2f0ebeb5228f5ee245c8c69a40acd653e170b5499f6aded2e8a03534e1389568

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 14:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
Size 2.2MB
Sample260802-schcsabf94
SHA256 2f0ebeb5228f5ee245c8c69a40acd653e170b5499f6aded2e8a03534e1389568
MD5 0149262876387cf96988c6714e32bf11
SHA1 c8f9f329da2dad2c04adceeba29a0a443f32bad2
SHA512 0501434f1301ffde1d9b435282627e3a083bd10d0dc02351e8a4e2b7cc947c0390dbcf288d888fd0d845bb95f4e3a111087768db2ec7a460278957b28302035a
SSDEEP 49152:P2stiiXqvQ9HXXx++kpBASZAvYAWXzc5Zd3K2z7+EVo:eGX4Q9HHx++kpBkv7a2/+E
TLSH
T1A2B5BF12B246C073E59316B1726D6BFA5AAC7D3417B154DBB2C03E3E58301D3793AE2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5788	elevation_service.exe
1816	elevation_service.exe
4800	maintenanceservice.exe
2672	OSE.EXE
6092	PerceptionSimulationService.exe
5392	perfhost.exe
3520	ReFsDedupSvc.exe
5328	SensorDataService.exe
4548	ssh-agent.exe
1268	AgentService.exe
2828	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\NeatDM = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe -autostart"	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4cc3c541e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaws.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004ecd6c838f22dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cc61ae838f22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d76a00848f22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000164d93838f22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3836	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
3836	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
3836	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
3836	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
3836	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
3836	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
3836	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
3836	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
3836	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
3836	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
3836	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
3836	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
3836	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
3836	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
3836	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
3836	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
3836	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
3836	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
3836	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
3836	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
3836	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
3836	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
3836	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
3836	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
3836	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
3836	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
3836	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
3836	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
5788	elevation_service.exe
5788	elevation_service.exe
5788	elevation_service.exe
5788	elevation_service.exe
5788	elevation_service.exe
5788	elevation_service.exe
5788	elevation_service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3836	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3836	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
