6ce32af4f57da49cc6f1fe4fe3eb29ca2c76115b30ca1d0edcf2e1c4d376b6a7
MD5 f5efb767ae270c00e3db0306415d70d6
SHA1 b8decaf789898b4570858688304cb2cc28924a29
SHA512 a457ce38a006a284a90be8086ae495c3e35c04c7e832fff9971f3f8b826600f844b21f022954d6f606f973e83944dbd960c44ca5bbee47594f546fa523d34a34
SSDEEP 12288:zK+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:zKyxknw4FYnshx8OfVe247
TLSH
T1A265237CBBDA95E2E50D11734B7162626609B5A6EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 9c287bc49912a412e4bedeccf1dbdd94d91b2f9e5af08568a775c05ef37a14d2
MD5 840e2eb332384c66b2b51516f84dc5e6
SHA1 da04a2230fcb5629cf3e875a24a98344baa06bda
SHA512 9a0e3ee4b7525602f3b5b14a6c19166137a142d41882731bcd9bdb4bc5425fd353187fcc4329c37ab2b2b48f1c130f94e3357b863b572b73691cd57cb8eed10c
SSDEEP 12288:KE+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:KEyxknw4FYnshx8OfVe247
TLSH
T18165237CBBDFA4D2E50D10734B7263626609B1A5EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 7e7b4bd1105df44e74ed57237fc5e7900408ac2927daeb164858ed8082a00e51
MD5 14359f434fbb42e7bccfef0d33b611da
SHA1 28d321cff8cfb3c988a978ee73453acf622ad8c3
SHA512 041013739441d3ea9de95d16a99a14331fc947c4eb528bb28555ba8d6244dc93255d171463d1fb80a84bbe102e91323e07618a550c9eaee28a3a3bd842f8207b
SSDEEP 12288:JVX+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:zyxknw4FYnshx8OfVe247
TLSH
T17B65237C77EE50D1E85A51738A726222B365B8E5E731835FCB64700EE9B0890E43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 e832a126495c292884f3dde5c2452cae4e2205bf1e1649bff54b789402373acc
MD5 fbf913e4dace418f830d2dc062d22985
SHA1 6bb2d5074f0a7acaa35b56b29962b51c3d9780bf
SHA512 f503002b033fc5bb46065bd26cc6ea35bf676ad78365bffe16f7b3cebbf85d33a718107141728b6eca7440bfe770c6744c6dee08fa8777660eec8f21e0aaf757
SSDEEP 12288:Tf+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Tfyxknw4FYnshx8OfVe247
TLSH
T1FF65237CBBDF95D2F50D11734B7263626609B5A6EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 0c2a55c951c73ef1face052471c3002f0ef94721e3e522d72d6b3c3cc38efdbf
MD5 b7a9bfda6609ae9f5496e9640038f133
SHA1 f9e2c7e52e461bea95989114497b544fd574e815
SHA512 d9b9ea887bc6c5e5eb84bf605e40a62a99505141dd66561102a611fe6c163f2d5736a1beac4997957f44e0906f63ad7b2b7dc5953ebdd0541adf8a81c14ab7cf
SSDEEP 12288:s++hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:s+yxknw4FYnshx8OfVe247
TLSH
T1AE65237CBBDE95E2E50D11734B7173626609B5A5EA71811BCB7DB00EF1F0CA0A02E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 9618e07615ca697e093839b2346a32de7d761abb21ccd919cb7c1260ebd74692
MD5 1ee2aa2631e384c5a247551fa4408cb9
SHA1 a9fb9b5cd2da6ebee00436540dc495ccb33d0425
SHA512 5a97e81f4ea7523bec6caa291f1d916dfd9b9a2b971594763b7c8aa5e656157d946693dc0494bc890d47658e93f540814ab2f65a02b56e180972456aa1d28649
SSDEEP 12288:vS+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:vSyxknw4FYnshx8OfVe247
TLSH
T16D65237CBBDB95D2E50D00734B7173626609B5A5EA75811BCB7DB00EF1F0CA0A02EA63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 f09015b0f9ce751ab6f18f239d179f16f1c635f5843458185fa974950ac63822
