9c8a6d5c879daf02dc8a981f853a5d7bb36521dc9b4c51ccaa6d533e65841892

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Size 2.1MB
Sample260731-vs627adh56
SHA256 9c8a6d5c879daf02dc8a981f853a5d7bb36521dc9b4c51ccaa6d533e65841892
MD5 a3efd4a55e01ded1afa0dd36de8c493b
SHA1 6177f9101605cf32b530d4edf52ed7d8d58cbff6
SHA512 2291fea0411884cfe410a8128c852891fba404c34217a85d11d7cca9f09bf2aad45997678f28df0402d57e71b89f3bcaa37866ae986e17a6975cd7b8137932af
SSDEEP 49152:n2dMo3MFm6ZF0f78HWJLzBYPVTFbLNiXicJFFRGNzj3:n85umkF0fQ0dYvb7wRGpj3
TLSH
T115A5CF01B4418476D6961170EC2CE638AB287E1C5BF248F7B3946DE87E741D13E3AA6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3260	elevation_service.exe
4272	elevation_service.exe
4688	maintenanceservice.exe
3120	OSE.EXE
5980	PerceptionSimulationService.exe
1748	perfhost.exe
5216	ReFsDedupSvc.exe
2596	SensorDataService.exe
2656	ssh-agent.exe
4280	AgentService.exe
4204	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe

Drops file in System32 directory 60 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6338b16ce62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ef2a79801021dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000598fef801021dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000005b7747f1021dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cd720bc21021dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000df897e7f1021dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3260	elevation_service.exe
3260	elevation_service.exe
3260	elevation_service.exe
3260	elevation_service.exe
3260	elevation_service.exe
3260	elevation_service.exe
3260	elevation_service.exe
4272	elevation_service.exe
4272	elevation_service.exe
4272	elevation_service.exe
4272	elevation_service.exe
4272	elevation_service.exe
4272	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5856	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeBackupPrivilege	5216	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5216	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5216	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5216	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5216	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5216	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5216	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5216	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5216	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5216	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4280	AgentService.exe
Token: 33	4204	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4204	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4204	SearchIndexer.exe
Token: SeDebugPrivilege	3260	elevation_service.exe
Token: SeDebugPrivilege	4272	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5856 wrote to memory of 1392	5856	2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe	88
PID 4204 wrote to memory of 4672	4204	SearchIndexer.exe	100
PID 4204 wrote to memory of 5468	4204	SearchIndexer.exe	101
PID 4204 wrote to memory of 4864	4204	SearchIndexer.exe	102
PID 4204 wrote to memory of 5904	4204	SearchIndexer.exe	103
PID 4204 wrote to memory of 1256	4204	SearchIndexer.exe	105
PID 4204 wrote to memory of 4500	4204	SearchIndexer.exe	106
PID 4204 wrote to memory of 996	4204	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5856
- C:\Users\Admin\AppData\Local\Temp\2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-31_a3efd4a55e01ded1afa0dd36de8c493b_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe" --statistics=https://api.browser.yandex.ru/installstats/send/dtype=stred/pid=457/cid=72992/path=extended_stat/vars=-action=service_unused,-brand_id=unknown,-error=UNKNOWN_COMMAND,-installer_type=service,-launched=false,-old_style=1,-old_ver=,-result=0,-stage=error,-ui=2ABF3811_9684_46B8_9A7E_BB8BBA1148C1/*
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:1392