Token: SeBackupPrivilege	3520	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3520	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3520	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3520	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3520	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3520	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3520	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3520	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3520	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3520	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1268	AgentService.exe
Token: 33	2828	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2828	SearchIndexer.exe
Token: SeDebugPrivilege	3836	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
Token: SeDebugPrivilege	3836	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
Token: SeDebugPrivilege	3836	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
Token: SeDebugPrivilege	3836	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
Token: SeDebugPrivilege	5788	elevation_service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3836	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3836	2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 568	2828	SearchIndexer.exe	101
PID 2828 wrote to memory of 5996	2828	SearchIndexer.exe	102
PID 2828 wrote to memory of 4444	2828	SearchIndexer.exe	103
PID 2828 wrote to memory of 5252	2828	SearchIndexer.exe	104
PID 2828 wrote to memory of 5728	2828	SearchIndexer.exe	106
PID 2828 wrote to memory of 4472	2828	SearchIndexer.exe	107
PID 2828 wrote to memory of 3020	2828	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_0149262876387cf96988c6714e32bf11_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3836

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5788

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1816

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4800

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2672

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6092

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5392

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3520

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5328

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4548

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1268

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:568
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5996
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3020 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4444
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2972 2964 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5252
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:5728
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2972 2964 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4472
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3020 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a7f44d28d3dadc10a580e56a9f2a5108231c882a956ec626a6be5e562c852437
MD5 be3788c997075ed9cee5945e8b7448ad
SHA1 added5a8cecc651e674b353c8e00ffad984ce3db
SHA512 71edd2f7405d46b0b86621a5398cc260e84504fa2d7373cc867b4d26ca68cc424598e3ae6369713ab6a0532646de0043dece2e14fb7ca9236f4f9b64a7732587
SSDEEP 49152:rb+632BuPkFKRrdE6ohdstBhuXjfS4LWxn53K2z7+EVo:53q6mjBia2/+E
TLSH
T165D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 17a0e704a2a69b655508b23a566dccd8b706869c37863722c31720cbc75246f7
MD5 54754be719fa9f20cc73cc5cbf477d02
SHA1 9c7946cd775fe058a93174faa0d84145f8d0e3b8