MD5 bedb3ce254f8ed959ca116dea1fea09d
SHA1 3bfdd913220dae246ef9517d295ef3b568f944b8
SHA512 433be07893f7d6965dbace7e4509c6c3c587b15a1f320b693a582c542c58f4d965867ae78bd5af15d4b132a5ad694c070c25455255b26277f7abbf7f46e8fbfc
SSDEEP 12288:XiZwbZzzFEoS2cPvyq+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:SZMdzFVSOqyxknw4FYnshx8OfVe247
TLSH
T16B7502A8B39018F4EC67413ECD259916D6B27C594B70C21F43B8362B5F736A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 d6d228a844eaf14e7a8c3bd52d1adf6a706645e62cbee6c1dc006c0bd6f12324
MD5 e90a65c5de2c5e90f09a7478f547cf16
SHA1 7a6beefb7e706306a6b3300577e80daf1e67cd5c
SHA512 62333c76584cb0f384b5f3a383420d7e93481c3e05f1257bf01e604d504641099c361989215f943c6d4fd5b646649ee0b27e75b38fe5ff3f4d3706faa912fa47
SSDEEP 12288:ip+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ipyxknw4FYnshx8OfVe247
TLSH
T11B6523BCBBDEA4D2E50D11734B7163626619B5A5FA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 5168b1daaafa3f9597089d4193816110db8fbbdde409a85ff425434fc58c01e3
MD5 16b5efd15f2d54c70e38f7392d74d0f9
SHA1 af86c67bfcfa0b5d712334323dc259c0b0b52a3c
SHA512 65bfa3b8d15af30c9f0d11262116a1bbab54fcc55b77be5ea50624a9a2da1488ccf9b82138c0933115b7e00d29789eebf86d2d34bee3c3a686c02980309abfe2
SSDEEP 12288:sl+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:slyxknw4FYnshx8OfVe247
TLSH
T17F65237CBBDE95D2E50D10734B7163666609B6A5FA71811BCB7DB00EF1F0CA0A02E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 6a1596895e1464f6985a9f1836218d84ceeee0d7d6ef2bcadb4091a54d205678
MD5 784c87f6e9ee388847743cf6beb1fdc4
SHA1 e8507c86d7b633e433a4e7cb19e347131bdc4e67
SHA512 a502126c10958a3503be25dd42c6c1058e1d8b49e9624ee1bc0c149c0977f97101beffa76e24e98531c229d975379f28fa3b74ce0b1b4280dd204d3ea00bf1bf
SSDEEP 12288:uyPz5L82+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:zzy2yxknw4FYnshx8OfVe247
TLSH
T1B075125B73E530F5D12A4236C9621612F372B872473086AF87A4537A6E739E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 a39e6bed03ab479f5c4b57772cc2b98e116a84b58f2c242bbea38645d155dc28
MD5 9a7d4766602b87b7f720ed2986a5efcf
SHA1 19dcae4a17f5e3c163ef5e8192a38300640fb068
SHA512 30b690ac10f26df74cdc9921018d0fc2a6fabc30fe8364bb801f5735ce2d041f55e61bb72582c4392d79a8e80298a1e74e7606da6b66524397988f069f65a52b
SSDEEP 12288:Cp+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Cpyxknw4FYnshx8OfVe247
TLSH
T13B65237CBBDEA4D2F50D11734B7173626609B5A5EA71811BCB6DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 0bcf944d079e79a6ba7badb30e51871ae1d243d5bc0488257958dd8583eab9a8
MD5 8f9ee506b2a40db1c1385665a4c72783
SHA1 50c71d66b7a1c4b50e8340ae47b9fcf4a2dd6b1d
SHA512 77b7bf4df7023ca315f01528d3762a03bfc0e896a8ae486856aa0849554cbb3c606dddb03582b0c8d96e1ca52abc6b7646f5d51f6d703926898f2e24d0edbabd
SSDEEP 12288:Lp+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Lpyxknw4FYnshx8OfVe247
TLSH
T1C165237CBBDEA4E2F50D10734B7163666609B5A5EA71811BCB7DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 214cd531cfb4954f93b0937254ee19b7657ba29b1f7063fbc34824da444df48f
MD5 f5a6ffd583c18c75fc96d8cc8a2314bd