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3260

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4272

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4688

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3120

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5980

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1748

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5216

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2596

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2656

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4280

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4672
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5468
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4864
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 3024 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5904
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1256
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4500
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 3024 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 aa90e8450d24f2ca3f4d5bcb9134d8c8cd2a5e431ff7912d66920adeeb362224
MD5 d196c818c76ef61c63eb26bec8ae1bf6
SHA1 b8c26489bec61fc7d1e7ec88889ad23e1ac2bf6d
SHA512 3f04f12ba876ba7490c1df7baed6a0160b40dc47dcd984e2b07bbda442e7d87503d86c388eba082025083616056121120a03780331aca7348059bad93b12b077
SSDEEP 49152:Ub+632BuPkFKRrdE6ohdstBhuXjfS4LWxngLNiXicJFFRGNzj3:O3q6mjBv7wRGpj3
TLSH
T1ADD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 f144b9a699a1b05f1a7554f9025a3965c31e7b152defcbe3d3376b5eeced34d6
MD5 60973816dbde26a7264ca05b531cbb95
SHA1 12e20858233a7aac07b9d5a8588259f8b66683ba
SHA512 91431a50a6bff94a9a216e3c9c62d20505e6f88f17aa17ef7dc1576fa917337e4f6bc3a9dc6867c9034f4ee2fd9c876330b16ba110dcdc53ca993e7dd717540c
SSDEEP 24576:oXYfDtczAb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/tcaLNiXicJFFRGNzj3
TLSH
T19975012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 3bf39732b828328e79bad5d538dc1649d04a3a62466e09ebc96729d24a0ed209
MD5 e942ee019bbfeb0b9e6e69bf64cda53b
SHA1 51a8411c134b260fa1df02aff254c3d445a2d96a
SHA512 ff09d5102e300537a2e297fbb2d630b9c7063914e58a1bae4d288792388471e1b57bf901100bcadeeeecf643948957e852019b7bbe6ee552f88ecf523d47b6e9
SSDEEP 24576:30Le5ji0hmxhrMI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3Pji0AzZLNiXicJFFRGNzj3
TLSH
T1F0859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 129b819448d1b23c551a4d968d914f3c4071ce05933158e6b161053c13a359ae
MD5 4ef0bb5f00a0b7eed4c553db2b8d8db1
SHA1 12c06c362f66f0e34ae16301dba1354038c91aa3
SHA512 1b2c5c73d9c5352b8a4f659e4dd9043ac9a3eca08d7b56ece8af9ac16b13f50d3f6fb91b6e18c24a5444c835c6207d74aa6d8375ec40d38a8ca51e2d35f2cf20
SSDEEP 24576:6a7/ezSC6vUyD/aqgrvWj6q8wyuK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:t/ezSC6vUzPv+HjyFLNiXicJFFRGNzj3
TLSH
T1B6756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a8bfcef8736c6382d3abaab8e6f034fd599f8975bf61179bb9e193d4e698fc18
MD5 0ede668d40a54a062894d20bfda11602
SHA1 a81325e5049f1c109dd003e592a45b9d2789f848
SHA512 550ab16a50fc67cf5c0e6325278c4223aa0f45c87c868877982af52326ef04f34c70d866bd31a05e648bc29037df241fcdbd9839dc1a3a841bbaf8c56e5744e7
SSDEEP 24576:JVbqPb88hv/l+Bf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JVO88hXl+5LNiXicJFFRGNzj3
TLSH
T1F1559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 11476391e8105deddea8fae88c32e339adb0307dcc476d71481829405d9566c8
MD5 0c9e4899ca194e8b8770b272d07e3b87
SHA1 ae52e00717837f3618153edfff97b1b6c38361a3
SHA512 d9589b23eb413473c5288cfd2df0a5181844e26859e712116668ef44d2d9742e56ab89c8f9af2e05a67ddaec439909d4444030d61c173532a9bf0869a59168f7
SSDEEP 24576:pGs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zLNiXicJFFRGNzj3
TLSH
T14B5523D3468854B1FBFD003A867A5828B5845E2C8A595DE3D2543E5EA13CFEBCF38123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 d999a6d378afc8e7db4b68f64ed96d756fba8983b93a7f4a003844cacb1379a2
MD5 21d021864718433b6e7bed506fcdc3d3
SHA1 4239ce85c90c327fe1911cb386c40ca381a10a49
SHA512 c5be72ae88107d7f4c26df6c59aa84f4510fc173b8b3a84abf326a58937102f3ea556d1f2c451c00916c9a8e232db245efab00b8d2b27d33a202b94ca014d358
SSDEEP 24576:TJIUn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TJIUnLNiXicJFFRGNzj3
TLSH
T19375CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 5db6b1adad102f39383de0bd1aae725771bcc5b97e42ca553210e08d79edcc04
MD5 38fa18e1ace32bf885e74d9e4dd3812d
SHA1 896b85af48707aa59b3afd6f10b3b5131e82c9c3
SHA512 efa7b4a26b01e0033cf1bf5cadea3198d1ee3d2a2bdc68d383b6e63a3f8b19dbf7710870623c68a2bf407e4a301030d81a345a65fd934c87308f6986b517366a
SSDEEP 49152:SQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THD:SQvGAdlCEL8c/WRNw5C67wRGpj3
TLSH
T1A9266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 7a5b1ba8c018a8fac4bea949f99c40be53b26c8ac4c296039ec53e98889822b3
MD5 2285391d6f3be4be9770ad5874763c87
SHA1 bd3c9cf7a72d779871b5a4b0b873477d3ffddf92