SHA512 26c6eca2445852eefcd5fe10c24ed68be8a9bec444829867a18eef207580a15873263b8bd8255de8ce877882515eb425d643ecab8c33245e8f07a20d653b2262
SSDEEP 24576:AXYfDtczAwPptKCDzLHfojswenwLQ4A49Me:3tcP3K2z7+EVo
TLSH
T1B465F12873E504F9ECA7827DC8A28511E632B8554760E7DB03E49A360F377D86E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 0938cb8167a8694e0483622a9ad7a64249381f4c42b711be9eb5a9e2516727f7
MD5 be3ddbdcea02d14c5258925da624ab96
SHA1 0783832dd7646fab8e76219503ba57829f09d252
SHA512 e01e87efbab673d634e7c7af92aa4a1f1b99b6479b63f679d7683d49105abfb6845c254b677f9973711df1fc656b27aa13406ff81cc7993892ca3a990ddf98a3
SSDEEP 24576:l0Le5ji0hmx7rMBPptKCDzLHfojswenwLQ4A49Me:lPji0Apw3K2z7+EVo
TLSH
T1E0859E15F5788335D073C0B9C5D2A69AEA7130865B308ACB4286D77C3F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ba23a22d57b5219d021855850979a475f7a3b546731aa82769efeaf496b7c47b
MD5 c114d44cafdcb716088a3ab356225cdb
SHA1 c128292136e8ce97a0104bf311ec04f93ddb7368
SHA512 d97ab7e7d2c762e1cdd61cdfc14c9015ea6802d7ed7a71ac4c0cd569cda55ccebc4634e6cc75a2a424035237056ce74511eca79114a204d45d42a8325cf189b2
SSDEEP 24576:wa7/ezSC6vUyD/aqgrvWj6q8wyuXPptKCDzLHfojswenwLQ4A49Me:n/ezSC6vUzPv+Hjyc3K2z7+EVo
TLSH
T11F755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 61d8000c216f48d5ce123dc6000d81cfee59e65a8dfd6466dd768d8c925fcfcd
MD5 b45243a9bf6f5be081924794b7d16c24
SHA1 02eb2f2b94d344c53d843928be230cb941225744
SHA512 fb476cab73a0dab46872dfba86839afecf5a664f7a69502c5ce944d7c7e00f4327be4c4311e7b5f3325cf0928db31fd1d26cc6f4b31d7dfeb879036b7f574920
SSDEEP 24576:9VbqPb88hv/l+BEPptKCDzLHfojswenwLQ4A49Me:9VO88hXl+Q3K2z7+EVo
TLSH
T165559E65F5748331D073C0BAC5D3AA9AEE3234425B318ACB0246D76C2E677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 ea71fa2db589a29e6e41db73510a8746dd2dfaff8e9058383ba4cb498924d60d
MD5 b4581fe3adab4b922bf1f5c5489f8300
SHA1 9878c9bd0e7f60df32a2ceb7b8f7e1e2ef67889d
SHA512 4a20e187a9b77b7002a7a71cc4274950dddd1b5fe8e78294ed92f4a21762c369c81cc837427d078d770fbc4f56624fe5ff1fbad60e3f883f9248f365d68f95c8
SSDEEP 12288:gI1PpHNKCDzKWHe31xHO45c0mojsw/kVa43iDzLQCYHYA49Ada15L:gI1PptKCDzLHfojswenwLQ4A49Me
TLSH
T129452304106E00C7EADA87B125DA86A1632CDC744C822B97C699FF3A057F776B5FF219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 ac009975e7816969fefbf71c4b35e7d62fe6862c81b7c8f3a2b4793e8aeb6eb8
MD5 01a5398a04b4c8aa51c189eb11bcc2cc
SHA1 1112744232074c47309c8dd377786aecb82eba25
SHA512 2a48561002d446b4e110c4f6f0397c189005d98c4e8db32aa53c500ab409d4c47485cde6a9f8d0587d059c826ffca77073a29080c4530cce57c46bc097856d53
SSDEEP 12288:AeBNUbTVO86UcPpHNKCDzKWHe31xHO45c0mojsw/kVa43iDzLQCYHYA49Ada15L:AJIUcPptKCDzLHfojswenwLQ4A49Me
TLSH
T17C65CF3BAD28FCD2C27E8DB956918640E77278304F52A3CBD165C30E8E275E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 89fe3156222a90b9b045852bf19fe421c3bcb04aec37e02d1484f058fb993fee
MD5 81f3f0e277ebd7f60f84cd8e4e59914d
SHA1 464be0064df61b8e9f89ea810a38a54c3e937349
SHA512 bd733e38cb84240031c1826d51bfdd32685182d22c53e35b49a4225219a328e824615c78d06d7bccfbb75eba5ece8166e56297fcd685b8742059f0cce51f5de3
SSDEEP 49152:9QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THP:9QvGAdlCEL8c/WRNw5Cva2/+E
TLSH
T1A9267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 1b50d6b9820ab7ad588223f3ea36aaeebdf8b91147e762a968d2f681f10f1cab
MD5 0d4bb792139c342a086c7082705a240f
SHA1 33cc7feac8f43870b6d188fdc97a6361a85b64d2
SHA512 cc247565c6b5de7a7d5c2a0926c76a5217235742c5c5d35071664fdc607b167cba3b1b7465be857fe6ec95cf4957ecae782370ee78d1ccbc74312cac6cc39543
SSDEEP 24576:PhewsAjqPptKCDzLHfojswenwLQ4A49Me:pljA3K2z7+EVo
TLSH