SHA1 7254ca78abefb591b99536bbc8517887fe2ca67c
SHA512 a6c3f82b6c58afffdff580840c464c813b412660c423235a8bba8a598408ab1f5b590454d6c901f11e6749e4d0f14bd2e11935b980a04933f19984f7bdf3973a
SSDEEP 12288:eyPz5L82+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Dzy2yxknw4FYnshx8OfVe247
TLSH
T1F575125B73E530F5D12A4236C9621612F372B872473086AF87A4537A6E739E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 da77213c342fea5f84f073ff5772d63238f1d4a2e6e29614a3ec1954d5e0e28a
MD5 b55b3e15d98cd0abf918825da333e24b
SHA1 c63e21705c2da1468a49a4141909069322421734
SHA512 cfedb272ee0d117669bcf98c753f448102f9615d0af99509edc0b31f852f5a355a5f00c7b0dcac1d53d907ef4b5ef562ec6f537709d768ae8547505f0cabcdcf
SSDEEP 24576:6TGaLl3z0zD0yxknw4FYnshx8OfVe247:6TFLlj+x4x8EVep
TLSH
T1507502A8B39018F4EC67413BCD659916D2B27C6A4770C21F43B8362B9F736A05C3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 7e53d1475d89ec06ee6d64c5482ee7d1e33666f060ed14cd03dec80c7a525730
MD5 e678bb835bc5c7144566c82b3c88bb58
SHA1 2d5e1559889384b439af7e925b6654c104bfab04
SHA512 b5021c9ce01af4572183276c460b2a1f5d339c813d4a96526e9a5c121860c6a518d9fb7a556862551bae2b93a1d23af90ba843421880ee0b386ac164c6be20b8
SSDEEP 24576:X3Xd9CHKy7GZ4yxknw4FYnshx8OfVe247:nXd9CHKyaBx4x8EVep
TLSH
T10195DF90F3E410E4F0B79A35CD765512DA767C9A5B31CA8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 41b734309aa762a52737cce160cca678817d8451707995b9ba50593ed0823af6
MD5 1255724aed1bd8063aabe15ee83a516c
SHA1 9d594c39a55ec2d8ba3087526d927bcbc1bc98d2
SHA512 f7cddef5b82b9c48e91a006bf7892a4fbe4b0ade18d7208608a8ea00318e8631aa3706a5d5bf6721d2b99bb4034a184fa62f9b1dc04d8365571fd585b0905267
SSDEEP 12288:Ik+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Ikyxknw4FYnshx8OfVe247
TLSH
T1EB65237CBBDF94D2E50D11734B7273626619B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 3b56dbc87f1bd02477b98a03d4487d5327057091c9c7a0993339d41ff676fa14
MD5 74f9dbcba042d0188934bfd7099ccb53
SHA1 becf71fa5c7b6218724cb833d69498967444e4d9
SHA512 94284e936428460c44008e9d817be1debb61b054c01fe070467ea6e8e68004d54e67d00e6c80c3dc529b8fe033fde927f4210cbb1deb68120901f547b083325e
SSDEEP 12288:cW+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:cWyxknw4FYnshx8OfVe247
TLSH
T16865237CBBDA95E2F50D11734B7163626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 eb5ef3b22e81660cd4c48b289e40cd219d4c08e9f9408feef9f933aa9ef5c9b7
MD5 031a1920ba5af8b03dbe4ea20f5f656c
SHA1 4479a4f2dafbf8dc859b31430f8fac6ba35a5dd1
SHA512 339f832bf5e1e103e2c266abad1488cb0568b7da7f1ec2066be6757150b5be4a630c322a1cfc6d9b3d229ae6c93a307cdf220cdf6f54f95e9f897cef8ffe6edf
SSDEEP 12288:Nj+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Njyxknw4FYnshx8OfVe247
TLSH
T1996523BCBBDE95D2E50D10734B7163626609B5A5FA71811BCB7DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 7448f484939bbc0a2e194c5554d4cc2fe680d56e7ed9e7065f3ff387fe6d71a9
MD5 15dd856c870d4b1a0241cdee39d35ef0
SHA1 29e9b0553eaf8e1ba8fc89f4dea486d814c77795
SHA512 9414a6357ee05726b506e8d1b26fde72ae9d0b64d6d8a0d4b2fb1762b7860293ef2f57a6d455fc7f75493770af0cb3a212fad8fedfed3ec97bdc44221c5b7e6e