SHA512 b1ee94dda04d9adceaf8945164d041466a78423c7a9fba54d5a017cccb5c89ea085e940f60c759258c30d0a0d536afabd13b4f817600e91a53e2fae41c5c50c6
SSDEEP 24576:PfewsAjJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XljJLNiXicJFFRGNzj3
TLSH
T15575E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ee21b9b714b14c054b92d4a2f4ccea1623c09a678bbeaccefce2791d8a134325
MD5 6f8b2d1d06c90de08066251bdd5625df
SHA1 3841194d33491cd06324c72155643dde76d5360c
SHA512 192a2f2dbf187711879f04a9d6e89b13a5f557ddda5de5de6b4bd1a9410952f1fee7b91460334e2249e469072a340fce4a3645c3c2028da039f6afd6c7049465
SSDEEP 196608:/UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHFF9:/UEtQevvqc2W1cpV20I32b9
TLSH
T134474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b84095b42ccfee9c7141ddcaf94dc6182ba2ebbb56e02d7611d5697fc51b6c5d
MD5 1d9d02c31bd2e67bea66702a8f38d9d0
SHA1 06d0cd95330c4e10da6b1ab66c9b3aabbfaa328a
SHA512 1198a7b7cf007be5ea310f5573c19c9d608780b413e64ba7de91b53f340f5fcc623774be807f47a4308112ddcb210181f55e2299d6bbe2397713ec82fecc6f7e
SSDEEP 49152:KCbRquA/m2yL5zLfFiV+XenmE3/zpLNiXicJFFRGNzj3:/oq2Vjnm27wRGpj3
TLSH
T13ED58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f4a8f2e3d53d9234dd3cf1ca78b5ff682e4a2eac007aeed708e324a4467e61c8
MD5 ee210f5feb2f4ad1189e93b35060d6ac
SHA1 ba0e746551b0d86104d37fe9a83e21dcae11e413
SHA512 895cc42c4b6c44ccc8695c857f85eb88557b50b557bd6f7b9760385850ab74c45929db581992570685575bb0b137705d7d2c8df01d364ee8548a64c303e8c8f3
SSDEEP 24576:IAhGL6IFoiwtA5l7S53W/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:IAM5Foiq5mLNiXicJFFRGNzj3
TLSH
T1EF359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 96551f8adadd536044e200ac39b890463d1ed95f469cad8af51f4e39528a5bcf
MD5 f45f3dfabc63a9cf3e3baeb6120075ef
SHA1 9fb8792ebc6f2ac5e80ed79b34847e64824b15ac
SHA512 047f5fb6115183a97f6bd329aa04146b732923aa50834af6b37d5976a961ef39c490c3d355967605b22ca4b9d81f00b4e60b141625d15fa6ed10fda57f07c865
SSDEEP 24576:wwuROWl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wwSOyLNiXicJFFRGNzj3
TLSH
T16A65F08632980CF9E9B641398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 f210132d4fd24131ab9147a99fe4b0b4394c0a7b68ac066f52ecdc337756806b
MD5 03be8206e2dd65982dc6883a51024497
SHA1 dad116d345c8ed8b0d1bdde71ff9fa5f434d728c
SHA512 5618c88ff6e981a6eed7b0ac7c8099894903809d25d5925a139bcb9c99827e3c968117af150d959dbcfb7128f432d51647d04c27e9e28218750a7232cc251214
SSDEEP 24576:eZuQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ULNiXicJFFRGNzj3
TLSH
T13D55129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 de099dcd2a68ed6414da5a4501ff2c7bff73f9a6cfb6ce294eee35656a0ff3e7
MD5 3e8516c27e229b81d9c7173a2dfa0e29
SHA1 2bde253258fe1ab750881a9c14c59e0b8efa5da1
SHA512 744905f19c1c1e9356420e061a629d7fa1a9095020732b3a469f6d4fac88454cd233bab70d486067767196cbadbf9974c64862b9bc1bb9b67c437e9ecd2d4ea6
SSDEEP 98304:eQRQyi36YOcPDLvw2gAf+PN3j7wRGpj3:FQyiKanX+PNHF9
TLSH
T1D3667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6171527ce92b3b90de1aff0d5af991761b97b0ca09668e965f576c306c73d307
MD5 13d4231a5c84cc3936c22f5c4eb4a648
SHA1 0ed7c136130a503225cf84e29aae3532de118383
SHA512 87fec83cc0dfe92206d92a34c4ab1781ff405edab75e9ae8092c50951e7a993798597430fa389b929e3f33b3d2b52bb91c02aaa408ca749890300ba12312ed3c
SSDEEP 98304:hQRQyi36YOcPDLvw2gAf+PN3j7wRGpj3:4QyiKanX+PNHF9
TLSH
T139667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f1e0a77a0ff2de4d7033de9bdc608c0382ea2ac6053f51f103852a87ded97cf5
MD5 3ab019c87ea24990a0bc72e1cca496e7
SHA1 5d77adaccada9a8ef04712ad44013f8cb6f52e8c
SHA512 4cd20308f67c40c38cf8a7288d9d345d8491f52f8b7f82fdab95f4ec2c78bc19dd712bc9a8ce15d00126e98479bc8ffce89395a14aa4e19cbd1757022b8c027c
SSDEEP 49152:U68Qg55nhkeWu7PNU3/ZLNiXicJFFRGNzj3:+thTRc/Z7wRGpj3
TLSH
T18CB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1373282c513aace86830128c142c5c0de7a89b301f98e34a700f53f773150bc2
MD5 7fb98148fd0dc705c33c954d2f00b51f
SHA1 e54202459f2ce95d0f1dab72d1017bf04cc8239d
SHA512 65b04a42a00dd9458e2feb87fcd926478b9da32c7c6af0b48b9a1e00b30b9df59f63c8bb94041d98332d15f34521af2fc2ad7c2e5469e65996b6315b5937e856
SSDEEP 98304:Cy5112gYy5azzVvU69nLKnhZs7wRGpj3:LLIHRWhCF9
TLSH
T157167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 30ecc483cbcbfff9c6b72f9ca3e7d97361e7ec11b0b8d73d3b914c8360457fea
MD5 7f14c3aac64bc57741d7fe629b4d011f
SHA1 121eba417c6d66b3eb55389d21ce2f024532b851
SHA512 6e161409eacbc474bb91b5b567b13cb995a828e6c4438fd268ace7a85b3e82e70f0aabaae222b90932b49a3edc8519667bef884bfb8387f3b57fc0edc7886bfe
SSDEEP 49152:oB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glrLNiXicJFFRGNzj3:iu6JmIxd2dr7wRGpj3
TLSH
T14ED59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 70832d558062dad0fde271f14fd4c6d0bb35d2fd445acfafbde31454a21bf2a2
MD5 ea90ce1a7f86520c2a5bde3e096fa3f0
SHA1 7059b97157bf421f089a3f399530e318d5aa6242
SHA512 843cd657ef4928b3870229b092fadb81971214a1ae51ab06cc8e033d806201a3cb3641ee8669c941e3161f0764cf0798a401c6fb58473bd18d879d4a9940f596
