f0010c7e2ad3563252bf11473fe59458fa4874b3a053ee6cfc0e2e454a1d6af3

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 02:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
Size 1.6MB
Sample260709-cvdvbacy7t
SHA256 f0010c7e2ad3563252bf11473fe59458fa4874b3a053ee6cfc0e2e454a1d6af3
MD5 25045c264e92c9b1a93084a8d8c9e8dc
SHA1 51460cd9f44086158031695aa02e94d9a05cc1d4
SHA512 26624cf0d334070f668219b942a20e3bd73d60bcbaef642375b271fe7bdac903fecf4d7638c9c27b511b14cca6b0e9d2ed8a88eadb5118a07c9fd624decc1056
SSDEEP 24576:Q+8DOeatY00qinBToNiSnnrFb4PM4MYgLxEVyGLB:Q+ZeayhqiJoNdj4MYPVyGLB
TLSH
T1FB75E02176E18072E9F72A3018B4A7B55A3EBD305E34D59FA394167E5E31AC0CA31B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1904	elevation_service.exe
1144	elevation_service.exe
4824	maintenanceservice.exe
2584	OSE.EXE
4544	PerceptionSimulationService.exe
836	perfhost.exe
2800	ReFsDedupSvc.exe
5548	SensorDataService.exe
3264	ssh-agent.exe
5592	AgentService.exe
1732	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\fe9a6a72b9871ed5.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_121500\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_121500\java.exe	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_121500\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\ExitOut.exe	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000026211efc490fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000055d325fc490fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d604a1fc490fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006df16b3c4a0fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000002dc7f5fb490fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000042e048fc490fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000950d903c4a0fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000050449c3c4a0fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
800	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
800	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
800	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
800	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
800	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
800	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
800	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
800	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
800	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
800	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
800	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
800	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
800	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
800	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
800	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
800	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
800	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
800	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
800	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
800	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
800	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
800	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
800	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
800	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
800	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
800	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
800	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
800	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
1904	elevation_service.exe
1904	elevation_service.exe
1904	elevation_service.exe
1904	elevation_service.exe
1904	elevation_service.exe
1904	elevation_service.exe
1904	elevation_service.exe
1144	elevation_service.exe
1144	elevation_service.exe
1144	elevation_service.exe
1144	elevation_service.exe
1144	elevation_service.exe
1144	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	800	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeBackupPrivilege	2800	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2800	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2800	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2800	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2800	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2800	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2800	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2800	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2800	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2800	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5592	AgentService.exe
Token: 33	1732	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1732	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1732	SearchIndexer.exe
Token: SeDebugPrivilege	800	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	800	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	800	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	800	2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	1904	elevation_service.exe
Token: SeDebugPrivilege	1144	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2360	1732	SearchIndexer.exe	101
PID 1732 wrote to memory of 4660	1732	SearchIndexer.exe	102
PID 1732 wrote to memory of 816	1732	SearchIndexer.exe	103
PID 1732 wrote to memory of 1956	1732	SearchIndexer.exe	104
PID 1732 wrote to memory of 4780	1732	SearchIndexer.exe	108
PID 1732 wrote to memory of 2340	1732	SearchIndexer.exe	109
PID 1732 wrote to memory of 712	1732	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_25045c264e92c9b1a93084a8d8c9e8dc_amadey_darkgate_elex_hellokitty_luca-stealer_lynx_njrat_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:800

