e752cb2a03e4fc1ad697db0a20049bec4832cb1de919a8a09a3f111deeb3f70b

Analysis

max time kernel
140s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 11:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-16_4c926ad76e2b891d0f2baf514dd81c22_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Size 1.5MB
Sample260716-nz3vsacs3k
SHA256 e752cb2a03e4fc1ad697db0a20049bec4832cb1de919a8a09a3f111deeb3f70b
MD5 4c926ad76e2b891d0f2baf514dd81c22
SHA1 d69bb3a5c3b6b58f5e09bd5a698ee0abf38f3dd2
SHA512 45e3d01fb81b83b5d12dda66c1a3f659b2b5c9222e6802c99455a7e95f4c7f1b294ae3ffdd03d71b32a81b2b57e3756ac935bd90c1e56a866b61f015ff1ec32f
SSDEEP 24576:xrd3zC9QNiY7A4iBOyLkyQkET3DMceJnRCe+3SiRejrxb9FvHYt:xh3zCmNMOQQkETTMHJRCe8SiQXZH0
TLSH
T1A075CF26FC22E172D49240B151B6BFE6E9EC7F11432888D7A3D0BF2E69181D32535B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3648	alg.exe
3340	elevation_service.exe
1884	elevation_service.exe
4936	maintenanceservice.exe
2424	OSE.EXE
4460	GameInputSvc.exe
5328	GameInputSvc.exe
1260	msdtc.exe
1456	PerceptionSimulationService.exe
3384	perfhost.exe
5400	ReFsDedupSvc.exe
4128	locator.exe
256	SensorDataService.exe
124	snmptrap.exe
6120	ssh-agent.exe
2808	TieringEngineService.exe
4004	AgentService.exe
1204	vds.exe
5612	vssvc.exe
3940	wbengine.exe
5704	WmiApSrv.exe
1860	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-16_4c926ad76e2b891d0f2baf514dd81c22_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d4d22b0be05f6396.bin	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-16_4c926ad76e2b891d0f2baf514dd81c22_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-16_4c926ad76e2b891d0f2baf514dd81c22_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5328	GameInputSvc.exe
5328	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	632	2026-07-16_4c926ad76e2b891d0f2baf514dd81c22_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	3648	alg.exe
Token: SeDebugPrivilege	3648	alg.exe
Token: SeTakeOwnershipPrivilege	3340	elevation_service.exe
Token: SeTcbPrivilege	4460	GameInputSvc.exe
Token: SeBackupPrivilege	5400	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5400	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5400	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5400	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5400	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5400	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5400	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5400	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5400	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5400	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2808	TieringEngineService.exe
Token: SeManageVolumePrivilege	2808	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4004	AgentService.exe
Token: SeBackupPrivilege	5612	vssvc.exe
Token: SeRestorePrivilege	5612	vssvc.exe
Token: SeAuditPrivilege	5612	vssvc.exe
Token: SeBackupPrivilege	3940	wbengine.exe
Token: SeRestorePrivilege	3940	wbengine.exe
Token: SeSecurityPrivilege	3940	wbengine.exe
Token: 33	1860	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1860	SearchIndexer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 5328	4460	GameInputSvc.exe	95

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-16_4c926ad76e2b891d0f2baf514dd81c22_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-16_4c926ad76e2b891d0f2baf514dd81c22_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:632