SSDEEP 49152:41hpsNoJpF1A67U44CwH7R4xHLNiXicJFFRGNzj3:4mifPqR27wRGpj3
TLSH
T1C7B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d76dd638e8b523a70c187535228f9c7f28e2ba9e418826f9c296b35fe4b7169a
MD5 069a4898b1d832957e4f4f36ab24270d
SHA1 6d31ec1b6d3af86f40645360534b91fe1268fe19
SHA512 5991e0015c476fa670ddbd6aa62aeb483ad257cd2c8d9f6b696ef4c78bb2aadbcfd5a5a597fdc24873a9e72e2364b1cbe1e229dc17e49200369dd9f592163a6b
SSDEEP 49152:jSuZQIY0Be2KkRVtOnks6NMHqQLNiXicJFFRGNzj3:B5dKqi61Q7wRGpj3
TLSH
T19BC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 939d78412c9e03eaecc629c3b532a3130191568f96cd992e90c5c300a16d6492
MD5 173c5f31312100450ec5046979f03ea5
SHA1 ef76a11b78fd1d329bb41a9ba95b7650b53f46dd
SHA512 f902d9a5bd9805ed378b592c29ce8272ce52ef79b58997ae76937409a5f079b9d5eb92c3b2a365400ee0cd1afc096a9ea2650b466c5c049b5be44950c0a57a08
SSDEEP 49152:ghtSn8EApI0figjgiDn0AP5wbLNiXicJFFRGNzj3:xX2iWphS7wRGpj3
TLSH
T1ED95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 75f41140bef8a72dd104e24471107799aac049e0150c51233025f7d2ff00ff8e
MD5 f44158cc4a038d58a4e586d023d69d0c
SHA1 89f568bcc3aaeab99ba68e8730464a4188e577b1
SHA512 6e77d83c3c6560222a8bcb14db277b9201b15edcb930d3ce7f61ab776945a71b4d4c77fc54633763d94e98a44fc2ede877b0431d91276c3466089c5f1da24c25
SSDEEP 12288:LSiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:L0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14D5523D3548955B1FAFC0039C6754428F5882E2DDB5619E3E3083D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 072826e8cb2d449744ccc83dbe84d31a4028792474c994e2704187668cfae388
MD5 bba20006e81a56d5076ed865ae6b4d7f
SHA1 943c238756583463d4ab3142dcb17dd799897ced
SHA512 1b05bec9b02ed9bdd6cd089445f6ccc901070e6aeb3ea6ced6fa8b46898cc040e4aeab851d5705aad392b42a26c147d093c0b7f2f198702830e0bec1882847d4
SSDEEP 12288:BxiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:B9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DC5523D3548955B1FABC0039C6754428F5882E2DEB5619E3E3483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 f7ba7d8b814dc7c0e2a1c44d99e1b55b2fb67b16ec90a5e4b75476d12dfbf41c
MD5 329dd9c93f4225bd0f4df648207d106c
SHA1 a9d4d4ee77e9cf66b4357d7f1c387c2817446fbf
SHA512 e8c0a6c80d58dda75d692160dd6b440bd92df69dcdbb248055e7d31531b75f5bbbc7df91cef70e552a6b7fccb7e8d3d580f3c9b5ee1fd5a30a20f18f9bb20611
SSDEEP 12288:p7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:pv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AE5523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 2d1ccb82649ae34b946d2ef1f2585e3d4851990b81e1c3caee14abe6b3916ad8
MD5 6417ac31e0845bd9c4739f2c41e0343f
SHA1 da009605a76c28b70361a917dabaa953f359b9d0
SHA512 137fa9c31a57d01f4d2ab43c2fe7c47314cddc2543e6e1d8bf60434aead0f79e9c678b295c612899fcfb52017d2971b2da49730821ce25b1534fc34645da712b
SSDEEP 12288:TVMiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Y/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BD552393168901F1E9F98039C6764424F2A47D6CD7325AEBD3003D1E5A74FEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 06ec7dac171cef39e9e123aa644429aefedabc3d9ca77e40ae82cdb97962ba54
MD5 9c4c226038cc5bfff4d840a2552f9f9d
SHA1 e141295d2b7c3fdba509aed72718103891cb101e
SHA512 e361384aabae36e4b32ba43ecdb6c1169c5f3817b6fabb05234fd6691dffe7f81a03336234f15632faac52180f97336b5f8dd5e65783af07b8b9064eac00fb33
SSDEEP 12288:bEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:bO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14A5523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 3a92ed3d1ac4bc2a68b804574a9c78ee7df460465b6c1ac7bee0ebcb2d7419a0
MD5 409665570b33322c81bb54a9cbe5ea80
SHA1 c121dcb23d8be98301a5646522b854eb4f3d96a2
SHA512 31a69b8f50a91f629970f6ba72cfbf88cc3c02561ea3e9ddab70a26af909ae82cd7a1ef87d99ff2b4953a687e165ae45514b788b1084d3a64fb190a984ca03f0
SSDEEP 12288:TtiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Tx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13D5523D3548955B1FABC0039C6754428F5882E2DEB5619E3E3483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 d883d9e67d9821028ee9ae3ada60bda550e10f1eb4e09f916b557190799be84b
MD5 c83a9e6ab37a24dd1c4e5e07772df8ba
SHA1 b1bc44eeff888d562a38ba8e213f5dc60894876d
SHA512 42f71bd21be639ab0efc96115fa6f74088b92d172b0ab17811df82da075df8879f64140ce66bae6ef9b7a6da603f9c6b3e0cf0b03db662c90a8cf95234e8ce28
SSDEEP 12288:epiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:e1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BD5523D3548955B1FABC0039C6754428F5882E2DEB5619E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 60d15013fb17984e0bcc9046404552982bd1c5125a3a96aaccfcd593f2037514
MD5 4af76612e0f73c8c63d821c638e4a2a5
SHA1 fe27961680ae9da3a86ee08dbe128158ab493982
SHA512 123059679b883d033d0a637e940aa43137016d2dce98f6129581ffde1ea1088ab1d9b943b27699f3e59a3080ebd9f201663aaf6d880060c676e1f1e5d323d28f
SSDEEP 24576:EZM3zFVSOd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EZM3zfhLNiXicJFFRGNzj3