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1904

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1144

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4824

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2584

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4544

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:836

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2800

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5548

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3264

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5592

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2360
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1590476978-4004838454-3790292847-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1590476978-4004838454-3790292847-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4660
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:816
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1956
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4780
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2340
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 240ccb290986404d31ad78e9c7047bd6e908fda83c0686db8ce2bc85777d0697
MD5 30f5d28188e076505495ddacee2e4e8e
SHA1 cbfd7b568af8bc15d16d62ec192e8dcbcacf9ef8
SHA512 a4320c0dd69e1edc3d8e261538011ed3bffe2076921f290cea926bc9b52c8081696c67de3b8a165ab63702cb3bc03608da565eecc8257ff7ff5ce6cb9f7ee7eb
SSDEEP 49152:Yb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnOj4MYPVyGL/:y3q6HjB4VL
TLSH
T1B7D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 2e437542413c823b80f2e11f20165a9e4531291b3a32570d82890bda7ea2dd47
MD5 443e2acb840c91503f827e8dd52c78e2
SHA1 fd767de61c96ce765f6267103744d0a3ff478ac2
SHA512 ebca1462c786ed6a0eb8d877fb57062097d07d236a4a82d7371f7583bc62e0ad2a658416d2a682637cbe75fb56084c299c28fda3cc26a47bfa8eddd08280b55e
SSDEEP 12288:51XLsswWkxy2lRq2czAz34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9c:XXYfDtczAMSnnrFb4PM4MYgLxEVyGL2
TLSH
T15A65F12977E408F9DD6B8278C8A28555E733B8518760F78B03E499662F333C85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 271d6be7068f39a1b05b458a2102f2ae2e26e148a54a8f781f4d2f3ed94b24ea
MD5 bfe2f800f3eb95ff926cb5b0cd16ce94
SHA1 ee7ffd7127e05526de6bc480864a99b680404dbf
SHA512 d921cfc481597adc24b6576c708409505b7a30dcf989af7a802e5189065834d7d297f1c226bd2d447bb84a6b89efcc352dd61889ae09f293cb89cac4bbf31d11
SSDEEP 24576:r0Le5ji0hmxirMNSnnrFb4PM4MYgLxEVyGLp:rPji0AcFj4MYPVyGLp
TLSH
T1A0859E66F6788375D073C0B9C5D2A68EE97130825B308ACB4286D77C3F676E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 593cf08f9cd26d13b159506e3ab92ff6bb116482b78d008d35ef0ab534b0bf27
MD5 3e2349d5d014d2cce1c4f18b9626f60c
SHA1 8ba097c2d0136f543e1f636bf3848fa54e7987bd
SHA512 c48d20f33b9e6dbe41fd713b0c7582733852122b31d7e77d3cbdd901920a6f146166b5d943346f1909349540aa04ff059208b2c8c4d35cf20c54c1b42c9a19e7
SSDEEP 24576:Za7/ezSC6vUyD/aqgrvWE6q8wyuvSnnrFb4PM4MYgLxEVyGLb:I/ezSC6vUzPvxHjyZj4MYPVyGLb
TLSH
T161755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 52d2053c2a714224a89ecac85920cc078d9af75f7b1ae1c13e81c60282fef119
MD5 7cd40d2a0d57366981ae81e4f7c0d81b
SHA1 4d4d8875a89fc1a15e610bc42a804e4d399c607d
SHA512 2440b393cc49542bf71670288f55dfd2e43d887a77f158e87d172b37f4dbfdf60643c80030b4d17f24a9e15f9fc5f02082e102c0fce40379e9bcb5154590c901
SSDEEP 24576:dVbqPb88hv/l+64SnnrFb4PM4MYgLxEVyGL7:dVO88hXl+qj4MYPVyGL7
TLSH
T197559E66F5B48331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 3dfc4fe909eb9bd3d6c8ecc12ae9e6643c731588ba4a7c5c3aff205da8927aa2
MD5 b08e803c1e9102b54bd5f83d63015532
SHA1 87022406ef59c76989667ef0ea6feec3cc6c97c4
SHA512 3a69ad43f9a9bc97f54b69747156ab084730ce884e970e0d2f7c20c706fe2836bb1b2c7699d268325a6c24d9c83e1d22a05f099aa100e7928596f3e013c92af7
SSDEEP 12288:nRK34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilz:nR5SnnrFb4PM4MYgLxEVyGLV
TLSH
T1934523A76BDC10EACFAE15B0D1B96AC8E2057C61F875B20B6751785B3A3F20DD891313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 a8b6793e677a714b41972510ac5552971aaf34b0cfc502ef9af82e07dca199f0
MD5 a3b22a8ec081403b467458185b705266
SHA1 ee0a8ff4e22541bab2888600dd4a74b0744bc0b3
SHA512 b2251b76a21d99106e5cbc0a1949b450b57206eb2c36d3973a65fa2757b6a4b120e94a67027860c24b2cb06c64d1ec441be161bf9789ce79f20d586bd9b1e4ee
SSDEEP 12288:4eBNUbTVO86Uv34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il7:4JIUwSnnrFb4PM4MYgLxEVyGLp
TLSH
T17D65DF3BEE28FCE2C67E4DB856918740E77278308F62A3CBD165820E9E235D45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7b695013b925a5f18ceb4b74ed9d8b6f1587b36b1a97b8ca1e1ec89aa312034d
MD5 502030fdb77124119c0bc6fb995b230e
SHA1 6464a29b4fcbc364141c90802c8c4311b56b8e05
SHA512 a99a7af4260582221eb87a4258ec98b95d71dbe3251e43728091ee4b4dd5444f1d405bee568c8793a09a64adb30cf77163ce101323d5b3b99a6291d780e684c4
SSDEEP 49152:vQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THe:vQvGAdlCEL8c/yRNw5CFV9
TLSH
T16A267C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 c629a6a8cc54c7fc74547227c26c6294e22f1b9ea5ae0145e713a9cf78f60a24
MD5 47ba70b53efb4d795c5df87cccddb752
SHA1 769d3645ebb985eb43c60ed16aa06fcd63c69222
SHA512 0352fd90f5c0c81676c3e72e07b945ca31db9dadae2f9d29ba79156d579b30c3d2dc7963fee43b89c707bb94147717345a7415d021ce7e54dfcba6c5f1b98cd3