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3648

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3340

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1884

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4936

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2424

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5328

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1260

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1456

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3384

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5400

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4128

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:256

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:124

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6120

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2808

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4004

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1204

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5612

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3940

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5704

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1860
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:1852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 394dea3c99c4a8d197021d11ff7184f123fcbf9ce1dd8cefbf67d677690c4b4b
MD5 975cced64c312553e1c4d3276fe3cc4d
SHA1 823a564da46e864e1b990c7214f5bc3465448fe3
SHA512 4642e51ecf315f44d09d259b05b068074fdd41d76e5c1daec54d262ca605eade4c6919f45fe452e1c4918ee1a2dc2b9f90e0499f6589596bbfa128f6cf08bbec
SSDEEP 49152:qb+632BuPkFKRrdE6oh7stBhuXjfS4LWxn+Ce8SiQXZH0:c3q6gjBlC450
TLSH
T1FED59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 5bae648cbd7eec22670ac77dbc80575f4afd6fee691499dd42e61c216259120f
MD5 cfb97db81fd7cb7f214a6530d2c617c4
SHA1 49fb09f35d93fd6901b02bca883b5799cabfa325
SHA512 2d12fce367e79ae5e1d6db4161669d515a5d7f2b6a316e91b165b97e40fb535fccb21f7c805fcd6a9b2b3db4e10017dc5fbef3f0efa1139d56f34c42888523ad
SSDEEP 12288:i1XLsrlBTx+KeUr2czAH1oG+/78+c7YNdDeoVJJSa5RUbjrxb2EuGRkIHYt:oXYZPwczAHCe+3SiRejrxb9FvHYt
TLSH
T16005012877E009F9DC678178CDB28506EB33785547A0F7AB03A486761F237989E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 8114a781795edd072c0196bce5dee821b7187e70e426f8dc862e917c67c14f3d
MD5 4fbe08001e50ee2a17a57713ccb6ddb2
SHA1 beda7cc39f5c0e299190fb442d0d856036441932
SHA512 a8f5008d6c1bb1a11e464e7a0f29716c3eb8a6bdc1c435172adcd4ebc495d60f9df86e2d907664b250fa29a7fdfe4ad6e0c3cf3c1ec658414e6589f9b4b5c30c
SSDEEP 24576:m00eNsb0B9xOrMbCe+3SiRejrxb9FvHYt:mqsb0roSCe8SiQXZH0
TLSH
T11D459E16F5748735D073C0B9C5D2A68EEA72308657308ACB4286C77C6E67BE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9327220990bbcddb10560501171aa5985d139433be2abcb5aa3765e451540db1
MD5 0e8211f9243bf71a5bc2f0e311d461c7
SHA1 6a891dbc23ee41f7066ed813a4850bc8f86bf249
SHA512 73ac4f742000f2f3c5b96ce8d5756a9b72ba9d315ae39d8cc8beae114c46c66d1bc7b61fcdcb54c04fc5c6117ca1279cc8770611efc9a8df0658eac6c6e35802
SSDEEP 24576:7ac/ezSC6vUyD/aqgrvW/6q8wyuVCe+3SiRejrxb9FvHYt:d/ezSC6vUzPvuHjyCCe8SiQXZH0
TLSH
T1A7755C15F5788323D0B2D0BAC5D6AA9AFE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 6e9a9e25c6a91d3296f2a5bd032360fc9772af398fc13d47da3da262f1462f58
MD5 01fea293bff26d4818e31ef732a11244
SHA1 6084328147271c97f59876a5efc6ba9855786227
SHA512 072a8f4aa26184cc45efd6d726c4719139309f5dab2bcf33ab5b68f58f8a81036d4980e4ff1780240a261c189cc4d9fc7c71d2ba3e93cca180a0a977d0b5cdc5
SSDEEP 24576:sabcPLShWv/l+dCCe+3SiRejrxb9FvHYt:sagShWXl+kCe8SiQXZH0
TLSH
T1E4559E66F5748331D073C0BAC5D2AA9EEE3234425B318ACB0246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 03b1c081e326ef2ebedad7b5b576dec6d4c5d3815c695a40421895d8c27994ad
MD5 f9b1a9a868dde8121a24d62cd9c5c858
SHA1 9f76518edca5a5c4d775205dc2f4ef03cb830613
SHA512 779c5e9a582a2292a991d2797dc36ece0cf0085fc552ac9d395c93c7509f1ac431718379f3535e0a15d05d88e9bc8a0a8b3bb9b367de33528ae0af2e1c54ddf8
SSDEEP 12288:AUG1oG+/78+c7YNdDeoVJJSa5RUbjrxb2EuGRkIHYt:AUGCe+3SiRejrxb9FvHYt
TLSH
T174D4231A9C650EF2CA6B80B03EB3594FFB3A7B6559C47B79032703EA5C34B14D61847A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 0fd71a7a135b33cb83d4c04f7f4b27d94771480c0b133ee5d707c544c1388e60
MD5 83b81aba2d9c169259ebfcaf9baed40a
SHA1 49f90151c6c2b36734cfe92fee822400e78181bd
SHA512 b40de8c9ce2a2f953c59064da0459b86bc63abfc92f7bc0938985de2caee51b69360665c8f4fe09388973a4350c6b8913f072e1f874212e6b20f1169a5d37bfb
SSDEEP 12288:ieBNUbTVO86UG1oG+/78+c7YNdDeoVJJSa5RUbjrxb2EuGRkIHYt:iJIUGCe+3SiRejrxb9FvHYt
TLSH
T1E315CF3BED28FCE2C27A8DB85A918604E77274304F51A3DBD165834EDE236E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 60154c382d4d3cfd6af5c4ae9db1fed16a3d7488ba7cda96bf8664e048a74121
MD5 57681c2debd07c106338017a273ba3c5
SHA1 94d8cbc3e1f366eae39fba419242c994917d08bf
SHA512 65dc976e49f41e8279eab1847e97d2c5dfec7c595c153d15d4b41cf18bcf318b1ef0bfef89f166b489d83ecb2c1fc20c669a8fe592e044623649c1914a03d3f7
SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJt9DN5JNNRV3THH:nQvGAdlCEL8c/tRN55CNC450
TLSH
T159367C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 5360c9b1a17873cce2e7d8d0bd4d36a1ece4cc962321b6bd29c1a95105d34abc