TLSH
T108750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 1a4590f621dc98d5a07274aa765fbc10b8958d239edf7f2c3c8a173eca3c7952
MD5 5d9da9b6795b98dac131f214224bd972
SHA1 cd35798a62386dc4eda60d1a1f86eb649cb40091
SHA512 0daa0b22ee8e87abb50ad1b61b05eba87fd577d582d2296a376eeed9298765d257ba05f1cd648b6eb06dd06d0b1f6b40d1b10ed44d3dd8d0eedb151cc81fbbac
SSDEEP 12288:U2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:UA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1235523D3548955B1FAFC003DC6764428F5881E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 9f7419d9cc6cb16731d3ba10167bb5a9b3a2043f32bdd210c3e0dd98574e4de0
MD5 e719c33dbac39f99974c1de96636d61b
SHA1 a40fddc535213ce2b4b0a1bb6ce25fa75439974c
SHA512 5c1782736321088fe7fb10a0eb370304e2f22a941fb6ec730c4ced0446d5e6b143fdb4c982f8c17edf303c810b46447abb5e386997ac0e8e0c09bccc0f70c79d
SSDEEP 12288:z6iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:zc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1315523D3548955B1FABC0039C6754428F5886E2DEB5619E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 6511366c3575a55c15c687964634085f138f0f1f10feb170461168a875f16036
MD5 6f40630d9fabb619fd202808929f7844
SHA1 f9f82f40c1748821b0125c6417502ca7ccd3a409
SHA512 2eb364b8547171fa46bf692417da7f34a41d8cc7a4b95d6681860ccc7764ad802e0cb51f81150f7fdb890831005f2fa4c1d82f4589db96d1c18d14500fce1916
SSDEEP 24576:4zy5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4SLNiXicJFFRGNzj3
TLSH
T159650247629530F9E17A8139C9620915F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 66a2b668660cc66f827814078964d07ade131653ce2092a8df323f00baa333e6
MD5 22da7f8a7d5b99cc6f635ba755c6abc5
SHA1 9e63c8e4beaa60e0c6fb4572e41941665895c445
SHA512 eb15f84d88a24e3258cdcd4ffb47bb8d077490dcb65a7d959820d326ad9c2bb1d17102dad6523a40fc37aa2d52dffa0ea09ffeca9b092b49a932e633c1802f31
SSDEEP 12288:l2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:lA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17D5523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 eb535471b38b4675543dcc1ff66531cf325bb9e3f06a81729dc19814bc5ef512
MD5 3691f37f7285f6874520f04fdb08649f
SHA1 f9462d1d0804fd8d429a2188dbf0ee33bb55afe4
SHA512 9dd93439eb8d05c17590085548d8667548d6607bb8b197799febc309fc88e89974c161921af8e020abcacbcb5429944746bf647601bb5aec536d384a128ec980
SSDEEP 12288:P2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:PA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1955523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 9d39b65959d20caca34fda39755a999bd90ff69e3c5ba4294196274e271c00c8
MD5 74ddfe94d0f0c53ed8407f17c47db2bd
SHA1 90958e9537968b44f39237383e013cc2d0d7e826
SHA512 0a095e92de65d40c284055247eca07266d316048c7bac855cc98c74f40f0911d3de1c1229c8e8ad265635d5552a76ebaae8cab6492204cb0aa849e896bcc2da7
SSDEEP 24576:dzy5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dSLNiXicJFFRGNzj3
TLSH
T1F4650247629530F9E17A8139C9620915F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 3cee98bca482e2735bd89901d49a6745d520c20b4ccced14ffb7143b7fdacbc9
MD5 9ea6e3827cb184457a767108034bd4e7
SHA1 a1913d06c0340ce60bed0a77d8c55bc0a9f48f9c
SHA512 8b44c38f001405a4c6ee479cd12c168970d55c2f12abfc4eebd54ae05751cfa27716ccc9fbdd7f3335636367f575d478a8619c404f6a9650a0e83e5d7af3f916
SSDEEP 24576:rT8aLl3z0zD//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rT7LljKLNiXicJFFRGNzj3
TLSH
T1667502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 d347274596bfa36e355f8935dfdb6804cdc4d8f3a127d6e77ea0cd1ff4fae190
MD5 c36f0eaeb08ea5263448e7640e325768
SHA1 db5b1266b6f08da428cb67cd419c6a603b04bf98
SHA512 340f365ce101c40ba7aed8e60fe482f7e688ab5438279b43b95560fd15a2abbb518b86a5214b1e36da4bd0caa7881ccd2e4a75774f6c58a01a71d23cd5189d84
SSDEEP 24576:D3rd9CHKy7GZD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jrd9CHKyahLNiXicJFFRGNzj3
TLSH
T1F985CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 99006e35088c81d3c90d901a24b01e5e0b379d9435df4192f34afa90e8d49037
MD5 d828764bbb746cd86bb5ccb3be8c7dd9
SHA1 a04c06a967b69d6f73c80c21cdb354bc2915c804
SHA512 a498f274c991df0ebd642e9efc3cd570161d7a2763a59a2250e197e696b84b96a802052a4ee5587bf530a93f851856bebc7986dc553a6b898079103fec0ee9be
SSDEEP 12288:WbiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:WP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A45523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 a3885854e769389f936035c4be3f63416726aea92cf97a395f482bea8e5970d8
MD5 2854f6fbe49473b7cbac4bff636d6e7e
SHA1 6241306daef14f95cc2c72737818966387a77088
SHA512 df9005b1fb9e19f4c949c7cd66094a8603cf8af760e21995e171b6d81669fd0dc01cb120ec93c20c6fdedb7b344bc0780090508ad3f6279225db099a4a833116
SSDEEP 12288:s1iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:sZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FC5523D3558955B1FABC003986764428F5882E2DDB5619E3E3443D1EA278FEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 8a0390cda9b0bb8d0f194d0a92e725003b531927ed1ed45b27439b5d7ee61229