T13E75E030FA75D036C6BF0DB61B66C716143CB9204F521AC3E3E89E9E59342D2277AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e6e1abe26d63199f03c7a518842d83e05550f16c2300e074aaf7957f4b82fd8b
MD5 8166b11905c9db17570dff6a7613a283
SHA1 5aef957f1d4196e9d62ea0d99d2ec1fc57eb2df0
SHA512 a2908569b265c821a1f2177e5657662e17e4c3db2dd5674002d932aafcec8adf9e1199405d66ac9aa17853778b4e1202e4455606c083848452284220df74ec77
SSDEEP 196608:WUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHYa2f:WUEtQevvqc2W1cpV20I32Ydf
TLSH
T19B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6f164090707f22aa5cb0208c04dbca75db492524d1a2cf8456af37102d5f4266
MD5 9746dfbb7bcefdb69f553e13e7054439
SHA1 1ce68958593d6bb3ecc6be21a594af54ea14d557
SHA512 dfa86c35d8161fd8deb6672136ef63934c738a80eab0a8a7d56250f7dbbc595fcc40750dce8d095692ced7c0d5405e45576b303ada6e4ff34744a51635f2a7a1
SSDEEP 49152:LCbRquA/m2yL5zifFiV+XenmE3/zg3K2z7+EVo:UoqHVjnmra2/+E
TLSH
T1D4D58D0976B881E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 182423c612d9b5b916ab8f2d5d951325cd47f9e0850256e2302a126383c1c00d
MD5 848cefd8d0edf7d7f85cdc00bb8888e4
SHA1 7261a0ac4279ae08369b2bd5937f7e138632bb60
SHA512 9d6dd0b29b6cdd5d865145e58ed22f2c37dcee58693a3d908ea9b76cc5ff60b4e8ecd260ba083edd7553e182270cdb2c83140529a852189912ab0d040f1b7e4c
SSDEEP 24576:FAhGL6IFoiwtA5l7S53jPptKCDzLHfojswenwLQ4A49Me:FAM5Foiq573K2z7+EVo
TLSH
T141359D80E7F945D4F5F3AAB899B68171EA76BCA95E31C20F2150D21F0E37A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 44758edf3a3987559756b9636356832c84c91aa2c104fae472172607aa7d8c4d
MD5 a9adbe503b1aa5dccf4561e50a8d8b65
SHA1 d123c93a53149dbf2946a9a372cb72603fbf08b7
SHA512 71b6447827d1acfe7059d2b73db5042a5d1e15c0ae33d536d705f7bc4492c9f4697d471d9b55a5524655bf19016f9f38e1a814d742c34185a53d4171dfa41824
SSDEEP 24576:ewu7OW2PptKCDzLHfojswenwLQ4A49Me:ewoOH3K2z7+EVo
TLSH
T11765F14532A908FAE9A782398597C536F7B2BC112A21DB1F4760C71B5F37361BD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 76b0ce310c0e43c76fe0a908c6308ae4bea07bfc092a834a39569114b600f0f7
MD5 f0b6dd9b79bd83addc8da46e11632a15
SHA1 cbfa996704137f1503dc10df6158bd7bd793dce9
SHA512 02bf9bf59438d332ea0065403936e33f74f639a34c5ca6aff5d646d4bda7ca3101d33b0932d066a4cfd77a72333955061be5d3fcc2628cb0e9b56cf1b23eb052
SSDEEP 12288:3EZ1IyaPpHNKCDzKWHe31xHO45c0mojsw/kVa43iDzLQCYHYA49Ada15L:UZu5PptKCDzLHfojswenwLQ4A49Me
TLSH
T1AA55124832E920FAE5E7837949E54641E375B861177203CF42699B3A1F37BE26D3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b7880b1885c1d2e19fafe0b1aba730d0e9c547db3913f26e5f603d0266cc9511
MD5 d41bd79cb985ec1ad40a2a21ac322bba
SHA1 161bdc8b9ded3be83e65af2bd2c875c6cb1b51d3
SHA512 5e48439d0ee7966f314dfc873ce7675bc68720e7da0c85148dc3b64fd2e0c3fd45088dd4b90996c2591bb16f0f05cf74828e4f650ac5d2375d9cfdef6e8d7fe4
SSDEEP 49152:jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Ur:yQRQyi36YOcPDLvw2gAf+PN3ma2/+E
TLSH
T151666C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5b2e966c8b297742f833f23469be362dda9989dcccca455c3d64104e6395b635
MD5 094bd0acec58241157963d0fa5a2bfa7
SHA1 e81b3f8a9122ed5ca47e8109171ec0c9c06ffb23
SHA512 eb3829b5e75332de17d031deda1b3a799be526f4bb283b7eb1ace5fa86a5f9ada9b7e09286e15d1678ab6259369cc4a0a65bb01ba7c2f94aba2347b96c2fc941
SSDEEP 49152:aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Ur:5QRQyi36YOcPDLvw2gAf+PN3ma2/+E
TLSH
T154666C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8e1235d2e009882f67f69c4b70183e94c5dda7b9ef51158c4aa0e41689bbb487
MD5 bdb847aa022cb1580e64e611b19ff688
SHA1 432d01871db9dfef6ca4b6526c97e792e7b6a2e1
SHA512 511db5cb27ad1814359fdd12760cc07476dfe24091b3a000489d32ff8837dd35203df98ee1a17a243af26dbed09ec5fae1b4007f96a50d8d05e71c8b8077f48c