MD5 c3bcf0215ce601186d50dac2753f0902
SHA1 da50e0cc8b36e04ffb410106c2548bb38d4be685
SHA512 44acb555f5fe773c46ce5a8d213ce283115781ad6adf92afd6e608cb424f54502fc97e26449446817aca557fbeff9da51b64ccf037d6e91a1b53bc0b25aae8bf
SSDEEP 12288:YhwSfxL/2Dc3bDLLmt0LDQewsAjj1oG+/78+c7YNdDeoVJJSa5RUbjrxb2EuGRkx:4mewsAjjCe+3SiRejrxb9FvHYt
TLSH
T19415E031FE74D436C67F0DB12B36C70A653D7A204F912AC3E3A84A9E59302D16776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b726e61ced5de25ff8775fcb6ed6574f0f3b37e03388ada53d46afb69330b491
MD5 7500d0d0b5ab755d52510d200358696b
SHA1 c5cd40963704b7fc00de410575b295c6b5594638
SHA512 1757769242640be7744f8fba09ab574af6832cc6137bca9d58d69788e000e25c5a5829bbfd6e02e1211569d0883bc9a9951e5fb1b9cf678cf078e7b02cc51614
SSDEEP 196608:lUEtQeTbvf2zlO12sJTv6Ja1cpVLyXFldPlbuJH++:lUEtQevvqc2W1cpV2XF32+
TLSH
T172474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d0407263a62571b5736ead4a226c12a5522094f612dedb163e763f0c7daee602
MD5 a59ebcb77ca86bd5f33a8aee19946f00
SHA1 e76054daa8c98b67de37f9e81956fa4a1c52ef20
SHA512 b95627d4910ce77124583cd25ec093fff27d7fb0ef79a587cb11f4c3dfab1d6239c70882d7113a3d72bc2625390e5f06a1e60272ef0b34d86ed77736bc8fcce0
SSDEEP 49152:mSbRquA/m2yL5zMfFiV+XenmE3/zkCe8SiQXZH0:boq1VjnmjC450
TLSH
T101D58D0976B882E4D1F6C77896A2C647F37178154B30A7EF4266461E2E33BD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 afc07d74b8389a77bb982f7ee0f765965a426762af2cffaacc72c1e98fd3f7f9
MD5 7d336dfc0cbcb254233c8226e4f8d8cd
SHA1 684caf0b49800db10061f1c6d453f9bf3fb0303a
SHA512 0f3c2369e1d95992c0675af450cc3e49a1377053306f3380aaf92c2013a6e85e1af54757984aa39bce1dd6ecc5ec6e97c2fd41bc40306a6320adc8513d273d11
SSDEEP 24576:RAhGLvfFoiwtA5l7S53nCe+3SiRejrxb9FvHYt:RAMrFoiq5XCe8SiQXZH0
TLSH
T13A459D81EBF945D4F5B3AAB859B68571EA76BCA65E30D21F1250C21F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 f36b7bc4bceeeaa653651b4ff8de21b9b9cdcd4e8ba626ac51bbe7b1e5feaba8
MD5 284ef88439fedf917c7ff09d25480f93
SHA1 caf07268a2300399096a735560381158b22e5041
SHA512 0f50fb8d4705962a67ed28c4c34cd71df0fee0f76aeff62194c5af6c48b25b0241f4094a87a9e54b5d54db8c77c3fb07c54fe791e70cd25764955f7ea46441e4
SSDEEP 12288:Pmw5HEjsChNXBFgl0WDm+CB1oG+/78+c7YNdDeoVJJSa5RUbjrxb2EuGRkIHYt:uwuuOWeCe+3SiRejrxb9FvHYt
TLSH
T1AE05F10A76A50CF9E96781388A97C53AF7B3B8112A64E72F1760C35B5F37311AD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 679KB
SHA256 797b491ec324e99d6c04002b7861cf19618cfa080780d5f349eaac8153d3040e
MD5 bf4c8a4d7d91888e6cdb01c9b0b6491f
SHA1 795f56bfabbf86c515f4a91f6ae50f7bb86ec2c6
SHA512 7a7d1454df31fc0c80c5b86b22e28e11d971bb21885f64d5b3e560a133eab0c01302f0e22c48ec751a07f38f22bf2f94b9c709cf8fcba3f068aefc259596a923
SSDEEP 12288:T7M1IiF1oG+/78+c7YNdDeoVJJSa5RUbjrxb2EuGRkIHYt:nMukCe+3SiRejrxb9FvHYt
TLSH
T105E4121A29E425F5D5A781789DF24A4EF7323562277463EF032543AA1F32BC09E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 448c47b7edaa8ba42f7c83389d857b079a96239bc505a4bf6655a98a32d01b06
MD5 013bb9ce71084c7244b067e34da5f453
SHA1 86c57c657aa1f96c382c2adca7328e07481313ff
SHA512 649622f05487ff07d3f2265e388713ae15b6a079cd8e122ef90521a066ab852bd32d512b6f827327a540c4396b35c8adb742e2ac97745ed3afe51165ede7cdd9
SSDEEP 49152:mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23UH:1QRQyi36YOcP8Lvw2gAf+PN3YC450
TLSH
T151666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 97eba79066620895c54b0faa93139f03c2155b7e361e047a9734c58be6ee3908
MD5 9fe61d4432f24934970379a40290d2ab
SHA1 83a6d925aed89002fd27dfb8f516ca08cb3eb7e4
SHA512 fc46b1a3a2ff5fd6a66f752bb19a62966c5f9dfe7222bf532c2b075def92e6edde433705f5ab865240640ab0e7ca111b566bb9bf047cd94a4623c285c853f57d
SSDEEP 49152:mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23U9:1QRQyi36YOcP8Lvw2gAf+PN3CC450
TLSH
T1CF666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 95c4b8280b57333cc6f8725b15b5915d90a431d06710e085ecd405f6d80db8f5
MD5 836dce73e14d58e3d4f713f9efba3935
SHA1 313b4d91011383d66e2afd8918f4fe2a93b33f36
SHA512 61c74e120443cbef7f47eeabcec2632503306e765e02a9d554d67b7a4474f161c554dee2409a8c66bcaf4803bba0831a0841ed88d51afcf1eb4c1ebc567511ac
SSDEEP 24576:0wvvbf6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0qCe+3SiRejrxb9+:x68Qg55nhMeWu7PNU3/jCe8SiQXZH0
TLSH
T141B55A33B2F600A9C44DE1769F46872196E27C758FE0E3DB851172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 651010e2e29dcf33dda9c1e711dd408417e047ff473ff0e3d0e3773559a0b3f7
MD5 356b5b800c24ee95fb5ac4d466cc99f8
SHA1 040887cff5110dc7395a144eb91c6d52d72ce051
SHA512 a3504621050548c8763ce251f137bf1cb2bb41a905fb494c1d82f5706a86fd7ffcf290ee6ed2758a0250d294ad63eb43e892800df0999571faa7fc136e357390
SSDEEP 49152:e3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk998:fy5112gYy5azzVv569nLKnhZoC450
TLSH
T101167B13F29900E8D05DD1B9874A9232EA72BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 32edfdc1230696cf9b473bcee55149f9f204bba44f33bc5dceb92716964adee3
MD5 f5013c4a396a8e5afd8b0747d1bf2f0b
SHA1 0fd205e6750a2a74fde1dd4ccededfa1f2b12b2f
SHA512 b7e3674b17e174783022c1c46737000c07518d087f4f5c137e3332ad749e89da1887a0e50b1703030e685eb68bddd49194c0829aceb381e19529d1f7e15febdd
SSDEEP 49152:bB+taZ3usBWOBr4tEGp0bqx0z+n217aau1gldCe8SiQXZH0:Nu6JmTxd2ddC450
TLSH