MD5 da3ac7f054a0bb0650d2a3d117ccaa9f
SHA1 42510beb102c9705846d3822ce1a7e564e3039af
SHA512 a09abf1ae2bd1d338c2647b7f5c9b4fa640fc8ff34545997322c7c55e5c523ba391d359cde20d920632f74e9d1093a4f32626204ce4b8580dc151378d704e8ab
SSDEEP 12288:3QiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3C/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1415523D3548955B1FAFC0039C6764428F5882E1DEB5619E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 910416836efb253cca347f8b875eb44b6fe6ef3101e79473faab02bc1605905c
MD5 993136e85ca668b3df0facc956ece28c
SHA1 585a2bc8586153a99125bda615e4f7356ca67fac
SHA512 d978a6f2a5aa534681d199bfcad0dabc3e9c8e02c0249c81f20cccb8829d0f4037a37e79d8daef59bd57b4298e5418a32f3277fb5fef0afdccb036196c7cd86f
SSDEEP 12288:02iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:0A/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F15523D3548955B1FAFC0039C6754428F5882E2DEB5619E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 debc4a062361330e4a36ea3e1a30cc1f9a3d9fd886021bccf28fec3430b23f74
MD5 f92eb5b96b40ac97b635db34667ad5fb
SHA1 d3a9d58ee31b59e9412778bba2b1ab2b6f404ae0
SHA512 f2d94bf32f3096fa46ef2528acfd463d5cc7762ece8f8c113589d7f3174f0a5aad19e88f08d129037e43e7fe000d6fbd2f1b3e3aa5e19842b706b390666686f3
SSDEEP 12288:gbiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:gP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1655523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 d4f4df0664a554350f3045e7b406d99e49f95be6e66df36df8dc5d9927f39005
MD5 e10202fd3b65c0f1bbdcb7f70f2ec098
SHA1 fb8cbdbac4cde9145d2503466c0ff8b380265a9a
SHA512 71fabb2d7a2ef92713b433cd26aa84bbf21ba9cd75f168cae1d71788fc30619c40c5214b5112061491a95ebe78752e4828a505272acb3719f1edf238202562bc
SSDEEP 12288:ZuiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ZY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11F5523D3548955B1EAFC0039C6764428F5882E2DEB5659E3E3043D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 72260f5802f079b311bad8f63d1707ee6019cab29d96ca70a6d0ee9e0093c5d5
MD5 59eea1399c521d6a5b073b345c7ef6b0
SHA1 c88283144f5e494f25758436bd8ece60d38a1d6b
SHA512 1bd8b0fcc74f850a1feb13f3d5a38989a18e832ff319ed4e4b63e967177c30fe49f6b21a118316b383bb7ba4b93eead8c83e7fbbba213fe694939787665ede9e
SSDEEP 24576:Jfwvzk9RX6wkyAIM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oMnYIMLNiXicJFFRGNzj3
TLSH
T11285DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 83e463cc6522c098c14762b7fed7fab015a932ef266119aceadfd08a38f906fa
MD5 6a88e98910eeeca2f6e140723a4c78e6
SHA1 20f05df812ed33347c3368a31dc8f8a1d2360b5a
SHA512 90c2584e93b1e0e58a0f705f8fdb4e6448c13747fee13e53b8e49bcbe2534029e4b32bceaec3b1b404d6aff1c4053488e8de20927a932ca8997463526de6955c
SSDEEP 49152:oYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK07LNiXicJFFRGN:nySzPD7wRGpj3
TLSH
T19B066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 1b64edd14d299554bf436ec1530a0579c96c52044c360948791b59c377242ffa
MD5 c8119c0fd3a17f3b6fd9d48797a7d98f
SHA1 0c9977f5dfc7cabe4fc12891ef9dfab57bf2871b
SHA512 bdd0a553e352bc7c1ab7826ff0ed6aa8ab30b6f1499b76faf9d56051bbb1993f134b7ab03a7a0efbcf790c62770afe74e08d60f0d9155828a25c69151d29cd9b
SSDEEP 24576:447Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:447JUQjqirIhCnDHUPfF/rLNiXicJFFS
TLSH
T13F65AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 337bfd11442a78e49cff7308c5e4ea5c1eaf16897100d66f0abfaf355b627cdf
MD5 4c78235f5ec10d4c4431d7a597606fef
SHA1 3807f96e2453c35f362ad662a8fe044dcc19d591
SHA512 181c796ba51b42e9d7bd560cc7fefda71e6c596ba25f4716b3ae6adcc9c0b66200aecffdc9698d7069e0a86e81a66183671faa4a39092b739d615f0b310a3aa9
SSDEEP 12288:PpsfmiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:gQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17865F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB92D0F93E1F79AD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 d268a3da856577b142fd2ee98898111b779c82f6266c960771f5c2e8d239e28b
MD5 586d53e08512e5b686e7b6a10797b962
SHA1 644e36961cf7c7c23b03849324744c6458657cd9
SHA512 d0d134ee54f03e29dc4efb98c661ecccc205ed6261e2ec33676476a29bffe85d748c780bfda2fb4e4885a06edc035234c5e0f53a3a76f24050f10fbc6a3ccbed
SSDEEP 12288:qtrNdyU3foVn/ZYJXx8Iugo4J+hvEVZiJtBiewA24RaRZblVb:qNNQUPCn/ZYW4JAvEVYJriXA24aRZbH
TLSH
T1DB551740762AC79FC6A990321E36D6CCA7707D01FE056F1773C8873E9476668B6F6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 9ba2a64106f090ae69d5894541ae626bc90b7cb5e3051d10d3740e03a8bc9134
MD5 ab2ac3215ff3623e0e7ef72d503cb6f5
SHA1 472aa72e68f9bfd8828d2781710f1f068baefc05
SHA512 85d5bbb1b90146c8205e3e224773d6e466e08a2333bc5d791dda923eaaa47ab31a0985b777f11f97e5ed2f659f6dc073d9f241b2dc748b7a7b4a2959fbb7f018
SSDEEP 12288:TuW/8yGU0UEaTy1stWeGXasQqTLyM9XZriOeWPZATiVQKWWuaOviiT:TuW/8X3X20oWnTZAWRVQKzE6iT
TLSH
T10A551A41A5A7E35FC9FE90770632C68DBB745C06BB453B0173448A3C8877A7EB5E2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