SSDEEP 12288:zp+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:zpyxknw4FYnshx8OfVe247
TLSH
T16865237CBBDE94D2E50D10734B7163626619B5A5EA71811BCB7DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 b0e312271b09d2baf90e1e6d44ce9fc9699eac519867936f091005e84e3bbc77
MD5 4cc4dd7e24eebab7125beaf08adec240
SHA1 86ca6769b9d71d490933385b4b07ce87d3002f06
SHA512 9a4049f34fa8934f65553d2cccd36a57eada55a9b2fc41bff8fabc0c34add298afd975f7ec6c4967be8eca471dfb349bd96730f803e1661b96fd76483669f841
SSDEEP 12288:Sk+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Skyxknw4FYnshx8OfVe247
TLSH
T18765237CBBDF94D2E50D10734B7163626619B5A6EA71811BCB7DB00EF5F0CA0A02E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 7b5175e83fd6c2b8c18f11c00e92fe859cc6f9a2f1f623176c84e4ac71f38304
MD5 ad28cb61470b636807bb851a12a91706
SHA1 1d73882fe2f9eddc33628e18d042a95964fd9af4
SHA512 76dbc52832150d0212e9d68a84f0f4894494977a0f9fe261578d76d75db396f3e928235f8ae78a6d4b9c1c619fbc8a605015598965c00a58554cb1321dece3a2
SSDEEP 12288:UR+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:URyxknw4FYnshx8OfVe247
TLSH
T19365237CBBDE95D2E50D01734B7163626609B5A5EA72821BCB7DB00EF5F0CA0A01E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 a675cad0094b711acaf12c0cafba54c66bd537f9aa408709186cad32721fb07d
MD5 71e7947f69a078381b3de2ebbbe9c225
SHA1 7e3f2095a0b40ff3c76226b218294827d758ebd3
SHA512 ab095f80db7ce34d109619770cd21df6edcf5f389d27d0d6a9d395801ec1031f8066609b1762078de405640455d85ef37a0591c2b944880fb9e27893e46fd487
SSDEEP 12288:5f+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:5fyxknw4FYnshx8OfVe247
TLSH
T16465237CBBDF94D2E50D10734B7263626609B5A6EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 64ef7be1a3de2623f70221ab517bb5231c341d5d3cac64f2655632be0a13500b
MD5 9538d1d1c190dbb0dfd0ca0fb4b5e779
SHA1 24af71ac4a17e88e1edf108d05929cbc2de5d838
SHA512 9862fd5dea489aa1c3138a0845089c00a8dabe94f3045daecbd0e481de94f73b0cec65e9c0fc63314baa47a8ee22d5bb80dc5aef755e576f1dbab60f2ed20331
SSDEEP 24576:NfwvJk9RX6wkyAI1yxknw4FYnshx8OfVe247:yMnYIAx4x8EVep
TLSH
T18A95CF29EBDC44E1E1B7913D89B3460AF6B178695B31C2CF029A536D0E33ED49D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 fb88457d51a374c2416c08e899e57e9e57671fbdb0ef38838076f0363b701c43
MD5 9fb717d0da24b0c496df8fc148db788d
SHA1 41908b0f237e7ce6eca5aa1103f9c24a5657d733
SHA512 9ee37a8ac045c963b285f4ea1b9467439184aa86c62d9fa1b3f85bc021f65e0a112b74f1949f2863012e200fc1850a07ed68fbdaa127add1b7c91c1f3263dcd8
SSDEEP 49152:QYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0jx4x8EVep:+ySzPbix8EVy
TLSH
T141066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 37bcb0df1659dc9edc24ac41eca77be4ff261f087b86cc893573222d7698e7d6
MD5 f2d1ced8085861590e756cd96dd33094
SHA1 bf1e3619c1a2ed150f649ee17e346130be3a0f8f
SHA512 80b8ed4aefa21766ce50cc437ecb9c7c570da12d13432aeee47e28c63cd0427c0064abecc1534844e3dc5c54ce56a57fb22e95f5a6aa08c02a9e41db4382ef09
SSDEEP 24576:n47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY6yxknw4FYnshx8OfVe247:n47JUQj1irIhCnDHUPfF/zx4x8EVep