T149D59D13F5DA01E8D05AD478974A9233FA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 94dc6457a54378fc92ebb66f2e0c76ee18d660cbdd4fd47917ac58eea15f2900
MD5 5f3cb15a4686461fab7350cc5cbed1f7
SHA1 078b349989c32aee59d4f5024b0a8f83fbe287e2
SHA512 4abf125d934c163afe7fe428c32435309fd0f13f9078b9cfc97271216032400baa90ee51e90f6d041935c0832904242bef9d1bc4ed64942468da8af6a6dd961e
SSDEEP 49152:t1hpsNoJpF1A6UU44CwH7R4xHCe8SiQXZH0:tmifPbRqC450
TLSH
T1C0B5BE13F2D901E8D06ED17887569232EA72BC460B24B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c683cffbc2e089d0d7df6bad049d5f57bb556d39f33996a6193fde0c1e982cb1
MD5 03d731fea97bdccabe84b22fb6530c3c
SHA1 fdd9b78444c6687e806c1f5a37b685bc1602d9b2
SHA512 1f0b2079ad644474aca93cc57a7673fe1abc24fae77d646c91d2926d17840dac4766de409d6e4635321f017e1312da9f1ae685cb1b7a931a2fdd1e3a9ccd273a
SSDEEP 49152:+SuZQIY0Be2K6RVtOnks6NMHqLCe8SiQXZH0:Q5dKoi61LC450
TLSH
T106C5BF03F2E901E8E0BED6748B669236EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d0667307610b2aee2e03ee52b24172c91ce27b676432f9247f1f6a227f79a869
MD5 51ab592b5996594758f0113d1f3289d3
SHA1 5a70748011e84706483ed12a951a3323bcc0bb28
SHA512 e40e6fec7eea1fe85f4dc5b2e7e379221d68aa431f448e86d8d1c1f37746bd3d8a930b49fc53c0f342130a19698366005fd110a1261a3649096a7ac3f4cc54c0
SSDEEP 49152:gboSn8EApI0figTgiDn0AP5wXCe8SiQXZH0:iX2iyphKC450
TLSH
T1C2A5BE13F2D901E8D05ED178C7568632EA72BC160B24BAEF0A50B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 602KB
SHA256 cb5b9377923e9f98a6400d260bb3bb3e176b43bb6468ef5d9934b7e003621118
MD5 fcfd121d0756e855a55ff9dd9ba11c95
SHA1 331110cf302bb290f4a3a6a2319f2e77a2777053
SHA512 e74e4f004797ca896ca9075acb87b41565f1ae8ee1ab6f277b60ead4f927f04e3a1addc450ba630df7d742323597fef4c3bcad2f56c29834b06bb8780c4acb85
SSDEEP 12288:1j1oG+/78+c7YNdDeoVJJSa5RUbjrxb2EuGRkIHYt:1jCe+3SiRejrxb9FvHYt
TLSH
T1B9D4231A9CA60EF6C95781F03EB31A8FFB3A375A69C47679131B03B65D20B14D608879
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 603KB
SHA256 01ce8b98761418fa40663e3301944cfbbd864945c15439fba188f80677d1cc8d
MD5 65a5e1ff0143071b0def41272da3c7bb
SHA1 f4c47a6f7b4487b771846f17996027f77aaf759a
SHA512 2175df3d6e0f82b5b01a38a0a75901af1d4ce1375c0b42b454cc8861bab2f68307b4d7efe761d33a712e5dd3caff06aed9079df9bd43dfd6cd899ec0ac907880
SSDEEP 12288:cn7LDTsy9ZPIZRFQ1EGXJxhzgsVyylUFaIg+c+L5b5/Y/ntJDDZXJ:cn7XB9ZIZRK1HXxcqyyKFaQ5NqtJ/7
TLSH
T1D2D423232CF50A29D93454389F7B138128A3A10F91A1E77B9F5B403B3ED666E7734672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 603KB
SHA256 2a2f565fbc9517de7abdc94f50630acd6e49e0827715af6037fbbd42cb2badac
MD5 0f24b01fed58fb77e6f865c50d5eeebf
SHA1 f2c6632112042df1d6fe3950720d3afbd1b06bd6
SHA512 34cf96901fd3088cef539d9dd11fdce93c7324bfe4296d77be400accd56f8fe2f0bdf2e3471b8e53d4e5340abba309e8ddda7ee259a3c56e362b27fc5cdeda9c
SSDEEP 12288:eH7LDTsy9ZPIZRFQ1EGXJxhzgsVyylUFaIg+c+L5b5/Y/ntJDDZXJ:eH7XB9ZIZRK1HXxcqyyKFaQ5NqtJ/7
TLSH
T18CD423232CF54A29D93454389F37138128A3910B91A1E77B9F5B003B3ED666F77356B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 623KB
SHA256 a56a3a66f2a43a10933358d54d9058a26149138c4a4f5c3dda5d494c09af1ed0
MD5 95fb0c346086a88cae33eca5a9f50335
SHA1 a4db6f1ffe192e2556ce532d346d22d4a44b5a85
SHA512 a791ee6b05ac9c762ab7aa41ef7309733b038a9bd47118eb3adc380dbd3ded5627a2e2e7fd0cef3397e7d0f2daf8a98465ef5b5075fe88b3140f1fdf4cbf97cc
SSDEEP 12288:Qlu7LDTsy9ZPIZRFQ1EGXJxhzgsVyylUFaIg+c+L5b5/Y/ntJDDZXJ:Z7XB9ZIZRK1HXxcqyyKFaQ5NqtJ/7
TLSH
T10DD423232EB506A5D8359438CE771241A5F3B14B9171E72F9F12017B2EE272A7B34B72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 603KB
SHA256 8ef67068f9a1e42294165a8cf1fab7dd5fad3b8c041f3e14358d348f9b9f9ed2
MD5 638add48de5337455bc0b7afb377fa0f
SHA1 150447dda6baadbb1463a9e5ec993d623cd327d3
SHA512 859a6510b56c926c27bcaab71aa49903ce5a4ac387c69e44234124b625ba737a059c5414e7b058673b5820bb33fafbbac488d5ebec348adcd0a287f2cc3f81e5
SSDEEP 12288:F27LDTsy9ZPIZRFQ1EGXJxhzgsVyylUFaIg+c+L5b5/Y/ntJDDZXJ:F27XB9ZIZRK1HXxcqyyKFaQ5NqtJ/7
TLSH
T17ED423232CF54A29D93454389F7B138128A3910B91A1E77B9F5B003B3ED666F77346B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 603KB
SHA256 4cd2667947b0519f341a50c4ddd838ceb476eb0211f7d7178098b61da5350403
MD5 94b737d960f664bc43c23e4f3c62456d
SHA1 691a5c4d1827f605e27e862d5bac4b76fbaa5e83
SHA512 909ea65fffa8433bd70e4ed20f6edb669348597d079860fab6181814baa0339f1234fffa7febe3cb6373dddaa197388f50f9889741c119ddf1781a19a341c13b
SSDEEP 12288:Gx7LDTsy9ZPIZRFQ1EGXJxhzgsVyylUFaIg+c+L5b5/Y/ntJDDZXJ:Gx7XB9ZIZRK1HXxcqyyKFaQ5NqtJ/7
TLSH
T13ED423232CF54A29D93454389F3B138229A3910B90B1E77BAF57003B3AD666F77345B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 603KB
SHA256 dfbc90a57a2c1a1689c695d2428b9b1e4f4cd491ce172db4f9ac3bf573f37e39
MD5 9d13688fa61a4662ee3e40919e25f7c4
SHA1 cee8ace92d409bf3171adb960bfe4c81f78a67bb
SHA512 fe2faaacc7a82bc076d61e48a8f6778a8fba338d5e4c42bf313859f26e9302c5a14a3c06f1e01f9fb09e18c76abc20f6b2f105c25e78451cc93fe0c7bb6c7c94
SSDEEP 12288:A37LDTsy9ZPIZRFQ1EGXJxhzgsVyylUFaIg+c+L5b5/Y/ntJDDZXJ:A37XB9ZIZRK1HXxcqyyKFaQ5NqtJ/7
TLSH
T1F2D423232CF54A29D93454389F3B138129A3A10B91B1E77BAF57403B3AD662F77345B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 864KB
SHA256 b044b39af31e88317c3e5916a88f28d394a04a6d4dc7278a207873addcf858a6
MD5 4e2c73c71706f3549ee8100ecb69ef67
SHA1 0b063d096b0bc07e1df292638fb9203b63336a9e