SSDEEP 12288:cAwSfxL/2Dc34DLLmt0LDQewsAj934XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeA4:BdewsAj6SnnrFb4PM4MYgLxEVyGLL
TLSH
T1AF75E031FE74E036C7BF0DB21B36D706542DB9204B612AC3E3A89D9E59342C26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 6766888950c83bc561dc254bd4f266c5a77eaf262d25ece24a0f9bfd16406d84
MD5 4b25ec1ed853d1923c5a3e58c6b83795
SHA1 1f9ab0afee1da4f49f7d51e90573ad8eb3bfcfa3
SHA512 693a26fc8fc5f475e8f28a71aab091105e3918a3ee163639b07ab4f1550e77307d7192eb6207370e3b74c16cd10150e3194f1b66a8772f6dcd7ad27b84a06fa0
SSDEEP 196608:hUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH:hUEtQevvqc2W1cpV2EI32
TLSH
T1DA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7c357a45c12592dffc982ae06f815bbce95559b8c7ed0d26a7a73ca7495b832b
MD5 9701b42caaf821e5acc30babc745dba0
SHA1 d0a5781e0b3924e9a353850c1833005b321d6fa7
SHA512 90c75c7d4adb54b6d57fa8e392289400cb80a12d5c8fe5b0e8abcdd218030026b7dd6d07fc2d5d3980adbc573fe03606aebef8a9daa303e97c0dde6e5e42e666
SSDEEP 49152:wCbRquA/m2yL5zQfFiV+XenmE3/zVj4MYPVyGLj:ZoqtVjnmpVf
TLSH
T12ED58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 21f47c314454bd95c05428fab1af8758c50228a7751da827dd4fb78e22f2ff44
MD5 7d0b1a39dadc6e5d77d0d0c62e7d7342
SHA1 a02b9d471828b2a38b04a2cd90967626d85cc557
SHA512 475e7a3b3109e8c9443cad05ec6981f0cf3200e94c93d637feabc9347cb05cf1e1fc260b40d0eee57bd8cb4975b6a57a584c070a25c223a7c1cbb5f4714d9d48
SSDEEP 24576:vAhGLJIFoiwtA5l7S53TSnnrFb4PM4MYgLxEVyGLp:vAMyFoiq5sj4MYPVyGLp
TLSH
T1B135AD81EBF955D4F5B3AAB899B68170EA76BCA65E31D20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 4a99bf18f655bbcdf8fc141acd8e9d994d5731c7960b8f6a7e5fe6c5fb62ae1f
MD5 72a625139e23a46a4a0106e148a02604
SHA1 6876689e5495b0cc6bd9f55f4396033bdc461b84
SHA512 57fb2880e5ddbf55ac8caff772f176c2af18ece485d990c93f2bda120d3bdc7df1971ca9616299bdced0d52275a32ba8912e71c3b376552fd3224cc8156442ba
SSDEEP 12288:Qmw5HEjsChNVBFgl0WDm+CE34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqv:NwuoOWeSnnrFb4PM4MYgLxEVyGLl
TLSH
T1E965F14637E81CF9EAA74238C5978535F7B2BC122A21D71F1760C65B6F37311AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 c1af9586cdcb69857e2ff90ad8281e0d31268249119e21c85e01f8e630b959d2
MD5 2b68ce2bf3ebe4763330fed059a665fb
SHA1 54b7fdfb1d9fda6694b33670ae82f76c1be22e9c
SHA512 37aae2cb4de1bacafcb4b643feba142d14d37832634a6f20677e1b0faa4b72f292f7a197c3932d10fa5faf549707c59bf9a1b0ca9c2ec667ef4f5cd1f582f622
SSDEEP 12288:5BZ1Iyt34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilU:XZulSnnrFb4PM4MYgLxEVyGLW
TLSH
T1215512AA37E820FAC6AB4274C4F55688E3327862B77293CF1650555A3F37AC55C35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 123838ec7397edf4f03251efc6f76f23c5285d77b658ae72348bb8b39da96c3e
MD5 717d2c37892a323d1fcc4d9c638fbd78
SHA1 fbd22ea145d8322b6b05c5a294b615b4667b65f6
SHA512 a2c899490411f358135939391b224dde636906795625e9da4a8d64dc303a85fd70d314e6b58bf1324b890f8deca2eef3059f161eb52bfed12c9f7d8a05c7b616
SSDEEP 49152:7j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ua:qQRQyi36YOcPQLvw2gAf+PN3EVx
TLSH
T1B4667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d407129130407fbdcc5178ab1cc2932e2d690503a2401a8866511e65c47525be
MD5 d1025cac111b3b0a66979a1b369284c7
SHA1 6c216046da97400137d5684f341d122651d4bcb2
SHA512 5576e5796ac940e618da98fbf3599093bcf38ae3f05279afa6e793234ad1c0e4f9b1a8444e68f07a135cbe2ea563d6da2358d5fb665e3c5038604aa4d2f79e39
SSDEEP 49152:cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U+:zQRQyi36YOcPQLvw2gAf+PN3EV1
TLSH
T170667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 21a23dd3b504a3a5d9da5ca0f447d2fd493b2a151dfe55f7bc9e71a03c23a25c
MD5 5c5469a88bbd607739c38f6c63a255ea
SHA1 1892849195ab27ae7be4a4f62b59319910cd4357
SHA512 f252a3b090349a938200aa2b34fd568d6bdbc1f0ec04b29ec06f3f49861e5ab0759905dd7bf4125a81df43ac3a98a62fc053ea64aad631ccdaeec39cdb0c05c3
SSDEEP 24576:ywvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL01SnnrFb4PM4MYgb:M68Qg55nhheWu7PNU3/Fj4MYPVyGLw
TLSH
T19FB54A33B2F600A9C44DE1769F4A972196D27C71CFE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a9000fbf763d4066c231f980acbb6a0867c9dda401408bade46a8bd47b0d8cbf
MD5 e68bb0c4dc189df57055b538a7452569
SHA1 afb45c5b83bac6dd3174746617d1f11301c13ef0
SHA512 28856e585af2f1215cf6248172a12741e55a010290d16502a93c18734f07db55bb602419aabeed9483377306318e74a3d1d3742d8a6658e5d276ac81e63b6e4b
SSDEEP 49152:J3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99O:Yy5112gYy5azzVvL69nLKnhZDVX
TLSH
T1E7167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 3d526c18b49c3ed0ef3c5e8a1060e9cf563d7ca347aaadf0bb79d2be16120e9f
MD5 4b28b1c5ef7b80cc1b62e20df4b8052e
SHA1 96dcb9a6565e9a117df6c18d794a29ceec28a16a
SHA512 8f6eddede8f64e7bd4e9b7d3e7860a5a352143a271e899950f3201dc5349a8cf9a15573aa60decb80d5df906aa727438c8566b659d9bc131a26243f35f7bbdd9
SSDEEP 49152:BB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glPj4MYPVyGL7:Xu6JmVxd2dMVP
TLSH
T1A7D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 29503fbcdda97d996ae4437e93d196358c3097f8899dc437e1f12ccc141eb76e
MD5 c5a82f001ebfbbeb264c01a8c22945a4
SHA1 110ac295563f8ec545a371811a86bae7177a8f00