SSDEEP 24576:9wvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0JPptKCDzLHfojsu:568Qg55nhkeWu7PNU3/w3K2z7+EVo
TLSH
T1EDB55933B2F60099C44DE1769F4A873196E17C758FE1E3DB8501721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 bcea3b73e4fe610bcb8a83e4b8109088aa49f82be9a9f7270015a23143f9a9af
MD5 c307cc7b4e17ace600df693fe0019573
SHA1 9fad1f8542e0e71a7872c4cd167516d4bea5b46c
SHA512 95215ece451263021034a099c438672b031e1debb36276c92ca657bfcb2676916dfd66c70911582aeeb26a812d4cddf626689b85dd3a3860a5534ec695dd119c
SSDEEP 49152:Q3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99Z:dy5112gYy5azzVvU69nLKnhZVa2/+E
TLSH
T148167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 da112de9962211a544070f1dd3d6a5d9ac1f1088493e14f3bd3c0a512dfef786
MD5 4d73f7b0807fc20ec3063c873977f09a
SHA1 6c2abc4bd4f78fe799e2e0d2caf6b17c274c06c0
SHA512 4e96c591f8a3e58b5d460d77b3adcb55908ae8ed167b8729d09409fa320d3a328be1936b2da4074e5a3f00bf03bfa98311783e55c82f7e864c30b1779f32d603
SSDEEP 49152:MB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glu3K2z7+EVo:Gu6JmIxd2dua2/+E
TLSH
T1C5D59D13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0aef5fb1cac856c01856259692bc1cc15ebc28d6542ceb5c2f030d66da826d55
MD5 6d9449d931e59daff849be0924cf93f2
SHA1 a35705597cf06cd9a94855b9df47ea60f2403bb9
SHA512 966397871890435af78dcde1466cdcaab16d768fb42cc43c0a9519c2e1ca90b46e0da4b92fe902b532695a5fd37ed82e27a90731769fc66341ee169187222720
SSDEEP 49152:H1hpsNoJpF1A67U44CwH7R4xa3K2z7+EVo:HmifPqRra2/+E
TLSH
T11BB5BE13F2D900E8D06ED17887569232EA62BC450B35B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 089bbf88082a57446836aee3e448effe0a677530c5f215c5cb9890e0dc5e020a
MD5 2289c80e44037f08d9842d30b7e5d01a
SHA1 07d40426700d81db11600ddabb285ec3c56c2c0b
SHA512 98a1eb75a5398fef8ab80fe6d6192cc40a514791a9ffa4b046ab93ebf471bb08d14ecfb550d7fc730e28e295f72881b59f7010bd3bc61ad03d034a6d40e34de9
SSDEEP 49152:ISuZQIY0Be2KkRVtOnks6NMHqJ3K2z7+EVo:S5dKqi61Ja2/+E
TLSH
T1A6C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 89310d5cb26696f45c670211f81124225fe1c845ba29d751bc4f1d46a211fd92
MD5 81884adf6ca6a2eb9afe0b844829933a
SHA1 e2e0ef230d0699abb70de1a91a779a76e22321ee
SHA512 1f6fa1dea8b242c6a06cfa20b8ec5208fc1cb09192ff781479da65e65d0a00f17b4e1ae2f78c641fc331256a4bb9f279f233ecf915f6ed60f276c931e49b5d29
SSDEEP 49152:qhtSn8EApI0figjgiDn0AP5w+3K2z7+EVo:LX2iWphna2/+E
TLSH
T1AF95BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 000400ee117b7c6f3dbcced53736cc13d8890405150b7b443f2244e4e50bf007
MD5 7ac98145f1d3b2c0e6be2ae913b5625f
SHA1 6a887b42f319970a468ee578606525b4a767562d
SHA512 980f79999939fed8398479761e7d47cd48acb64974bdec7472662c297984bf135037a41728fc22140b04c382a6de2e108a07cd52362c7238506dfe4400cc1da2
SSDEEP 12288:OtPpHNKCDzKWHe31xHO45c0mojsw/kVa43iDzLQCYHYA49Ada15L:OtPptKCDzLHfojswenwLQ4A49Me
TLSH
T1BC45230420BF00C7E5CA87B115C68691A22C9C74AC83279B969EFF36067F77675BF258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 e42b7da862633ce082c8bf32b963db0b32349f35351bb445173034428ae73373
MD5 1375c95323f23f1c50fb5b3f5f854b88
SHA1 a6576dc0049d37ce77002e3194da58de65870e43
SHA512 c828d8ab18afd0a0088bf4506b19d820bac71e4a6b72dd2aa798becd1faae67a3b70bfb22ff5b0cfcfae6dc2f46a607356ac5ab9764f0eb064a17b881748bac0
SSDEEP 12288:UePpHNKCDzKWHe31xHO45c0mojsw/kVa43iDzLQCYHYA49Ada15L:UePptKCDzLHfojswenwLQ4A49Me
TLSH
T12C452304207F00C7E4CA83B115C68691A22C9D75AC83279B969EFF36067F77679BF258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 7253212b7a921110058877f8b5d80e7b3c7a7cc323302a6246311731a316ac2b
MD5 9c90708e5936473d79363464e71e5914
SHA1 e668a71968e6762a0cc9cbc36adf3ba2945fc9d9