SHA512 536c2d7d8d27d3585676685dc3f34473019974c08bed3dc7dff9a60e7bf2c8a525aa0b916e9adc88b5c28a207ce19e401e9e0979a69a8f419ef8fb3ddfb11b41
SSDEEP 24576:RZMIzFASje7XB9ZIZRK1HXxcqyyKFaQ5NqtJ/7:RZMIzezN/IZkncagNq
TLSH
T13415F1A577A018F8EC67813DCD264906D6B27C1A0670C71F07A5326B6F733611E3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 603KB
SHA256 f178b346a9ab557175c2da7d862cc2ee3594d0593bb3589ce0a6baa2c1850179
MD5 3a041017c9cb044c67928890b5ca6d2e
SHA1 330c0b3940207b0356366b169f1c3098b308d5ec
SHA512 dfa6b9e34da7de47aab6d9e1edcfc7abecc69d2fd14f23e15723cb05c8cd745559c899acc12280ec8ce65981a0663918c1fbd4549e3a93cd663dc199bccb5775
SSDEEP 12288:UK7LDTsy9ZPIZRFQ1EGXJxhzgsVyylUFaIg+c+L5b5/Y/ntJDDZXJ:UK7XB9ZIZRK1HXxcqyyKFaQ5NqtJ/7
TLSH
T1E0D423232CF54A29D93454389F3B138128A3910B90A1E77B9F5B013B3ED662F77356B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 603KB
SHA256 652c1a15a1a577f43c8add3ec3137bbcb66824c8a4a19c1eb1edbc1a06354e51
MD5 a3e45022e83d59df316ce766affd5dbf
SHA1 0c4442bf018e9814adcdf5a445ad660471d7a0fa
SHA512 5c820da247e68da0d9294ab14dc9953a5ab0e6b0de53af69eb35db0953cc043cf8bca55ecd42baf16a6bc74e1277605b574a4cb74b010ae314ee9711d9e3c384
SSDEEP 12288:uv7LDTsy9ZPIZRFQ1EGXJxhzgsVyylUFaIg+c+L5b5/Y/ntJDDZXJ:uv7XB9ZIZRK1HXxcqyyKFaQ5NqtJ/7
TLSH
T1F7D423232CF54A29D93454389F37138129A3A10B90A1E77B9F5B413B3ED652F77346B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 740KB
SHA256 f758cc2a3744318c46686e9218e36325452e0e3d4b3bedaf9a6c448c80332d45
MD5 18fa5677b3e85a1c80146b9c7fbfcaae
SHA1 4996fc4b9168e19f07d1b36c8ca5daf87fb00237
SHA512 115668ff730b6a2dc6132010ed7204cb9e86672d2e5e1f3c6dde4c6193d075176cd1784a72eb7093cf9865c5b5cf7f54be79c6c099121572cafdb6094c2cfe96
SSDEEP 12288:3EP7mLdc7LDTsy9ZPIZRFQ1EGXJxhzgsVyylUFaIg+c+L5b5/Y/ntJDDZXJ:E7Gc7XB9ZIZRK1HXxcqyyKFaQ5NqtJ/7
TLSH
T1EEF4121336A121F9D5369138CD621A02F7B2B4374720DB2F57A4027B2F63665AF3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 603KB
SHA256 891d2b6124381bd89306b7ee361dcb95121e3ce523d6b551de337ac63c2b1ad7
MD5 8c73c87ba9ac8fab2adb2bbcb56a0124
SHA1 06dead1eb5c6cd5c320f8dac6373a99fd2caf60c
SHA512 c3f40214f0b8992ca810e91deee86c530fd8e855555b7bcc7586facf92a70eff514470d5b0c2b20ee07300ad3153713dc4c42f9067995adab16011b2587fe0b6
SSDEEP 12288:4j7LDTsy9ZPIZRFQ1EGXJxhzgsVyylUFaIg+c+L5b5/Y/ntJDDZXJ:4j7XB9ZIZRK1HXxcqyyKFaQ5NqtJ/7
TLSH
T19ED423232CF54A29D93454388F37138128A3A10B91A1E77B9F5B013B3ED666F77346B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 603KB
SHA256 5ad26056fcdf078972fd735377fb70fba603c990d6bcb0e6816826d6b31ef751
MD5 1a54c843fb51cebb8933f180250a3240
SHA1 8517f4b6b88ea367a33065f3451ac5ab23ee3ae0
SHA512 5319b7353e50daf9ea8b9b2dc622593170a539580451b17ee9a46c64284ba5a41a71fd8150151535362a9f4e606ed5f76073fa4a76c2dbe90df3c22c3b8c4a5f
SSDEEP 12288:867LDTsy9ZPIZRFQ1EGXJxhzgsVyylUFaIg+c+L5b5/Y/ntJDDZXJ:867XB9ZIZRK1HXxcqyyKFaQ5NqtJ/7
TLSH
T1D3D423232CF50A29D93454789F7B138129A3A10B90A1E77B9F5B003B3ED666F77345B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 740KB
SHA256 87f7e050252514c84693b331138dc7eecb90bb1a3fc64c21d270fa6543f3dfda
MD5 116b17921a2fbb4eb96f5cf955461c2c
SHA1 3ee597bafb3f7e91dbbd3e8dd16aa43175fdb531
SHA512 a62bb0ace33a19820f8039d01da18b06e1129ac37936225327d48908503a70c49bb603cd57b169661478d57009b10f929686705262c3966a71d260112cf25dcd
SSDEEP 12288:SEP7mLdca7LDTsy9ZPIZRFQ1EGXJxhzgsVyylUFaIg+c+L5b5/Y/ntJDDZXJ:97Gca7XB9ZIZRK1HXxcqyyKFaQ5NqtJD
TLSH
T165F4021336A121F9D53691388D621A02F7B2B4374730DB2F57A4027B2F63665AF3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 864KB
SHA256 33f629471384ca81d00b1db3e3b69c502e327d360ef29201624b2ea45192be2e
MD5 fc945057908866f3cb86ca51b70ed030
SHA1 d11aeb59ed9dc66063bf86937634dad212dcec8c
SHA512 cd674d478d62c4ae3c6d2aa0e54843ceaffce0811b8fd4fc3aa87248c7f0147d4f38a9d63ff4e0cd35e00a0a01debb493cd0f5d85e5d114ca09b3d5b8b51c36d
SSDEEP 24576:HTuaLl3z0zDA7XB9ZIZRK1HXxcqyyKFaQ5NqtJ/7:HTdLljbN/IZkncagNq
TLSH
T10D15F1A577A018F8EC66813DCD664A02D6B27C1A0770C71F07A5326B5F733A11E3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 96801fd334f63879b3e6be8cd2d1e84ef41a42d99343c8fc158ba8e9e92c5960
MD5 3b31569995ce537d75900999854e0267
SHA1 9b4bbdfbe1c09f0b68e865d83103d17d9b7b1779
SHA512 7afb73fbf7a3e9adde68b429fbb11415ffb34663ed91986dff902a889ea3876c378dfb50560bcc9766a4bc253f04d86883922142b8dd8ccbda0bab61aa4baa76
SSDEEP 24576:W3tdhCHpy7zj27XB9ZIZRK1HXxcqyyKFaQ5NqtJ/7:4tdhCHpyXiN/IZkncagNq
TLSH
T15E35CF91B7E414E8F0779A358D764501DAB67C5A1B31DA8F03A4262A1F33BD19E38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 603KB
SHA256 b787285c6478342811cc71f20b792bfbb3ff2c0eb35a3270811effcbd3988425
MD5 f0f2a70c17fdce87bcc0f6c3023ea661
SHA1 1553e7704381e4f81c6e809b4fd3a9d2a28bfcf4
SHA512 53f62b0181c11e0c0156fd3a4df81b0efd9e7d12add04db8f69a883e7f46b74e1b04629490c7f7b56fc486d657d1fe3e1a663ba586930a4f03070d739be55cb9
SSDEEP 12288:w87LDTsy9ZPIZRFQ1EGXJxhzgsVyylUFaIg+c+L5b5/Y/ntJDDZXJ:w87XB9ZIZRK1HXxcqyyKFaQ5NqtJ/7
TLSH
T17ED423232CB54A2AD93454389F7B138128A3A10B90A1E77B9F5B003B3FD656F77355B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 603KB
SHA256 518e9f3ac8c3641f64f5f4e230ddd2e27dd6eba08a5f3aaf6bcbb14fc7191175
MD5 4ea138a2a8f33e4a824d9c4989de77d1
SHA1 71769c84473d336a0ac745f7412340894de0901b