SHA512 a0aa629a0d5c6d11332c02251643357364c60070c1a93b2d80c68d2f016a670b5d90abdc8d6cb607397c8abe6e6ffbb9f2905ba805a73c02653e741306ba1271
SSDEEP 49152:V1hpsNoJpF1A6UU44CwH7R4xjj4MYPVyGLg:VmifPbRpVs
TLSH
T1E6B5BE13F2D900E8D06DD17887569232EA62BC460B34B6DF0A90B7962F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d9dfa7aa0d14a0328a8cc6749326a990159ee26ec72e9527cb2ada6a054acde1
MD5 f84d9640a0df34d9b32d5c584e09cfab
SHA1 6b756891cd315f48e4bb70ec92e178f1bca88ccf
SHA512 43d36df40d3b7643a9fc50d12a56a66bc74d54724cc7b96ae45b6dd22ab3f102b3728bf1e330c4c21885e23ac136ba722eff96939f94bb6f24b09238e55946da
SSDEEP 49152:bSuZQIY0Be2KRRVtOnks6NMHq+j4MYPVyGLq:J5dKTi61/Ve
TLSH
T1F1C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 fb76bb3c9c0f9489deb723e0e1c54db030fa7720b411851b835a558d8b908298
MD5 cc23e0ac43907557565381318c886d4a
SHA1 84bb312ef4f69c14714fd45fb933da7687397147
SHA512 1b7afdb5cc87accda0afe5c08d996bdd7820425828a0661d7f70cc283c23d849ca97ba399520259f2c9c36604654dc4c050f2a8e0e8cb14265752c8391a8823e
SSDEEP 49152:0htSn8EApI0figngiDn0AP5w/j4MYPVyGL4:VX2iyphdVU
TLSH
T10C95BE13F2D900E8D05ED174C7568632EA62BC160B35B6EF0A90B6562F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 6784eb5af02dcdd0811e95299acab2cf887861b31f3bf259a3d68b7a56d32249
MD5 a72f0bab61b4b6eabece664712a1b38c
SHA1 200f1602ea792bd5907a25a5657cdc7bc0b140bb
SHA512 48008d028f945604bdc6a7728cfbaaed7fdafb6acd8357a45d3afd2eb3d3268e3e525d2c373ef45ae179e1bdb3ec07c3805c475150b8632b5d8d78cf190454a6
SSDEEP 12288:bi34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2iln:bxSnnrFb4PM4MYgLxEVyGLB
TLSH
T12B4523A62EDD10EFCF5D16F0C1A566C8E2097C62F976B20B7B4574173B3B20D5892722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 12bade69b82249143919ba3088ae687a6d0d8a3954ae9cd86b418d941b8f4e07
MD5 349ec687aaf776ba6b2c0b112da242a0
SHA1 d16f747cc4ca01900580c514175d49067695781e
SHA512 0fe75387a8dae7496a045ef9b91c18c412662e1a5e468101c378c350fc28e10ea1dd08192493bed3dcc02b708cffef8210d75e939d8707ff9ff58f432bdcdf80
SSDEEP 12288:PB34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ili:PGSnnrFb4PM4MYgLxEVyGLw
TLSH
T1BF4523A62EDD10EFCF5D16F0C1A566C8E2097C63F976B20B7B8574073B3B60D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 b6c5e1268856b48cc1af7df462a8023e6e644fe828826da87b768eacb2666009
MD5 e1c1473ceaf8253742c90857874c7f87
SHA1 efe1bc0e9e85ff31228360bb40d9e70b93fc212d
SHA512 354d6d3e8b0360cfa4e2dc62ca8e39b504da2ccf3645c3ddce32d10fdd237233bcd6c547ee073ae58943dd283799c57fbacc2145a38b7e1d6fa4e7d44c426f10
SSDEEP 12288:WH34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il5:WISnnrFb4PM4MYgLxEVyGLT
TLSH
T17F4523A62EDD10EECF5D16F0C1A666C8E2097C63F976B20F7B4574063B3B20D9891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 b14176658f40be000ad6aa22e2406e8f228496724c23659f80833c5777d25a27
MD5 0d235a954ca43f8aad270dc68428def9
SHA1 053d9669714c873248307f43e2e3b9c530b8f9ef
SHA512 51aed64e0c19b7cce242a90bee6ad58f5f16ad9031476372cb25d289f3209e8ff08f034031df8374bac07aca2305ee326b05a155c0f33d3c651abf16dd836763
SSDEEP 12288:zVg34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilr:9SnnrFb4PM4MYgLxEVyGL9
TLSH
T1FD4523662BDD10EACE6A96B0C1B556C8E2257C62FA72B35F6740381A3F373489C71721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 8b8718ac88c7fa2a20d9be0e6513b6508a3c3695ab146384dd06d4287bc6ded4
MD5 4d10fbe1b10df13eaf57740a49501f1e
SHA1 765e7933c522cf5f451bbbf1c5674ed1f1761541
SHA512 fe8c190fb39c7b4041836e00396bb283cc58c52c48be4c523c076695b7e44701f1b8bcf16dd1b7f6077503f0c8168b869ac527c75d2fda5a8ae3940ac9b20ba2
SSDEEP 12288:hI34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilU:hbSnnrFb4PM4MYgLxEVyGLe
TLSH
T12B4523A62EDD10EFCF5D16F0C1A666C8E2097C63F976B20F7B4574063B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 7f0e113636869109fc3bff115ec3c30692b1eae2b0283275c68414a170d6e106
MD5 7908fcbaca7ccb82bc6061a92cba3641
SHA1 77a3168649aedd7d695d938eea3ae8332ccc0309
SHA512 6b5bf1711ffe6ed4f18df90a11c08486a610b4e08dff0c167acfe7f7e314afe1bc2c9d4806c22beb5613f1550190586a4ccdc4f9bb2a2b56669b9da059b211ff
SSDEEP 12288:NV34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilf:NSSnnrFb4PM4MYgLxEVyGLV
TLSH
T18A4523A62EDD10EFCF6D16B0C1A566C8E2097C63F976B20B7B4574073B3B20D9891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 0139ba0fa05c75730684b965d27d046cc6fd73a429d8d42c79011ea008c7d1d4
MD5 28705fb446147f663e4159ecedefed56
SHA1 dab7cb1b5b988fc5cb24fb0ce44efcad70e9eb60
SHA512 8aa1a2755d8a1b454fa4d1fc3f466443709c9ef152aa7e0c7cfe2de6403b53beddb3ceb10bc843ac7387c813dcf1cb92efba9d83f89f374c27583bc12281c765
SSDEEP 12288:Op34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilI:OuSnnrFb4PM4MYgLxEVyGL2
TLSH
T1674523A62EDD10EFCF5D06F0C1A566C8E2097C62F976B20F7B4574173B3B20D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 4b10967e83ce5942f95a8d722044886e88d1a1a7a4a2febd53a986824b7d62a6
MD5 faf4936fcb1fe8e20175c83fdbf18916
SHA1 8c388a68ca21e57b16028d68ec7764cc767b6a9a
SHA512 de1bce546488623acfefed141498787bce977774f60dbf921d62021c5d23231fd23c0c125dc408e9a6aadf23d15063997a9ff857019495f30fc1e0fc15f7cf86
SSDEEP 12288:niZwb6zzFEoS2cPvyh34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2k:iZMSzFVSOmSnnrFb4PM4MYgLxEVyGLh
TLSH
T1CF6502A5739418F8DD67823EC9658945E2B27C265B70C61F13E4362B2F333911C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 5aa1ad7387877d333e32e84f12d2ba0ffe790413fb0bd33af4e40c1e05d57eb3