TLSH
T15765AE1DA3EC01E5E1BA927885154A1AEA71742E1F31CACF1270837D6F63ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 e1bd2f2fb3e2bd89fa333d34216b982b18a81c24a8fd48d465ab775b9db1bb5b
MD5 caa3e73964d01fe1a2c1ba029d0e7753
SHA1 f53c886b36e5dbef71aaa1f60b31bae2d04eaf37
SHA512 24a6719828c3244ada3602eb2cdd04fa5bf01e7c9fc5370fe4380d79153856f96f0a81a5a51a8f73de9383ed9176269c4e53d77401fd8ef21cb14a642a9f38c8
SSDEEP 12288:g+sfZ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:QZyxknw4FYnshx8OfVe247
TLSH
T1C175F028E29802E4D06E2176CB625641B3237C6597F1D3CB97D0F53E1FB1990ADEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 f7c40dbf657c13c8ec51028eb85fde3f1743a210c40c6a95cb1bd1829401f688
MD5 0ad2f97eac91f8547188a39c9ce76f0b
SHA1 b60581e74b9cd0f4e009bca792f48cdaecb1714c
SHA512 68bb836057ac4e85f6e5dc67876250b22a4c71da5be347c95b3f2d18357880a5e545b05fd398d76bdb750e2a7e4cda0bba7d35429d2487ceb7b6955eaa7c4c47
SSDEEP 6144:5sBC2naWvTRZyPX5LKAotMxBMdDbr6luBBbGLFLWfQxOBlc00I1ModKs6jn41949:OR6uuAhBi0Eok3494pAIAaR/OI5+0
TLSH
T10A350610766AC74FC66D40725E32D5CCAB707D41EE05AB0772C88B3FD576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 eac37b85c4daff1ada7276befbf1413f9fe990453164c516c4f9aceb0314f90e
MD5 fb5baf7fc5c5a70a4fa145b2e862acb5
SHA1 e59677b1854bd219526f05952b639791f8986a66
SHA512 6c6ad8c0f21ebc7034f0fa92b5a6f01e4c44fbe0f2eed4ac5b1a901ace6efa97193f5d7b4b8bf9e29f7655df724af691c8a931827547358d742f963efc4268fe
SSDEEP 6144:LKhKnBT1uTYuCVuCxdDb+WtQmWzKVyI1UxZhKTtMxRhNynFkITKZcr095n3lFTJM:PP3XLdngPfn/m
TLSH
T17965D8406536A3CFD1BB60B2072A5F4DAB64EC07B7456F2673CC443ED86AB15A0B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 1970304ac807ba3c3ad9efc559e4e039e1ce9e5886ce88435de76b4bde2df3d7
MD5 7acd039357e3f2aca661cd47d79f0fed
SHA1 9f3906bfc95805e28ec47e28d9549ea863a423a0
SHA512 863498d435748a6d042b6f514a904972e59b6577e851005f50eb0b4fefe42b4741cfa5e9e73d5d957af3c41c52182b3eef58b5cc23551cdff23fb131864abdc9
SSDEEP 12288:b47B+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:UByxknw4FYnshx8OfVe247
TLSH
T17B65237CA7DEA892F86D11730676A231360AB5B49B70C1DBD728B14EE4B0CD0D93E617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7ea0cf7bc98862806add34d99bf92d36d40678a2d29a28d15b9e7a9c67d5e7f7
MD5 6b250337b23d8779cf92a36d6b267c90
SHA1 3195749458a7a6fdffeb94bf80701b68bee3eb39
SHA512 8e84fc2a51f766f7d186569319a9e614b60bb5283425eff29b0019ccac7cd9659f8126e123ae35626ab6dcf3600ec5ef6f04e4e64f4774433f1efe11c27a0a53
SSDEEP 24576:zgb6bmBIi49WNNFpg1rSvFv7bYbyxknw4FYnshx8OfVe247:zgb4mBIBhGFVx4x8EVep
TLSH
T1F165AE1E22EC02F5E0FAD2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 166e20f852b8d9e97aabce10d5f9aa9bac1f5050b0fb033e4b0fcadb4d6e1cd0
MD5 2cc66971cadb24b735856d3f495732ef
SHA1 7e3133083db55a729d17f0471b4cdadf4006029c
SHA512 53854c2fafa31f10b3b65cf889f167048cfcfe5d47a6da21c0406f75d11fbb8490574228ef6e122f2d04eb49e6e5a7b12dcdce6f3be606f7bbb01f2c995b6760
SSDEEP 24576:YG88u8FpJqH1azria7/mqyxknw4FYnshx8OfVe247:b7ZFPqVla7/Gx4x8EVep
TLSH