SHA512 b9022b10d8ec7601563fef42b35949d59e66597d53c482adad650c9237055e7d5278e32657188036e30aa1f1495eb4477753edf47875ac0b725f8c7539055275
SSDEEP 12288:4d7LDTsy9ZPIZRFQ1EGXJxhzgsVyylUFaIg+c+L5b5/Y/ntJDDZXJ:4d7XB9ZIZRK1HXxcqyyKFaQ5NqtJ/7
TLSH
T14CD423232CB54A2AD93454789F7B138129A3A10B90B1E77BAF5B003B3ED656F7734172
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 603KB
SHA256 6cfc4efdaa874bcadd45f2cecf0039db9344d629e9b510b7d0eef539b51f1503
MD5 11d74a3766e083f31eba837ddb4156d0
SHA1 743d3008592a5eb0b3a98b160ef0080a2473461d
SHA512 dab6490bfa745d2c6dfc8da34ee162725e88ce1c3825f917e19e0201eb1a71d77f84ed2d1635d76e08d7696f1ac5b34b839b7008c4084ce9824cf2f83468a7c2
SSDEEP 12288:JM7LDTsy9ZPIZRFQ1EGXJxhzgsVyylUFaIg+c+L5b5/Y/ntJDDZXJ:JM7XB9ZIZRK1HXxcqyyKFaQ5NqtJ/7
TLSH
T1CDD423233CB50A29D93454789F37138128A3A10B90A1E77BAF5B013B3ED666F7735572
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 603KB
SHA256 0d279b208a03298257790df5bbfe927ecc9a9dc2784c97d045161086263cc23f
MD5 34b8e4c724ec4af666123001fc5434bd
SHA1 81c6684d033dca5c3d347e06820013f1b8f9f55d
SHA512 5975b686a0bb442c7b9455be6369265e61075bfc260149f2f778a0d4c101586a05997b9752cc670e5c36bdd2e7290470063a84afc164f4356f36b0f60085f3d9
SSDEEP 12288:K67LDTsy9ZPIZRFQ1EGXJxhzgsVyylUFaIg+c+L5b5/Y/ntJDDZXJ:K67XB9ZIZRK1HXxcqyyKFaQ5NqtJ/7
TLSH
T1B4D423233CB50A29D93454789F37138128A3A10B90A1E77B9F5B013B3ED666F77356B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 408c340e273d032deb594c526f824de76680dfe64e89c173a668023150847441
MD5 3024b8474e5a76b4d1d82d5cce5c5b18
SHA1 5860ce03327e0f66860b23e2d929453e79500cb8
SHA512 34ed6b0e1e2a483e94fa4ff8d9b6a9c5da18fb895c72fd7273aeda3ed12d1e88091bec1805515bce1e74a6733ab71a256cf97199335ee721bd348ae5e8a755d3
SSDEEP 12288:g8Vfv1oG+/78+c7YNdDeoVJJSa5RUbjrxb2EuGRkIHYt:dvCe+3SiRejrxb9FvHYt
TLSH
T1DAF4011AD6A402E8C06F9174DB524A4AF3373D2597E0E3EA13D1F27E0F356909ED9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 9acf7cf5e243fe9159409d76d714ec7209e8eff781f0136e417f99fac69c1825
MD5 de909498aa69ef867487e2fccf474778
SHA1 0b28f02b5b436f98a939ca2262b636112eee28f6
SHA512 b37486a8eed13771440c2774b12a4f0a0b59c6baf16e8ad7ca204e93d61439e96971a5fdd9dee9fa72c5a8ebe58601cafcc94203b507294ed84eb6bd6a4e74e1
SSDEEP 12288:R77A1oG+/78+c7YNdDeoVJJSa5RUbjrxb2EuGRkIHYt:1ACe+3SiRejrxb9FvHYt
TLSH
T199D4231A9C690EB6D97781B03EB3450EB73E77655F8476BB631603EA5C30F44CE28829
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 918efe1b041deb27d284cf19ad6b5e551cb2572a9dadad9df132c3801d26650a
MD5 6c589213d130326e59b957c1c347b7b3
SHA1 06bbfcd48e04f2073c320e75953b540a77c87f3a
SHA512 c11bb1173c614f8a26e8a354c1d32c6e3dcea33b71af732c6b58f5e49e948361fd8ac6d2be51f4b13b9117e637f40c89634973cfdea7efc2ce22adeea1c9fcc2
SSDEEP 24576:mgb6bmBIi49WNNFpg1rSvFv7bYUnCe+3SiRejrxb9FvHYt:mgb4mBIBhGFHnCe8SiQXZH0
TLSH
T18E65AE1E22EC02F5E0FAD2B89DA64417D6B278160731D2DF1251427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 6ee92da7ccd90427e5b3ec916c134107ab5da3f012c4f0e45d542b65c87fe5e7
MD5 cabd1ae370d4076090f866ca46ba26f9
SHA1 702a1df8e6eccb323cd9696e3f8c7d65c673a0d3
SHA512 c027e1f37d257cd7117ce4810820911516d008f82b6e18ae401ff3786885919442d544e3c092fc9acbbc056ed0b85bdcea8554786d1555291adae67ecd68923c
SSDEEP 12288:ltGA1oG+/78+c7YNdDeoVJJSa5RUbjrxb2EuGRkIHYt:TGACe+3SiRejrxb9FvHYt
TLSH
T1BFE4132D6CB629F4C93BC1B42D72554FBA3636615B4436FF079582768E20BE0E63CC68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 a53d47a789c2554bce6bcd77fe0164e8dc0dde1898040dffc2288813898f0da4
MD5 38e9f05938ea8b13fe8b314ee61eae03
SHA1 c8d65c2f019b3258e194ce1eb06e4c16ff50bb29
SHA512 1883080e3a0e382345bbfb5778298f807fe2f91524cc51d7f26c8b4d54e9fab2aac23081ef82d5b91bddf039303cb31943eaf7ef845fac17cdb1df8777a9c535
SSDEEP 12288:Mdb1oG+/78+c7YNdDeoVJJSa5RUbjrxb2EuGRkIHYt:MtCe+3SiRejrxb9FvHYt
TLSH
T1A4D423199C650EF2C96781B03EA3494FBB3A37666BC437FB531A03A64C24BD4D638479
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 3d6fae1160a1d4f7cfea6d519dfc40058177f5b97e59c393fa80ff39848bb957
MD5 bcd7ba5c36082b6cbdcb2245243285aa
SHA1 c7599fd6fa381a1134ac4e2f1d2ac944d887f7ea
SHA512 69384597dac4d99bb90136245eaddcc47c5afea13d0376e13ec6fb4a61ff3ce0bcdf86e46642b7ad9173e6d8ba0fcecd85a8d38c00a019fbc017fa4b3d70acfa
SSDEEP 24576:QYw828FpJqH1qyria7/mpCe+3SiRejrxb9FvHYt:9/hFPqV0a7/GCe8SiQXZH0
TLSH
T1F135F1257AE101F1D47BD1388A924667F6B2B4250364FBEF07A88B551F23BD44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 ce927e85648b76b52372dc24da0255512e47bb46f5f6b1f738942416eb562ec5
MD5 e8595ae935f487ca5c79f1e4b62ba9df
SHA1 db8d90c6c69b335950e8e23b58a6229442c764a1
SHA512 9d9315c4f02254ebf6ad9bc2fc77b9511b5dc2cb4271ca630c087d6624609823a04aa9b670fcd1fe44475256e4affbaea5989e876f99daa2cdee86e7571d5321
SSDEEP 49152:PBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjWCe8SiQXZH0:AG05lO43b3C450
TLSH
T1CDD5C06E62EC11F9D1BBD17CDAC64A0BEBB23415032456CF02A486A91F27FF4967E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 bd4c1df17b815e728ad29f72a6fdcdadbd0ec1e7c1bf1de44fa25d3dd9c88ec9
MD5 5445e5233a769448b705fda62f936db3
SHA1 0c4cf58bddb723ecf6ea0e1df09979e7ce670b07
SHA512 f30af8c6cd7e62e9fd351d48a07411b2a6e84240420454d28652eab8a3071d1737c04cb48d4331c2d67d519467c780962d978e8efae879d9d7462a83cd9cc4a5