MD5 6ebb2e481025ad31fae18b3a43062be3
SHA1 f6bed0dd4d6946b3d61808d77abea446de11944e
SHA512 fca055e1eab89ed0ef7646da3a18fba5155a97d515a5d54f326ca66a22bb5f262387b964fe667c8b4af1f04b0a4813a6a032e56ceb2fb3193609b542ea719396
SSDEEP 12288:ke34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilr:kVSnnrFb4PM4MYgLxEVyGLN
TLSH
T1544523A62EDD10EECF6D06F0C1A566C8E2097C63F976B20FBB4574063B3B60D5891762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 569187df291798e9c0c143c8cea08d97042f799aaec198c97fa1ad019f766298
MD5 361a0bef80b6edd66a46c1d9ae368a93
SHA1 145142a88d2f2b2cc4c1c3fd84966c1127a2e9be
SHA512 90bba2199e4e65908900e04d10beb05c158c30d8ed19191988168e944ca7e5933c1386ed59e04d27b25ad63241fbb38fcd0599afb867dd7bb65d15e36876dd70
SSDEEP 12288:c634XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilFk:cpSnnrFb4PM4MYgLxEVyGLDk
TLSH
T16E4523A62EDD10EECF6D16F0C1A566C8E2097C63F976B20B7B4574073B3B60D6891722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 9a5432b0fc527ca7c317cf717ef508385f52939518a7989b7f97f08ed9d6050f
MD5 bed5c9bb88fcaf2cf23284d3ece910d5
SHA1 94b1c944cc24e18bbef7888dbb496fc865924e12
SHA512 e0b9789462e8bb9d8f00972fdb786190c47debaade3667e1a8de0b112819fc543dc32b7dcb70b32665b2114d1d48adc5a8118bc9df44d3d578a4638f948e2d7d
SSDEEP 12288:tyPz5L8t34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilc:EzyqSnnrFb4PM4MYgLxEVyGLO
TLSH
T19D55025737E530F9C67A8274C4A21A45F336B8329B309A6F279016763F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 5c18d7ef8c86b8d1735f40f71b2d9fc109a54d42ba717b3523bb2a01b2cc9a5d
MD5 99cd4f508387429a9ea4ee4a8808aab4
SHA1 98f024fe6d66d1f68895304e3273960ee12781c1
SHA512 48daec5c23ae36253d9b6ee6728469fd175316f5767674050e3dcbcd107dee50ff8322eb4650ef07351680f7bb203e9157a4cb71cecb3cd3544b74f49f99aaec
SSDEEP 12288:Ne34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il5:NVSnnrFb4PM4MYgLxEVyGLD
TLSH
T1794523A62EDC10EECF5D06F0C1A566C8E2097C63F976B20FBB4574163B3B60D5891762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 69460a6545d1eb83a85011afe7d62abed5a8f339b7982f542318368f7dc8a70e
MD5 fe9772d55e18e8d1d5c5c411b5063981
SHA1 2ea987a3b54d357e6d8f5a3f11801aee9ebdaa6b
SHA512 0d60d5c3ffc79f9aa81311c834929c3d60a020d874a92e01133176dcfb18e3d98c71faafd0010e8ce526366bfdab17ec2c619f4aab8964dd1e9dc05da43338c1
SSDEEP 12288:Ce34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilr:CVSnnrFb4PM4MYgLxEVyGLl
TLSH
T14E4523A62EDC10EECF6D06F0C1A566C8E2097C63F976B20FBB4574163B3B20D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 f6a5802f7c1a14786c2369d0e1f79befcf0e0b8166e1b6209448bbbc475e432c
MD5 c4fd29fb12c088ddf2aea0924e2ade44
SHA1 9d8aab5f937d473c25c1752269e0ae398a0b4db7
SHA512 151e11422e39ea4c7ba98d6b21d6ffb4f643d3031f1e5031b5377c92489e57ea8a46e2e82575b7c4eabad972cf4ffaa12db68216ddca1772fce753432354f40b
SSDEEP 12288:WyPz5L8t34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ily:rzyqSnnrFb4PM4MYgLxEVyGLA
TLSH
T19355025737E530FDC67A8274C4A21A45F336B8329B309A6F279016763F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 55883138e1186cf7712aff53a7515d79e2a4ef0f68afb3335fc1b7999939fe73
MD5 c60b9f9b7d2ff82f16c681f7cde78714
SHA1 6b9181b0a4a4a84a8dd5aaad1a0db8c6693b5411
SHA512 50d787f646d363ce6e1c1cb89d489d495bfeb869073e9e7e4e8ddc016faa4bfb984605941f079ab062cfe6524866a550a4fca438527aa4870ae1d3165bbd9230
SSDEEP 24576:xTHaLl3z0zDYSnnrFb4PM4MYgLxEVyGLk:xT6LljIj4MYPVyGLk
TLSH
T1516502A5B39018F8DD67827AC9658946D2B27C265B70C71F13E4362B2F333911C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 59a2dfd1e34259ba0f296c44704dd4b782ccf5a27837d7aed1416fe4d2e3ed1a
MD5 04ab220b46e5c99d5254bfbb45f9018d
SHA1 50b919912977286b5c64947706136f6db4f3b4dd
SHA512 958653c8bbd78af029a13f7e1332bdefc9f265739edeb137f72d96eb7bfac434a901553ce04d51d59c356f036aa097bf4992db4860fd9f75630082426e6cb33f
SSDEEP 24576:t37d9CHKy7GZkSnnrFb4PM4MYgLxEVyGLE:N7d9CHKya9j4MYPVyGLE
TLSH
T17275DF90F3E810E8F1B79A35C9765501DA767C6A5B31DA8F03A4251A2F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 ca809ce12b45a86c2eacbff7d65bc873d96d6d799588ca6e250b0b5c27a57ee4
MD5 28775ebd55475e5c2463c13e8d6541e1
SHA1 cd1d415e5d7a9ed89556d254d998a28567198fd7
SHA512 aa3d8edd853571fdccf09dfeecc0b77a3d6f07bfa4933ae3ff2db07ccf29b9d36d2a1a582772b1b364f1010d7c3e5848cd12a485502e2cedbef8d5241fb15434
SSDEEP 12288:9n34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ile:9oSnnrFb4PM4MYgLxEVyGLE
TLSH
T1044523A62EDD10EECF5D16F0C1A566C8E2097C63F976B20F7B4574063B3B20D5891762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 f116673b98674ab306c7d87c18d9e0ad21bf7e67f95679cfbfedbbbfe1d6fcca
MD5 620bc68e3b5464064b642e297c32f83f
SHA1 eccd7a12b0e113df4f09b7752c719a02228bef61
SHA512 8f3cbaf96ed4f9784474996a854c94ce80fd85cba4bf2dffd3c025425db98b16d8ff87fc15481b1efa17e1279eb0f94a6aad4fde23b74fbca17d5c4e770d0912
SSDEEP 12288:mN34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilH:mKSnnrFb4PM4MYgLxEVyGL1
TLSH
T1CE4523A62EDC10EFCF6D16F0C1A956C8E2097C62F976B20B7B4574173B3B60D9891722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 312d684fee64bb1a6b5f00d5ebb2b30e412eec97aaac2bc484d4f83b94832049
MD5 2f7fed06c6ef433c9fc5363c8fa009cc
SHA1 aa9dec9e9dd2636fcf60136363c2bc210ab8bcb9