T1DA95F16977E101F1D47BD1388A924663F6B2B4250374EBDF07AC8A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 ac0cb0d63dfedbbbf8e47c7faed30a3b3c3c5c938d2e6a83bb4ebf6217bb8808
MD5 126a14d03b0ed495c0921997405c599a
SHA1 ee98688a800010fcb090779e59d983aeb2c998dd
SHA512 8800e4468fec4b8c3c73ce5fbf8f9baa2780eabf43068dc3211e2edfbe9730621444ba2ed44ce04afc5e48e3cf02c6a560de45e542ce4635a59f10591192a4ba
SSDEEP 12288:sHvUrBFrEjwaQO+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:sPUr+NQOyxknw4FYnshx8OfVe247
TLSH
T15775F12E22ED18E5E67AA17D89828319F771B4621711D2CF02E0817E5E73DE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 8397c3c9fd2689771312b8bfddf0a5db64e001eee9d808e61a834319b5b55c80
MD5 dfc820c7ff15e93d739e355576a9b75c
SHA1 0c54ced568db627df286419f23449fd808b4c135
SHA512 588f82d6e62d951178536723c301616802a3fa1a4598702a6aaf3f3be9a0c8cbba4a3cf87ac0c5998065950eee3b77cf4aee018c45bb30e8ee5cd2f09c0a53aa
SSDEEP 49152:SBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjxx4x8EVep:dG05lO43boix8EVy
TLSH
T1C6D5CF6E62EC11F9D1BBD17CDAC6460BEBB23425033556CB02A486A91F23FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c1f37b5d8a18f78035e129c60a8a108a1a0f5fd1106ef9223a0c9019179403cd
MD5 32dded9372be747999229ab5a59a92b0
SHA1 15fac64328cc15df612813e3eb8992f4e155ca0a
SHA512 ca588b10ea716866b1427634ed3975b622f3600f51b0fcfedfc7d87696e9c3b973ee80e45d046ebc60f4f6eed35d429080d815566c0c22fc562e954f2b42e6a5
SSDEEP 24576:Dfa5POZ3dpFWVM50JicR2hG0lasx2+47eidngyxknw4FYnshx8OfVe247:7a5POZ3+Jt2pasx2+mJx4x8EVep
TLSH
T17A65AF5DA6FC01D5D5B9D17DC583861AF5B1342253329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9ce2cd480331f75629db906af176fb42de9bf2ea5336ce07846d28d3e27c5f59
MD5 95f35d16524518d17a2d5fe2224d1a8b
SHA1 a4e59ce1a859e78d1f9915c16247944e8d1d9541
SHA512 d26715f8b393dc2d03cbab73decd2f5eab73b980b462b4cbbf0a4d786baa2d7c4f6365bbaa614bb6cae904b60ea8c95e6f701c6a3b3a6ce58fb1417b748ba073
SSDEEP 24576:GNcwHdjbyQ4nLC18lb/EOjowL7FkCyxknw4FYnshx8OfVe247:GNc/zEOVHFmx4x8EVep
TLSH
T1B0857B2A23E901E4E5BBE1BE89779546FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e41459b2f1cac886fa06bb4b27abd302590606f6855b76fbabc1ddab0e70afe5
MD5 9eb1f8316f6e43caea06e9f3d1dd22af
SHA1 d3567ef9046f87f8abc0e1e8a6c9e30d54b62af0
SHA512 c487ad6595829d44af8ef8932e3552eaaf14e3f7cf76e699837c2b56d18f05eb47a06d314cf24738413c97dfc9591800cd48b4d5a5cb1689838e553ee64486cc
SSDEEP 24576:k8kNvNnaFeYhJNtmZBm8yxknw4FYnshx8OfVe247:k8MwBtOmXx4x8EVep
TLSH
T13D55AF6EB6F846E4D1FEC6B58D238512E6727461073293CB8390C13E4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 3b1942b317c64bd39317c1ecdb281743be3be942441c14a93eb557e6efd631e8
MD5 53a2f8f3f5b233a567385cbf3f453d81
SHA1 95e4e90c82569631635dc71037b459a4db3c4b3b
SHA512 db5101c27d8155bfb04304431df82765c3616697e8c13cda13592dcab280d8c4fdedb15db9f9489b04e3e92e0cce03a519e69b76b437796d92449e7376075840
SSDEEP 24576:OD3FHshBIYQgANyxknw4FYnshx8OfVe247:ODVHeBIAA4x4x8EVep
TLSH
T11085E17DE79C04E4E57AC1BC8A638606E77138A9033256CB0294D1BA5F67EE46D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/580-77-0x0000000000400000-0x00000000005B6000-memory.dmp