SSDEEP 24576:Yya5POZ3dpbWVM50JicR2hG0lasx2+47eidnPCe+3SiRejrxb9FvHYt:Fa5POZ3wJt2pasx2+mBCe8SiQXZH0
TLSH
T1E865AF5EA6FC01D5D5B9D17CC5834A1AF5B1342653319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 48cb7a7fb63d6adb5fe1b99bc9f5af11390ffec775fc1807b81e5a3b3a5f4ea9
MD5 6a19c8f38a1aff3258a2cd09a9242bbe
SHA1 f3325eb0cea5987cfe0d9a27fa04dee5691b2530
SHA512 e1212db5a9caa1d461cbaaaeb0941eee3d3a583b516fc8eb1b1bf4f9d5e823d326141ed82a892eb8b5e12746d169c4b3c14427d93616314d56e2e2009ab0b66d
SSDEEP 24576:FNcwHdjbyQ4nLC18lb/EOjowL7Fk2kCe+3SiRejrxb9FvHYt:FNc/zEOVHFQCe8SiQXZH0
TLSH
T135858C2622E901E4F5BBE1BE89779546FA71786513309ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 37bba68f3ede4fb2ebee8553b897218d32f773fb0917bcb93b03288ce69732f8
MD5 3826309f98948cec7e21b16c1da896db
SHA1 405e8fe4eff748fbe6069c3335ebdfcc854461cc
SHA512 434957aec67b898ce15d0ce65e146f69d3af968f757c8686d0a2d9c3ce8a6e0ce1bbfad8156bbfff2e84f818edf8da32a6d02dd8081839994679432b51e53373
SSDEEP 12288:YAHPJnJP6szeCs6Rl28do1oG+/78+c7YNdDeoVJJSa5RUbjrxb2EuGRkIHYt:XJnJPbzB4SoCe+3SiRejrxb9FvHYt
TLSH
T14815D03DD2A810E8D4B7C2B4815A1A5AFF31386D2F1169DB19B4D1353F12FE0AA39F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 cb56d17afeaeca41a2279509f729abc04494f0e22dd9722150bc789513354553
MD5 ce1637b272616d669db5de00c45bbe88
SHA1 62eafc3b2cbd783e462b6b7e3034543df09dbbcd
SHA512 f732f8dfd97ca1167e3aec5825d7e22ea6f38f59b4f615234fa84c70e8d3d73a980930e15d917b6946fdf5ada065c9d69a5f73101da64b1ebae09fc4d367e505
SSDEEP 24576:LCLHGL0MoeVtFumTijCmlKQWDkICe+3SiRejrxb9FvHYt:LCLHGeeV5ijCmlDWDkICe8SiQXZH0
TLSH
T1D8A56C05E7EB5184E8F3CAF5CA2294169A327C549B34F7EF4A80C96A1E32FD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 4a334e1a01e968022f826c683b001b73a96991f74e6a04655f1a75c68b6416be
MD5 97e44e405060d6cc3e99415b8b031145
SHA1 d46b3aaa7ec3d4f1636353125209f31a76945c29
SHA512 dda517744f300bfe77b06300fd62e56921443255f5693539a3f17d767146674860fc050083ca09844b5601787a56c75e98bce52e2d40b94786a3cd8e77b4a5f2
SSDEEP 12288:ZeHck6j5ZI75vr1oG+/78+c7YNdDeoVJJSa5RUbjrxb2EuGRkIHYt:e6DI5rCe+3SiRejrxb9FvHYt
TLSH
T13105011D267A10F5D06BD07D9A93050AE2B2B17187512AEF0794C2BE4EA3FD8FA3CD51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 1d0a1f277b97f9f89076257a95d5b86c22bd35190715d7a5bc93e74a3ec0a072
MD5 069d724610d6b90e1f54febc35402f35
SHA1 2a6dd44a5efba904e652c064a69ffa78d5dbc9d7
SHA512 573d80d8d37904ca19ee646b48dee15eecd318cd32a34d50a409c4131f3efafa55eff17970d7944c9fa4ce0b25056de4bc82bc3eddcd8121011c449e6c14d0d4
SSDEEP 12288:SG6kyb1oG+/78+c7YNdDeoVJJSa5RUbjrxb2EuGRkIHYt:btybCe+3SiRejrxb9FvHYt
TLSH
T12CF412086AA415E4D97A41746EB3428EEF3A7D205B4073FF1391937E1E31BD4E934B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 15bd8379862f8f648d31994953f865b4d9814a90386c3d68d0d0580ad9232f18
MD5 7f761c2b229fac54d969d33963bf101e
SHA1 18591080115ec5aea975bad20c7dcfaec5813758
SHA512 0ebb312a75df533043495537717c81378ba71a022ce3389d8080bc8bcf0f390871e0594a49fd48e5dc53d7f7f67b2e03c7e7e1f5cb98ba91cc325a680b769e85
SSDEEP 12288:Mv11oG+/78+c7YNdDeoVJJSa5RUbjrxb2EuGRkIHYt:E1Ce+3SiRejrxb9FvHYt
TLSH
T120D4232D9C651AF5C82791B03EA20A4FB73A33751B8436FF175643B68D24BD4D638C29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 5cba814bd073c589b4c551412d96eed3db54a2b64cdc76bd3a1897f05bf67ec2
MD5 19b96a55a3b3154d3c6c99ff89fe97e9
SHA1 762ec78769bc1801f717446d6b368e77a9bd1060
SHA512 dd581d305ce2886277408b8bd2862ac2d5485e6b26e8f219dcc0060b07e091d452914090a80fb18eb5d0ef65cc0bebf48b4fcdc3e5b1a6dd34fb95a6e8059034
SSDEEP 24576:S+gcToTfaidZLrCe+3SiRejrxb9FvHYt:RgrTrZLrCe8SiQXZH0
TLSH
T132559C1DA7EA09DAE2B2D275D8721483D633B4311771D6DF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 796KB
SHA256 bd63ce27b632d397473ad0ad55577851380e15d941e09bc64312191964d902f5
MD5 e8eb64bad1d09f1f3729188fa8a473cb
SHA1 dab2794dc98d7c738ee25602cdc30b0aafb58a83
SHA512 69fb900fd0088b7c25e6c4ea07054785d8dfe14c82f9f454535477c4954542a0fea5074cc2ab0403cc3c744074ca8d0a87e41f5704d3cd6a2a88c0e33366e62e
SSDEEP 12288:LpJcm8CNK1oG+/78+c7YNdDeoVJJSa5RUbjrxb2EuGRkIHYt:LrcmRKCe+3SiRejrxb9FvHYt
TLSH
T15C05F11EB6AA00F5D1B7C17C8D82450AF7737031275167EF02A1837E4E27AE9BE38A51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 c5dc05f19b696228c5dd354bbd8f0167df5aab8ed530dfeebc3695ce0a235985
MD5 caa13fcedb1596f440357b015f5a56c7
SHA1 b9a2326f3566ce4c235a8d779b7ff0d3e46e07af
SHA512 8370959302ad9a0ed19de836e7f453e0458b1dde4a318da6b170a04199f869c9b47176532ff3836e21c7cb3895fbff0c6bddd21f7801abc88b43a1cb1ad0fc97
SSDEEP 49152:9DL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3jCe8SiQXZH0:+3Upow8sBKC450
TLSH
T163A58C3DA2E810A8D9AAC379C54213A6EA71742D3F3015DB0174C178BF1BEF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 e688673b9a9f25f0287a55223f6fe807cb82961b5e92253eba96c6c6f735fe36
MD5 6c17e84a704153b00d21677aa0cc2339
SHA1 45d9646cbca0fb7b1a2dca300b571661da0fa4b7
SHA512 a4e5ede607b69aca53c03d456a86c345b175508aa4818617116525ee2e001f5694043a2cc13ebc40dfc81afedaa6396315fa514ddfd50690fc66c4db6f47c657
SSDEEP 12288:sHvUrBFrEjwaQy1oG+/78+c7YNdDeoVJJSa5RUbjrxb2EuGRkIHYt:sPUr+NQyCe+3SiRejrxb9FvHYt
TLSH
T18505F12F65A91CF5E676E17C8982470DF77274621741A2DF03A1817E4E23EE8BD3DA20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/124-388-0x00007FF699630000-0x00007FF6996E4000-memory.dmp