service_update.log

Path C:\ProgramData\Yandex\YandexBrowser\service_update.log
Size 1KB
SHA256 e7855b8e4af27f534629c6c602108fb61fed62c9a1c1f65dd7f36759f2716ed7
MD5 3efe901f9a964c9f09fa1cef43ded23b
SHA1 3d0f40dd357958409161b0dbf2257f47bfc0a10a
SHA512 e473624de39649ed00681fd2852eb5bf5965fa427565965a0b745b553025026a4e6fe27bbee4e1ac71f19a85bdabf9e03f2db2d9472b26661d5ec4d461252498
TLSH
T1C23182C9907D0DA2129C328BEB744D5F9B90F5A03A5A02B175E78DC037B34B37E2D659
MD5 SHA1 SHA512 TLSH

Submit Download

service_update.log

Path C:\ProgramData\Yandex\YandexBrowser\service_update.log
Size 2KB
SHA256 25d992d5ba5f5e8c71139101d9a36a611849aa2b3b78f8f3bc49740bd9546b0d
MD5 229006f40501c0b8cdfac29bcf75b8d4
SHA1 ee7349ebb21e8b09b8b169dd5564d3ca5ba8fb79
SHA512 7f544c3d334f436f568cb51b54dba013c6ae1f67c4af240435d9f1d0b932f6fe02ba27002b6302498f998c62e22a93a03fa05d775ac4b3307d8d3fad18af5b0f
TLSH
T1E051A0D9907D0DA2524C26CBDBB55C5E9BD0F160352A01A175E78DC07BA34A37E2D258
MD5 SHA1 SHA512 TLSH