SHA512 ee80a7e4e754983d8380171b8a1783e1e3b15b14eddd52c6ad4f3807e2a261e4cd2c17d816a89d89b363bccb9dd71d0aeab9619b260cedf2e603f7bb72bf1eb6
SSDEEP 12288:xs34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilf:x3SnnrFb4PM4MYgLxEVyGLB
TLSH
T17A4523A63EDD10EECF5D06F0C1A566C8E2097C63F9B6B20FBB4574063B3B60D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 27996dc5697e366b953b5dc6ee0b6b7ff0cd042f8c60130a3ee3302e6cc80415
MD5 2c62dfadc8062a2aae0b57f6e239138c
SHA1 737e0a09f08126238e43005d14ddf57eb8fa7c59
SHA512 dd95e9ff556796e21dcbeb50c72ff69775bceb368a79053b6b639c2b499b6defe83bdb990664aa1fcdf8ade2abd8db3977becd2322a657bb63c6ec59337bc4e1
SSDEEP 12288:9e34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2iln:9VSnnrFb4PM4MYgLxEVyGLZ
TLSH
T1F54523A63EDD10EECF5D06F0C1A566C8E2097C63F976B20FBB4574063B3B60D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 56a0762879e05786296c7d4967335e1a0eaa01db9a9aae280820e2bf3619853d
MD5 828724c407c876e41cad30b33a44e323
SHA1 992f4d983ffe8d1af69cb1e7ea8ee152654ae0f6
SHA512 197e90a5e04960c620f2dae1b0dede7d90c35c509b1c714eeae5a779ed0c9f0ac5b537c8fabe72b7c14fe373cd736e64a38969ed0fd8c898ce717363aa1a79c0
SSDEEP 12288:in34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilU:ioSnnrFb4PM4MYgLxEVyGLW
TLSH
T1744523A62EDD10EECF5D16F0C1A566C8E2097C63F976B20F7B8574063B3B20D5892762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 762b36341c5e83b8e45b77bfb1ac75f4e3ca4a9685489a11871b0cface857382
MD5 c50fce633e4eb7cdb68fb0903462f5b2
SHA1 def162c5241a6d6e0ff268756c75d02613881a84
SHA512 2cd28c0eddd75c99582beeccd6fe201d3281698df8ee085a9afe81b2308ef84bf1e89db774ec99b03474d300a238cf3de3ddd6869255965fc30417bdd84776df
SSDEEP 12288:3m34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il5:3dSnnrFb4PM4MYgLxEVyGLr
TLSH
T19A4523A62EDD10EECF5D46F0C1A556C8E6097C62F9B6B20F7B4574073B3B20D9891722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 64bff0cfe9e2eed6aba040823f2d1dd4e82c2bbe3432a1ea61b900b9856a20af
MD5 d4905cc9d2da1688bdd04c2ac766225a
SHA1 cba7d9d15f0273888472a82a9f4497a3de7a1bf9
SHA512 31c454ab0345990522b65865c0538da1fe7391c1797fcda55c0ee76b7543e77657c5ed18ed95525271385eb833c7205fd2d974e19b4c7069fa90b6d2502d17f0
SSDEEP 12288:DI34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilF:DbSnnrFb4PM4MYgLxEVyGL3
TLSH
T1F84523A62EDD10EFCF5D16F0C1A666C8E2097C63F976B20F7B4574063B3B20D9891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 d5e2d123243d325c0ffc6523a9e22e9b02b166b8399259da985e313820f2eacf
MD5 5d2bb013ceacd838df6d866b772fdab3
SHA1 e37b270cc7e245aa7f04fd6e2e9601766b5722a3
SHA512 84b8b6cd13676a6df91e8c2880ae498f11c4b5d321571881c713d2e6a7bea9c60b0ab05725426e90ff78a2f7e4269663a8744a26badcac0da703d94c462c16d3
SSDEEP 12288:of34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il1:ogSnnrFb4PM4MYgLxEVyGLL
TLSH
T10E4523A63EDD10EECF5D46F0C1A556C8E6097C62F9B6B20FBB4574073B3B20D9891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 c15eba3a65f2eadc14b4b0fbf3ab2b0e6cd620d4922b07802dd70fdae3cb3bc6
MD5 351d52bc862a916c9021d639b808f3b5
SHA1 e07ce11b43186875697d3519e2a8e293378ccbbe
SHA512 a677caf39613d3ab3806cb12b57ff4843e4f36c4d69da4527c7729dfc15fcdabff03768ec4b2ff51c9c5d0ee9cdea3bd58996248004f69598a56ce2eae64b585
SSDEEP 24576:7fwvok9RX6wkyAIZSnnrFb4PM4MYgLxEVyGLj:dMnYISj4MYPVyGLj
TLSH
T11A85D029EBDC04E5E1B7923C89B3460AF2B178695B31C2CF129A536E1E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 bf308174750e24887dec406fbceb865255c22cf69dc0bb7fdc922a7e881a7905
MD5 fbe609d8280917f1539c363cfe8ea070
SHA1 5e49a0a0af4698e4e4c519d032f4b86d5714d3b8
SHA512 be01955a4ca10443cafc810f6dc9b032b8f5dc965642d2315e5d4f73c8a29cd69f8d84d04f07968f71940bd96791620659d8449eca6223b2eac1a1a3088f1680
SSDEEP 49152:gYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0fj4MYPVyGLB:OySzPkVF
TLSH
T1D5066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c3eee6ebb7526c9bbb26d48dea0de2e93c0d334e208a0a8e2fbba33720181ae1
MD5 04a5b2c9bd670c8c282ec71c6d4b2f54
SHA1 8a4a710fd1b20e73778fb879029d670247e3cb0b
SHA512 0c0599b0ce60e18ab75d12568538bd8377eb444fba63ce9fc6d43faf6a0ffc510759e3691da52e3a5d82c2e751acab02b7aacdd02e93f13ec247a9349eb996af
SSDEEP 24576:+47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYWSnnrFb4PM4MYgLxEVyGL5:+47JUQj1irIhCnDHUPfF/Pj4MYPVyGL5
TLSH
T18265BE1EA3EC01E5E1BA827885154A5AEA71742E5F31CACF2270837D6F23EC45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 e29057c365cec75d39f8cb63ad6fdef7195929f7bca695df993db54b20977950
MD5 b3f4b33919922efa352d305505bf1a43
SHA1 1adfac41bf25b5c8f0e80b324501f2bdac14ece4
SHA512 78a2e2690ae3c6446ba7c690b138cf293a0fcd88f0c68e1684769a76ef5b4ba3d2035af14bbfbd9df84ce5c4b0286dfdf286301c18dde63330c39b1a0f40e985
SSDEEP 12288:xNsfu34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilZ:2lSnnrFb4PM4MYgLxEVyGLL
TLSH
T1F455F15AD29801E9C56E6271C3565A84F3237C21A7E1E3CB67C0F43E2F366849DEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 e85c0c3be3aa8e49ec25f366b741d1e9319ae6544b5952c55be8436aa170427d
MD5 45a9adbcdc20c18ea27430ae6fc9927e
SHA1 1fa9b69f92e4c24e22ec4cb71a1a30cdfd4da7b3
SHA512 fb5b75c2bae1ce712c49288c3a58539181c0c6d2a8aaf9b6c13d8981467f951f8c3ac7421d7c298abaa5d4c082d712c54aa4bc812de94779678e48f39dc0042e