Download

memory/580-8-0x0000000002350000-0x00000000023B6000-memory.dmp

Download

memory/580-6-0x0000000002350000-0x00000000023B6000-memory.dmp

Download

memory/580-1-0x0000000002350000-0x00000000023B6000-memory.dmp

Download

memory/580-0-0x0000000000400000-0x00000000005B6000-memory.dmp

Download

memory/1176-312-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/1176-120-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/1176-114-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/1176-131-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/1436-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1436-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1436-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1436-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1956-67-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1956-65-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/1956-294-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/1956-73-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2172-61-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2172-55-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2172-54-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/2172-277-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/2552-88-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2552-13-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/2552-22-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/2552-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3980-96-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3980-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3980-90-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3980-327-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3980-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3980-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4024-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4024-137-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4024-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4024-28-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4040-79-0x0000000000920000-0x0000000000986000-memory.dmp

Download

memory/4040-308-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/4040-78-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/4040-84-0x0000000000920000-0x0000000000986000-memory.dmp

Download

memory/4056-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4056-138-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4056-125-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4056-132-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4336-102-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4336-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4336-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4336-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4336-313-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4336-108-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5744-51-0x0000000002350000-0x00000000023B0000-memory.dmp

Download

memory/5744-38-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/5744-39-0x0000000002350000-0x00000000023B0000-memory.dmp

Download

memory/5744-45-0x0000000002350000-0x00000000023B0000-memory.dmp

Download

memory/5744-47-0x0000000002350000-0x00000000023B0000-memory.dmp

Download

memory/5744-52-0x0000000140000000-0x00000001401A1000-memory.dmp

Download