SHA512 c005749980f68ddda240d6cb363ad78db97f0c557809e8c3cf59c7964a534b8673cbfacad5cb127766d5900a87e3aff443a24c3edf03fffadf6f1bda9230df4d
SSDEEP 12288:eUPpHNKCDzKWHe31xHO45c0mojsw/kVa43iDzLQCYHYA49Ada15L:eUPptKCDzLHfojswenwLQ4A49Me
TLSH
T120452304207F00C7E4CA87B5158686D1A22C9874AC83279BD68EFF36067F77A75BF258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 1c76ba58d9e75631c0546c7988116a73a092a57b6b90e2c3e84738bec67b0779
MD5 c131119ee17f5d3c90995296d538c93f
SHA1 ed4c487ef3e96cc330ef00e024b0520247555221
SHA512 fc7f9f8c21d81cc54277ac845cf1ada422efc6a9907839801018e1b39f49f93e0e4af5da077332c4fdd01f186adaaea41c7a3ec89d3a05642b9faaa53e828314
SSDEEP 12288:kVDPpHNKCDzKWHe31xHO45c0mojsw/kVa43iDzLQCYHYA49Ada15L:YPptKCDzLHfojswenwLQ4A49Me
TLSH
T11745230420BF00C7E8D6C3B545968291E378BC749A1227DF8685AF2A0E7B7B579BE714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 ad5dbc675f0fb42b0dd1c50ea569696e07f46be061e3766a7eb8c5c02b132a39
MD5 0eebd4dd7b2605c0cdf286bd57225001
SHA1 01d8e8cb8383e87fe96147460c97e12ad2a500f2
SHA512 80d922a88a3e88f08f8735822582843ed59d513e598e6dfc81cc16515995762a46cec18504990cc3b389997a186c4e43e7ceec3a8a0c7247110444d6f3e1fbd3
SSDEEP 12288:VrPpHNKCDzKWHe31xHO45c0mojsw/kVa43iDzLQCYHYA49Ada15L:VrPptKCDzLHfojswenwLQ4A49Me
TLSH
T185452304207F00C7E4CA87B515C686D1A22C9875AC83279B968EFF36067F77675BF258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 8ad6144d29c6c2e3ec81dfeb78bf6494ffe868d25558d29f40e2fc7b2769718d
MD5 4a26d228b9a2eaeb262e7106e209650d
SHA1 5809a4124f5ee7e34f3095cd69b1909921bc6387
SHA512 f77e8dc1e32c0a9ada7fc265684f0deb8d54621ccee2414d81a621ff5fc8919f7f55497ecaee5b4a9b1a547edf26bc9a7c53917d708ca68444fde44590c470a2
SSDEEP 12288:eiPpHNKCDzKWHe31xHO45c0mojsw/kVa43iDzLQCYHYA49Ada15L:eiPptKCDzLHfojswenwLQ4A49Me
TLSH
T110452304207F00C7E4CA83B115C686D0A22C9D79AC83279B969EFF36067F77675BE258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 b59891a3ef2d25f3285f45447c52298c5a22d3e223e796ad714ad27acc6f0b8d
MD5 5313e8d91de8ad928b735f22c74e3a71
SHA1 2023f07a8169457f502e0ed1f10e1ee48c908459
SHA512 9e88ed5210a5dd535a17b1ba676b682ee4c8f4a09e4c088a9da17fef438c9af0a42fdf831718cb55d313f098d3ed16f7a5b20e343cab40ae89ea977cf3b333d5
SSDEEP 12288:uGPpHNKCDzKWHe31xHO45c0mojsw/kVa43iDzLQCYHYA49Ada15L:uGPptKCDzLHfojswenwLQ4A49Me
TLSH
T168452304207F00C7E5CA83B5158686A0A22C9D789C83279BD69EFF36067F77675BF258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 3332f88384038c2b16b6f28e9f97810b624f2f0562356194f77b74cff437890c
MD5 1389b34f3efa99bf60a77e5b1c13ce95
SHA1 bf7c81a0bb0d84f292185a0dc9fe8d6a7d52ca36
SHA512 07bacdc4ac2e96036e0825956707cd2574e32180928370b5b788fa563f59149c2155280945b4fde49a121ef9ced79ecabb3b3694b408591de1a74d989b2c25d6
SSDEEP 24576:fZMxzFVSO+PptKCDzLHfojswenwLQ4A49Me:fZMxzf43K2z7+EVo
TLSH
T1A565029473A508F9ECA7823E89558916D2B2BC690B60C75F03E837271F373A11D3EB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 521546652ab957b2ee0aeec9a15f42f4e1134b476f9dd627f98e98712ff4d565
MD5 b4f0b0c7d6eb9675f227b58620d5b4fa
SHA1 7aadd241fd5e733208ad8e6041478599edd853ea
SHA512 723140cea6f0b7526d03605bb80bdc3281642877ad7c587fe016e1a5c1a322485e503f979557ed9aa0c0cffe3a651d5f2925b5c311592be7048ad8752ac51ac9
SSDEEP 12288:LpPpHNKCDzKWHe31xHO45c0mojsw/kVa43iDzLQCYHYA49Ada15L:LpPptKCDzLHfojswenwLQ4A49Me
TLSH
T1B7452304207F00C7E5CA83B515868690A22C9D78AC83279BD68EFF36067F77675BF258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 4ee05895da1e5cacfdb58160f340c5ef8e21d73a8a89f8f2a2ca27749b64f9e7
MD5 b69fe79fd9d0f36d65c69c016f4e96ed
SHA1 8670514d7570bc391b402f59db7771f8f5f50f01