SSDEEP 6144:IsBC2naXbXWootMxqKiNqPHk7SxokxpaGHc2tooI1YP+58aIoTP6lTH1ic2MiTag:JvLSn2OTo5JG1uXTaTDeL
TLSH
T14E451601766AC74FC6AD40325E77D2CCA7707D41EE45AB0772C8873FC576668BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 132fa0c37c69666eb3fa348016fb49ec3d0cd9c2b3eb8a87a0fc31a2751b0d2d
MD5 436e3453fdb582de979359404613c311
SHA1 dfdf2f90de534e1fa1b848c232e4d758c4420488
SHA512 54b0faf903646a2a0490c64e355e4e12e4ea30e041751b32198e11ab53703159c7d9a1c50a6d0ea9ca2b79a2e4bc5b2dbfcb00b002a2967b20d8bcf7d7b7e65c
SSDEEP 6144:5LyaUodh8+8U8EVt2Pd38NcI19YCvstMxqK/tMxqKimn8eG55IZGLV035NT/:aode3dkIG4nUV03nT/
TLSH
T12765E8405136A28FC6BB20B2176A5F4C6B68EC07B7459F2673CC053AD86B752B1F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 7427ddea706a9522a00f424bb7f7163554a4a23b3d217d80417fc39fd35c72d8
MD5 9ef30ca554239f37a1b30802af80d016
SHA1 7b5ca4942c4713a3898497ec3c823d2f6d7126de
SHA512 29ebfb9dfc96372f39aa776bd41f3dbd18009a5719d4e532df71435467a4261a21d16d5adc5c6842e1d3ce0ba35f705c4917c744486a206c6af9e15338cd549f
SSDEEP 12288:hM7234XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ily:6tSnnrFb4PM4MYgLxEVyGLg
TLSH
T11C4523722BDC14EEDE7D16B080A99698B2097C21FF61F18BB740744A363B68D9CB1717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 430336ca08a80ca2cd4dee7174060193e8abcf4ddd1dd54275c65a400eb1398e
MD5 d0ca25b6c3e40bf857479ac96bfdbcff
SHA1 b9b93f5ae29e892879e80145d34c72c6828d1d56
SHA512 c4a677575dd2a3d9b38cab9924c42a82dfe1b2060900f9ecc6c0bf62e8d0eabe2321223ae61587a0038641a6979e4eaea669e7bd5cd130560ec09b545c90f9c5
SSDEEP 24576:ogb6bmBIi49WNNFpg1rSvFv7bYvSnnrFb4PM4MYgLxEVyGLg:ogb4mBIBhGFxj4MYPVyGLg
TLSH
T16F65AE1E22EC02F5E0F9D2B8CDAA4417D6B278165731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 d86a1d5269498fa33737a518f09fd3ef662b7fd5c17ec92d1ba04100111aa3d7
MD5 136890140b96b35f557e5c7a1286d772
SHA1 1dd951d5e982ef174d9c1fa0bcc671fa5b74958d
SHA512 2d17cfbcfe7c089cb8ef2b8508118d57a7a118b4901f35a5099c94e5a27b4167c7544a861f3555179982881f00869b147e832085524d5aae0f2ec52749d11903
SSDEEP 24576:/G88u8FpJqH1bzria7/mmSnnrFb4PM4MYgLxEVyGLR:O7ZFPqVea7/Qj4MYPVyGLR
TLSH
T11585016577E401F1D47BD138C98646A3F672B8211360FBDF07A88A522F23AD54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 84172d2dab8f6170fc31062a33f7a69acf85578abdb300823955ce4a44b74074
MD5 099eb325893501ec91dba500ddd52625
SHA1 4f12e775bf93e55639f78709150970ab4d2854b0
SHA512 201e680b06183c43a158e53963846639cc67cbc94e1b56f1f234040aa96ed439a4c7b7f115971ae5b27bb92cc286751a1d6329c70d5e14fa86d501d935c80578
SSDEEP 49152:PBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjNj4MYPVyGLq:AG05lO43bbVG
TLSH
T1E5D5CF6A62EC11F9D1BBD17CC9C6460BEBB23815033556CF02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 99886772218a0cb380cef6e42d96c9d2f55987a004777f857e6ccfd52c7a844e
MD5 9080b85324b4839c47efd9399bc5af61
SHA1 c9ea98a44167fe139c5b77cf631c85e4577d6694
SHA512 b9a7cbd3c7627a8f99ac5247074fe1cf0bf7648049f8409b04fff9d997d1da811e2bde10ec4118b7376c985b71fad48f2554c3f71fa609a89e2cbd9260c4f4d8
SSDEEP 24576:Pfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnsSnnrFb4PM4MYgLxEVyGLT:3a5POZ3+Jt2pasx2+mFj4MYPVyGLT
TLSH
T12A65AF5EA6FC01D5D5B9D17CC583861AF5B1342253329BCB122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 045ee671a8b99b25270c229198be341bccc2bdb284744cf8831c2b4cc5e06a2f
MD5 2fbe5a75b5df5f03422c4fbfb9bd1528
SHA1 51ec1cf9da594d9d9cc900fbb33dc7b0f1636281
SHA512 bc9d4b4ea521b5e729d494be602f9917ff73625493e8888c99ef111e816b85e19d699be21ee0596e1b07971c48a4906367f4a1eb5fa1458814aaeb39d14604fd
SSDEEP 24576:gNcwHdjbyQ4nLC18lb/EOjowL7Fk+SnnrFb4PM4MYgLxEVyGLh:gNc/zEOVHFwj4MYPVyGLh
TLSH
T11E858B2623E901E4E5BBE1BE89779646FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f514307c280969afe795d7800b7f79cad0b98f75aa1b17a08947432168bb0289
MD5 b453e02aa4a1db7863d59e78c8210126
SHA1 09479dc08c8418bb7c23bc35a656bc2119bac0de
SHA512 bb2636bf74b4c0872545a86ad5f5c09cf377e498a5dcf1531e79a046c817944085ac02cbd023232ab1e25e12a7a4cfcc29e1f3a1f7b59bf7fe012bc86450cec3
SSDEEP 24576:j8kNvNnaFeYhJNtmZBmgSnnrFb4PM4MYgLxEVyGLl:j8MwBtOmzj4MYPVyGLl
TLSH
T1D4559E6EBAF806E4D1FEC6B4CD238512E6727461173293CB5290C13E1E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 31a2c56effdc7451b2ddb533cfb94202d8468c456c95731e953778545dff38e5
MD5 75b3137dfd431da4bb7d44b23282cd9e
SHA1 1d14eef6ebbbe370a3a46951d72f1ce32d97c871
SHA512 6fa10f1a9033a3fb632bb2aa45a49549ef7031d7042f91e654d03d1eb9271dde77f33ff2c4a3b79d54af11e88792f43afbf15eb217ae0b8a67d6440dff3f24f1
SSDEEP 12288:RHvUrBFrEjwaQF34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilg:RPUr+NQCSnnrFb4PM4MYgLxEVyGLO
TLSH
T1A065E12F26EC18E5E67AA178C5864749F771B8625712E2CF02D0817E1F27ED8BC39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 e9f11feaff3332b4fbb0a3b203ace68b15a885b7201e3b54b8b9109fadec0aa1
MD5 26eb62da38c2b11f6f5c2f37893779f0
SHA1 c275153f3dd1bbec61453fc1362fc5993d6963b9
SHA512 d2e78a280dbe0508d75b6db06d92aa9ee8778f590c095ade1056a41ee961463703180cc778c2ea98a4b6428020001d39dfb7d6f5cbc3aacb61ee658ad1143200
SSDEEP 24576:7D3FHshBIYQgARSnnrFb4PM4MYgLxEVyGLw:7DVHeBIAAKj4MYPVyGLw
TLSH
T1ED75E17EEA9C04E4D57AD1BCC6638A06E77138A9033266CB12D491B61F2BED46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/800-8-0x0000000000C10000-0x0000000000C77000-memory.dmp