Submit Download

6338b16ce62f061e.bin

Path C:\Users\Admin\AppData\Roaming\6338b16ce62f061e.bin
Size 12KB
SHA256 cd65afb1dd43b2ac1ba44a8f5689271482480bc2a4996f00b41abe60b2088c51
MD5 391e08a6b98845ff6b9cbbd13ef07482
SHA1 dcd0e27a948c17c2f364eecdb709b76c69782709
SHA512 d7366bd971823fdb453bfebe36b8a835388f7a5f0e267411920d61a7e7db59d4e304cef33983ba4f5c1a3e564143d27707a06cd538c25f5c977442359bf032df
SSDEEP 192:5iaF70FpQ2hKDNyyFBat58nMJZPGfhzub633ZmNEdqd4zIF0XXE:9FMp/KpyKfnMJZPGsb4ZKeqdn0k
TLSH
T19142C00BC630603616D95E916A6DBA91484B3B458318D339BC4F9881B2E99ED6FCD3F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 3c9cd77fa11836a9bbdd6a46bd117074107f4b05c74dd592d265bcb2e1cd41e1
MD5 05d96c2e116a213d1e96da031faf9f8f
SHA1 ecec80e302a723b45cf519dab4dcb1ceab327194
SHA512 c7ec4985cade64daa3c897c9cb8ce8d040e09875a6fd75677855ba6d0f20d71a14fee62157572a5c655ea79e884523515cfe32955b7e1e29250bb3679e3015fd
SSDEEP 12288:4F7eiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:co/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FA552393468D59B1FAFD0039857A8434B5497E2C9F1594E3E2043A5EA238FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 881a01db16f5862abb332ce0cfebeec0217cc2fbfdb08dc0466ad4a0f8afaa41
MD5 424fd3933cc02b2b436406ff92ae61b2
SHA1 0a257d57018a02a46ea5f68690ede8d8b9f7fa69
SHA512 bd89ba4f1d37047a713ec332b66bc3075ccc58f42d48b73b73b3fc966431b6101fd3cc0d39076c7dccc940d7083eb712c1bbfdcbce6fda95dad5efc69619f023
SSDEEP 24576:egb6bmBIi49WNNFpg1rSvFv7bYK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:egb4mBIBhGFNLNiXicJFFRGNzj3
TLSH
T1BD65AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 9017f08532470b03d4e06feac41a5773a87cae77566ceabcbf69bc665f9e2f27
MD5 356ac31e6366e4346f9a5f4069ce377d
SHA1 a0ef3ef7385a6ccff8c4ab461867b66a5f5bfd20
SHA512 f7120915d5f27c8479d2a56691501f91770477aca2798a7e7cd145eb22d556e17de0bb589c57172fc137f58a016c6e04eba9d812723779bd8882fa61dceb2d19
SSDEEP 24576:1G88u8FpJqH1vzria7/md/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:47ZFPqVya7/iLNiXicJFFRGNzj3
TLSH
T18585F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 7a72ccd49495c3ed7d06812cf2edc51ed21d05c34018e2827dbedb0df229e3e3
MD5 b78f1f82884dda65ae6f749af37dfb3e
SHA1 7c38d45689b8aad06581e0c48edafc0416a16e52
SHA512 4fdeefd2b1e7f5631eda25b1109ebc11a7c96c0007edd1d3f22e3cde10913ddfbc4693532dc73aba22baef49eb2a0c07654549b718d7b0aebb0451c1c34c8f1f
SSDEEP 24576:kPUr+NQh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kJQhLNiXicJFFRGNzj3
TLSH
T13565F16F22DC18E5E67AA03D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 42947d449ecb85c07c4abcbe368b074c01e1df2c5b6b44d9ba5768e46b803ab5
MD5 96cdb8fc9f1b14d9f0481ef0739e2eb7
SHA1 1ffba9bb3bf196a93cda6a84f24c70b98b0ab286
SHA512 6b876df4dc99b350aa90f2ba6c0293dbeb909b4b4947da5bb677b4be45116b3422e3ba3cd3dedbe4914941e9cfcdf00380d9e4d83ba4f832b2eb815549245d23
SSDEEP 49152:OBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjxLNiXicJFFRGNzj3:RG05lO43bk7wRGpj3
TLSH
T105D5C06A62EC11F9D1BBD07CD9C6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 549c8fdcdf0531f1efd7e36606287153aa55ef4fe3ca4c79c8ec55d37e63a573
MD5 9125de96ad500b6e2c1be2dc5c24e188
SHA1 4ff3e0e68c07b8f7ba60b5f76930c2d77b41beb3
SHA512 bf19f1d84ca9b70c6ab7f41aba84bc9de9125be6f24cf403ddbc0b4047043342df466fa052d4b8066afb63011bd4ff8e4ef38ee2708256f7bc03c7ee7e73fd16
SSDEEP 24576:Ffa5POZ3dpyWVM50JicR2hG0lasx2+47eidn7/TwSfVcYG3K/cJHlnFR+IGNe8jg:Fa5POZ3lJt2pasx2+mZLNiXicJFFRGNf
TLSH
T19F65BF5EA2FC01D5E5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 5ca526e2af307283f887d7e887c3b4e6d9170048db76f6edb42d0266c2de3fb1
MD5 ed60d1cb24ae4929e72a5a0cbb986640
SHA1 3997d0461991dc367f51e6183ca57d8a198c3949
SHA512 f17648ea4265580ac2b80124b3b73640e7aeb21bc388f2c31f5341456d78c3118dda13b1be34e2cb9f40500a256f9b462915d5d8d7a22a2dd185a2583d324e26
SSDEEP 24576:uNcwHdjbyQ4nLC18lb/EOjowL7FkF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uNc/zEOVHFCLNiXicJFFRGNzj3
TLSH
T1C0858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b2a37c21c0641376e167dababcc12803641163ef4d1fcec5d9227b579923d36e
MD5 e83712272fd4f5c4ad896dc8c5813fdf
SHA1 3f22131bfbe4a8227711ef5f7741f2ec3968da25
SHA512 de23c81ff74d9934f9e4532f3d7669d3fd59c8d27f6163ed81e556eae962f1792e837fe0b7aff0d0959a2c665f1a5a02b8f14d6e333e2286c9a39f048d8c44f5
SSDEEP 24576:lzkNvNnaFeYhJNtmZBm3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lzMwBtOm3LNiXicJFFRGNzj3
TLSH
T1E355AF6EB6E846E4D1FEC675CD238512E6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 f80900cd27df64fa4c3d6e4e735d803fc44bd9ecb621c9f98e795f46cd5666c8
MD5 2beb91207a5d103709c413d5b4981aa2
SHA1 418a2067e2ade5b5878516ce26800976a9031484
SHA512 bfeea0ed5943b05c2ba092e977340618bfc4b1b47f4de18763308c21096df08e510aea53bf8ef985d1d4cf12cf75999b0d9b63fa52b2e7147bcc43acdbb7bd52
SSDEEP 24576:UD3FHshBIYQgAU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UDVHeBIAAULNiXicJFFRGNzj3
TLSH
T19475E17EE69C04E4E57AC17CCA638906E77138AD032265CB029491BA5F6BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1392-33-0x0000000002370000-0x00000000023D6000-memory.dmp

Download

memory/1392-32-0x0000000000400000-0x0000000000630000-memory.dmp

Download

memory/1392-356-0x0000000000400000-0x0000000000630000-memory.dmp

Download

memory/1392-39-0x0000000002370000-0x00000000023D6000-memory.dmp

Download

memory/1392-40-0x0000000002370000-0x00000000023D6000-memory.dmp

Download

memory/1392-122-0x0000000000400000-0x0000000000630000-memory.dmp

Download

memory/1748-335-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1748-112-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1748-113-0x00000000009F0000-0x0000000000A56000-memory.dmp

Download

memory/1748-118-0x00000000009F0000-0x0000000000A56000-memory.dmp

Download

memory/2596-351-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2596-135-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2596-142-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2596-349-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2596-347-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2656-156-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2656-150-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2656-149-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2656-348-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/3120-96-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3120-275-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3120-89-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3120-90-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3260-50-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3260-51-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/3260-57-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/3260-60-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/3260-147-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4204-177-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4204-352-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4204-183-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4204-176-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4272-63-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4272-201-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4272-64-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4272-70-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4280-160-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4280-171-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4280-167-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4280-169-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4280-161-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4688-80-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4688-74-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/4688-86-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4688-84-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/4688-81-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/5216-130-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5216-129-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5216-415-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5216-414-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5216-346-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5216-123-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5856-6-0x00000000024D0000-0x0000000002536000-memory.dmp

Download

memory/5856-0-0x0000000000400000-0x0000000000630000-memory.dmp

Download

memory/5856-38-0x0000000000400000-0x0000000000630000-memory.dmp

Download

memory/5856-1-0x00000000024D0000-0x0000000002536000-memory.dmp

Download

memory/5856-7-0x00000000024D0000-0x0000000002536000-memory.dmp

Download

memory/5980-321-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5980-100-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5980-102-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5980-108-0x0000000000800000-0x0000000000860000-memory.dmp

Download