SHA512 49e66428380162ea7bc95f1710661e756b5a0d38a3108adaad37a77bf18a9bed3fa07841a38e6cb3a6d13b92da1039bc6adb675da9caad922dc3e722b2bdb397
SSDEEP 12288:JlPpHNKCDzKWHe31xHO45c0mojsw/kVa43iDzLQCYHYA49Ada15L:JlPptKCDzLHfojswenwLQ4A49Me
TLSH
T177452304206F00C7E5CA83B515C68690A22C9D78AC83279BD69EFF36067F77675BE258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 7cf27661301f9ea69ab84d876d77c2c1aaf66db840b92052b585ae26c82f011f
MD5 ac5eaaf3d695adb3528d47e1f4ca2405
SHA1 7fcc58f93b2beb243ce8ba1ae79dc95415ccf28b
SHA512 3ef18e38a918414dcef7d2c35def8abb3ae676bb6e5e2469b061907c382e50bd38f1d62549328fc10ca3573e7f64c766e031d802de4a214b34563cb86adfefe8
SSDEEP 12288:TyPz5L8aPpHNKCDzKWHe31xHO45c0mojsw/kVa43iDzLQCYHYA49Ada15L:ezyaPptKCDzLHfojswenwLQ4A49Me
TLSH
T1A955020732A620FAD1A7837988920A41F375B8354B215BAF53A45B371F377A16E7F720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 00c93d569f14d14758d35819ae9e1a411bfd5a0314624c4a8ad372e7c7d1be8f
MD5 a9449d60a7403653481d2df38cb5d53d
SHA1 461d575e0abd6f09b40a466b5c3694199f9baa12
SHA512 59a58e32844db198a69e6f958fab0d67e518574adbeac49b977caefb68d767773640644ac4a808939afc0f146f623f878d3a8d8d96caabfce863fac7e5e5bc2d
SSDEEP 12288:5pPpHNKCDzKWHe31xHO45c0mojsw/kVa43iDzLQCYHYA49Ada15L:5pPptKCDzLHfojswenwLQ4A49Me
TLSH
T172452304207F00C7E5CA83B515868690A22C9D79AC83279BD68EFF36067F77675BF258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 2e2cfca8309181ff97aa69e9d2f8baf8a98e286086be206edd840fd54468e0e8
MD5 01e924e7ad8e785119d3237ed94a5688
SHA1 b1dad10e78b52f4164211e180f85136c832347c3
SHA512 ed254ecc29746397221c78f26313adf251f8e235ba70a5c2da014ba52cbf9063456cd8a47ac2949625387b4a1114f76fa22a3f407c2438c94c1e4a2095acf168
SSDEEP 12288:mpPpHNKCDzKWHe31xHO45c0mojsw/kVa43iDzLQCYHYA49Ada15L:mpPptKCDzLHfojswenwLQ4A49Me
TLSH
T1CE452304207F00C7E5C983B515868690A22C9C79AC83279BD68EFF36067F77675BF258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 b594bf83d92853198b34aaf5d3e3d2d30174774c7793046c1b437417b93439f7
MD5 dbcea088db64535952e867d2be606800
SHA1 8c7bd24001a23af4e777a39e86300a454a29f77f
SHA512 1638a7dac796f6628e2f73cf0a958485ae86e0d70d4624f0741f1645bb634db73c93a10dd8e4a68845716a2885be2ced2dd134787730fd9e78c6d26127774bf3
SSDEEP 12288:vyPz5L8aPpHNKCDzKWHe31xHO45c0mojsw/kVa43iDzLQCYHYA49Ada15L:CzyaPptKCDzLHfojswenwLQ4A49Me
TLSH
T13755020732A620FAD1A7837988920A41F375B8354B215BAF53A45B371F377A16E7F720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 279604e9190866b878a2c137d8034416281893722768d34e64db31a08e058c0a
MD5 352c2654f1f7f1d9d101792932740846
SHA1 baa22dfdb85a92e7fcb9ebe7f5c03f77e1d88fa3
SHA512 1b51ee3b0cfd7fad9ae52611b5a10b7526c4c63792d7b65fbaec6c1373ec847748b7c7727d6936c5a27e0af6f35bc678fe5b2fa42ef2ec2db942b5e26dfc7f10
SSDEEP 24576:NTeaLl3z0zDkPptKCDzLHfojswenwLQ4A49Me:NTtLljf3K2z7+EVo
TLSH
T136650294736008F9ECA7827E89568956D2B2BC690B60C75F03E837271F373A11D3EB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 b20dbd6c7b5a3820edef7eecc5141e6d780ce4725dbdbcb97507ebc519dfc2a2
MD5 9c2d9232c8cd966c899ee9a9e4c2e4a9
SHA1 2c18cb2f6604e74041335cccc658d3b76f5af3ca
SHA512 b2b9bff6cb5a5595807a7448cf3872528c9701041a38f15f4f260a9a94578fd7b2982c95afdf57e48b2ee46c7137fa2d5e6a7d0686a0aaa8d5bac89aec8750a7
SSDEEP 24576:w3Vd9CHKy7GZoPptKCDzLHfojswenwLQ4A49Me:6Vd9CHKya43K2z7+EVo
TLSH
T1C175CF90F3E810E9F0B7CA3589764511DA767C691B21DE8F03A8661A1F337E19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 024c86f71ae8a369ca35d9f06a3d35661d54c17f476b1a4f547aa6828ae83b4e
MD5 419e7721dd18975054ca27f7e5d43c36
SHA1 2315f8177b9d31d68b35121dc862f15de512346c
SHA512 de2aba18b158fcc1b03e794975138c767ad2f47edf6a7bbbfe8cb7384599f55cd72d60b3f9df00689f23a46e68d0bee287e51b0a930ff9736aa53ac0fd877296