Download

memory/800-1-0x0000000000C10000-0x0000000000C77000-memory.dmp

Download

memory/800-331-0x0000000000400000-0x0000000000633000-memory.dmp

Download

memory/800-77-0x0000000000400000-0x0000000000633000-memory.dmp

Download

memory/800-6-0x0000000000C10000-0x0000000000C77000-memory.dmp

Download

memory/800-0-0x0000000000400000-0x0000000000633000-memory.dmp

Download

memory/836-84-0x0000000000A40000-0x0000000000AA7000-memory.dmp

Download

memory/836-78-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/836-79-0x0000000000A40000-0x0000000000AA7000-memory.dmp

Download

memory/836-296-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1144-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1144-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1144-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1144-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1144-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1732-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1732-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1732-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1732-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1904-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1904-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1904-22-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1904-14-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2584-236-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2584-54-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2584-61-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/2584-55-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/2800-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2800-89-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2800-385-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2800-383-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2800-95-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2800-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3264-115-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3264-313-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3264-121-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3264-113-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4544-279-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4544-65-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4544-73-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4544-67-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4824-39-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/4824-46-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/4824-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4824-45-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/4824-52-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4824-50-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/5548-108-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5548-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5548-102-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5548-314-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5548-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5548-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5592-128-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5592-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5592-137-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5592-134-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5592-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download