Download

memory/124-315-0x000001ED45ED0000-0x000001ED45F36000-memory.dmp

Download

memory/124-312-0x00007FF699630000-0x00007FF6996E4000-memory.dmp

Download

memory/124-313-0x000001ED45ED0000-0x000001ED45F36000-memory.dmp

Download

memory/256-443-0x000001D81B8F0000-0x000001D81BB93000-memory.dmp

Download

memory/256-381-0x00007FF61A640000-0x00007FF61AA57000-memory.dmp

Download

memory/256-445-0x000001D81AF50000-0x000001D81AFB6000-memory.dmp

Download

memory/256-447-0x000001D81B8F0000-0x000001D81BB93000-memory.dmp

Download

memory/256-304-0x000001D81AF50000-0x000001D81AFB6000-memory.dmp

Download

memory/256-303-0x000001D81AF50000-0x000001D81AFB6000-memory.dmp

Download

memory/256-302-0x00007FF61A640000-0x00007FF61AA57000-memory.dmp

Download

memory/256-448-0x00007FF61A640000-0x00007FF61AA57000-memory.dmp

Download

memory/632-2-0x00000000028B0000-0x0000000002919000-memory.dmp

Download

memory/632-6-0x00000000028B0000-0x0000000002919000-memory.dmp

Download

memory/632-7-0x00000000028B0000-0x0000000002919000-memory.dmp

Download

memory/632-0-0x0000000002650000-0x000000000273F000-memory.dmp

Download

memory/1204-449-0x00007FF769FB0000-0x00007FF76A23B000-memory.dmp

Download

memory/1204-353-0x0000011D872D0000-0x0000011D87336000-memory.dmp

Download

memory/1204-354-0x0000011D872D0000-0x0000011D87336000-memory.dmp

Download

memory/1204-352-0x00007FF769FB0000-0x00007FF76A23B000-memory.dmp

Download

memory/1260-253-0x000002B01B8F0000-0x000002B01B956000-memory.dmp

Download

memory/1260-252-0x00007FF661B20000-0x00007FF661C3A000-memory.dmp

Download

memory/1260-254-0x000002B01B8F0000-0x000002B01B956000-memory.dmp

Download

memory/1260-339-0x00007FF661B20000-0x00007FF661C3A000-memory.dmp

Download

memory/1456-266-0x000001FB37650000-0x000001FB376B6000-memory.dmp

Download

memory/1456-351-0x00007FF70A0A0000-0x00007FF70A1EA000-memory.dmp

Download

memory/1456-264-0x00007FF70A0A0000-0x00007FF70A1EA000-memory.dmp

Download

memory/1456-267-0x000001FB37650000-0x000001FB376B6000-memory.dmp

Download

memory/1860-393-0x0000016A018A0000-0x0000016A01906000-memory.dmp

Download

memory/1860-394-0x0000016A018A0000-0x0000016A01906000-memory.dmp

Download

memory/1860-453-0x00007FF6E2100000-0x00007FF6E243F000-memory.dmp

Download

memory/1860-392-0x00007FF6E2100000-0x00007FF6E243F000-memory.dmp

Download

memory/1884-39-0x000001D66E2F0000-0x000001D66E356000-memory.dmp

Download

memory/1884-37-0x000001D66E040000-0x000001D66E1C5000-memory.dmp

Download

memory/1884-40-0x000001D66E2F0000-0x000001D66E356000-memory.dmp

Download

memory/1884-38-0x000001D66E2F0000-0x000001D66E356000-memory.dmp

Download

memory/2424-54-0x0000022CF44C0000-0x0000022CF4645000-memory.dmp

Download

memory/2424-57-0x0000022CF4440000-0x0000022CF44A6000-memory.dmp

Download

memory/2424-55-0x0000022CF4440000-0x0000022CF44A6000-memory.dmp

Download

memory/2808-333-0x000001BC0F6A0000-0x000001BC0F706000-memory.dmp

Download

memory/2808-444-0x00007FF617130000-0x00007FF6172C5000-memory.dmp

Download

memory/2808-332-0x000001BC0F6A0000-0x000001BC0F706000-memory.dmp

Download

memory/2808-331-0x00007FF617130000-0x00007FF6172C5000-memory.dmp

Download

memory/3340-28-0x00000258D4970000-0x00000258D4AF5000-memory.dmp

Download

memory/3340-31-0x00000258D4C20000-0x00000258D4C86000-memory.dmp

Download

memory/3340-30-0x00000258D4C20000-0x00000258D4C86000-memory.dmp

Download

memory/3340-29-0x00000258D4C20000-0x00000258D4C86000-memory.dmp

Download

memory/3384-279-0x0000000000930000-0x0000000000999000-memory.dmp

Download

memory/3384-360-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/3384-273-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/3384-274-0x0000000000930000-0x0000000000999000-memory.dmp

Download

memory/3648-15-0x00007FF62F490000-0x00007FF62F5B3000-memory.dmp

Download

memory/3648-70-0x00007FF62F490000-0x00007FF62F5B3000-memory.dmp

Download

memory/3648-17-0x00000234F30D0000-0x00000234F3136000-memory.dmp

Download

memory/3648-18-0x00000234F30D0000-0x00000234F3136000-memory.dmp

Download

memory/3648-16-0x00000234F30D0000-0x00000234F3136000-memory.dmp

Download

memory/3940-371-0x00007FF7A7BD0000-0x00007FF7A80D7000-memory.dmp

Download

memory/3940-451-0x00007FF7A7BD0000-0x00007FF7A80D7000-memory.dmp

Download

memory/3940-372-0x00000261E9130000-0x00000261E9196000-memory.dmp

Download

memory/3940-370-0x00000261E9130000-0x00000261E9196000-memory.dmp

Download

memory/4004-348-0x00007FF7FD080000-0x00007FF7FD3A1000-memory.dmp

Download

memory/4004-340-0x0000028214210000-0x0000028214276000-memory.dmp

Download

memory/4004-341-0x0000028214210000-0x0000028214276000-memory.dmp

Download

memory/4004-345-0x00007FF7FD080000-0x00007FF7FD3A1000-memory.dmp

Download

memory/4004-346-0x0000028214210000-0x0000028214276000-memory.dmp

Download

memory/4128-293-0x00007FF704CC0000-0x00007FF704D6E000-memory.dmp

Download

memory/4128-295-0x00000254170A0000-0x0000025417106000-memory.dmp

Download

memory/4128-294-0x00000254170A0000-0x0000025417106000-memory.dmp

Download

memory/4128-376-0x00007FF704CC0000-0x00007FF704D6E000-memory.dmp

Download

memory/4460-320-0x00007FF625A30000-0x00007FF625AF9000-memory.dmp

Download

memory/4460-237-0x0000017836C40000-0x0000017836CA6000-memory.dmp

Download

memory/4460-236-0x0000017836C40000-0x0000017836CA6000-memory.dmp

Download

memory/4460-235-0x00007FF625A30000-0x00007FF625AF9000-memory.dmp

Download

memory/4936-48-0x000001ED7CEA0000-0x000001ED7CF06000-memory.dmp

Download

memory/4936-47-0x000001ED7CEA0000-0x000001ED7CF06000-memory.dmp

Download

memory/4936-60-0x00007FF79FEF0000-0x00007FF7A0058000-memory.dmp

Download

memory/4936-46-0x00007FF79FEF0000-0x00007FF7A0058000-memory.dmp

Download

memory/4936-58-0x000001ED7CEA0000-0x000001ED7CF06000-memory.dmp

Download

memory/5328-330-0x00007FF625A30000-0x00007FF625AF9000-memory.dmp

Download

memory/5328-245-0x000001C58D790000-0x000001C58D7F6000-memory.dmp

Download

memory/5328-246-0x000001C58D790000-0x000001C58D7F6000-memory.dmp

Download

memory/5328-243-0x00007FF625A30000-0x00007FF625AF9000-memory.dmp

Download

memory/5400-369-0x00007FF6E94A0000-0x00007FF6E9BE4000-memory.dmp

Download

memory/5400-286-0x000002157B000000-0x000002157B066000-memory.dmp

Download

memory/5400-285-0x000002157B000000-0x000002157B066000-memory.dmp

Download

memory/5400-291-0x00007FF6E94A0000-0x00007FF6E9BE4000-memory.dmp

Download

memory/5612-362-0x0000022F7B340000-0x0000022F7B3A6000-memory.dmp

Download

memory/5612-363-0x0000022F7B340000-0x0000022F7B3A6000-memory.dmp

Download

memory/5612-450-0x00007FF7754A0000-0x00007FF775971000-memory.dmp

Download

memory/5612-361-0x00007FF7754A0000-0x00007FF775971000-memory.dmp

Download

memory/5704-382-0x00007FF6562E0000-0x00007FF65640F000-memory.dmp

Download

memory/5704-383-0x00000206C7350000-0x00000206C73B6000-memory.dmp

Download

memory/5704-380-0x00000206C7350000-0x00000206C73B6000-memory.dmp

Download

memory/5704-452-0x00007FF6562E0000-0x00007FF65640F000-memory.dmp

Download

memory/6120-328-0x00007FF76B770000-0x00007FF76BA13000-memory.dmp

Download

memory/6120-391-0x00007FF76B770000-0x00007FF76BA13000-memory.dmp

Download

memory/6120-323-0x0000013A46880000-0x0000013A468E6000-memory.dmp

Download

memory/6120-322-0x0000013A46880000-0x0000013A468E6000-memory.dmp

Download