SSDEEP 12288:r0PpHNKCDzKWHe31xHO45c0mojsw/kVa43iDzLQCYHYA49Ada15L:r0PptKCDzLHfojswenwLQ4A49Me
TLSH
T183452304207F00C7E4CA87B5158686D1A22C9875AC83279BD68EFF36067F77675BF258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 8d1ba753602ef11fca407029e760628a32985d961dc39eb086f096e517446752
MD5 ab3556bd75ef9e0a2a5b352c05e23a6a
SHA1 2a53cbaa9967451103db0764a0782551a8981cc2
SHA512 6b36c97f77126814712d880758db526d4e6d16c03a49244bd5657957c8243c5360f14e80bd7a56457aa7d9fa6387fd3eab4fd189e4922efd1edd85f399cec4d8
SSDEEP 12288:m6PpHNKCDzKWHe31xHO45c0mojsw/kVa43iDzLQCYHYA49Ada15L:m6PptKCDzLHfojswenwLQ4A49Me
TLSH
T148452304207F00C7E4CA83B515CA8691A22C9D749C83279BD69EFF36067F77679BE258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 7d47a2fd760c728e8b180b731dd0bf5b54b42cdf35c5014b8b1ada682bfe0d13
MD5 fee2612831e276111b8649b9a56b7d7e
SHA1 cbde02e2e7b7c6c07e6aea36a8dc809d912cff2f
SHA512 e577ea27ade2e88cad601659da8f227c38903cfd16af7ecbbf1230e3b79fbbbfc099a7f9a668badd4c5733235112fb7c95069a4db797f178747a1cce52e61cc7
SSDEEP 12288:O/PpHNKCDzKWHe31xHO45c0mojsw/kVa43iDzLQCYHYA49Ada15L:O/PptKCDzLHfojswenwLQ4A49Me
TLSH
T1BF452304207F00C7E4C983B515868690A26C9D79AC83279BD68EFF36067F77A75BF258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 91696c6beb63cecece716ee593c31f32c3ea30d16a8ea95ca9b4e92e90bcb8ce
MD5 092606606ae3f554ea1844fa88e4923d
SHA1 3189f67f0f410681dbb8f1fceefacec62170ec1c
SHA512 342493f8691ebc36b6e1531b7d76d111b39cc8da08e0066d1829ac01740688368b23aebc4f7880be051285e112f04fb7748006f928e0d7d97e7e144dbee74f0c
SSDEEP 12288:wpPpHNKCDzKWHe31xHO45c0mojsw/kVa43iDzLQCYHYA49Ada15L:wpPptKCDzLHfojswenwLQ4A49Me
TLSH
T155452304207F00C7E5C987B515868690A22C9C79AC83279BD68EFF36067F77675BF258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 b3ea54d65195425973f841f35b6ca43508a3a8480534447a744415de80e8eb23
MD5 ba8b08d91df74a880d094b628ab0bc9e
SHA1 eed1216e949f0420eeff7c79bebf6ac6a64b07c2
SHA512 4db9fa825e0395079cb0c7ec741a10ee5c7d4d16391149e1da37b15b537716e4470346807539b9a2f07f520e35cc7b7a165ef6c70476e392a1150de725300258
SSDEEP 12288:q0PpHNKCDzKWHe31xHO45c0mojsw/kVa43iDzLQCYHYA49Ada15L:q0PptKCDzLHfojswenwLQ4A49Me
TLSH
T106452304207F00C7E4CA87B5158686D0A26C9879AC83279BD68EFF36067F77675BF258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 8598bb05734a9578485c449308bc13f8b8dea6bc6f07d53086767be8128e2be0
MD5 8ffe8ea0e19fe01cbab3139992a31b07
SHA1 03870f0736aa631a226d9bcafc4eda84263a0d9f
SHA512 182cfb2604a07326433834c42d11d67857a074b0c10db67f7a71ddfa65f3e0decf4ba064de732b702c1ddf81c61175f9863f2d621b7049609df506fb2b104bbb
SSDEEP 12288:7RPpHNKCDzKWHe31xHO45c0mojsw/kVa43iDzLQCYHYA49Ada15L:7RPptKCDzLHfojswenwLQ4A49Me
TLSH
T13B452304207F00C7E5CA83B515C686A1A26C9D74AC83279BD68EFF26067F77675BF218
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 7b3f6d448cda86c8458a755dad89ce59e0cda9e6d8960769a413a4d3e9c02fc8
MD5 530e3817d21cc23ac04388589e80c4d6
SHA1 8ee3ab0ae96093a4a5322523965866342d56765c
SHA512 f271e28d2b19c320dd30392da635b16591d3db3653c64143262d1d18d37efd29b611e3f6f95d75979c025e909f80d3471160a95450894f9f2d8dd2e54dc2a6b1
SSDEEP 12288:trPpHNKCDzKWHe31xHO45c0mojsw/kVa43iDzLQCYHYA49Ada15L:trPptKCDzLHfojswenwLQ4A49Me
TLSH
T199452304207F00C7E4CA87B515868691A22C9879AC83279BD68EFF36067F77675BF258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 ce1cb3526ff4cbb66b58ef6d9e072dd62b672cf249c3223ef6d0c86b4c3b8b39
MD5 bc2f817bf76c4701469c92607edecfa8
SHA1 ecb0051f6bc7a20eab2786d3a139dbdb03395111
SHA512 fa94480212ba07aa9d8aecf6ebe04a413f429df618c4937d874f82622de9d219d15ba1198718c431641f7bd672b4978dbc2c4e6f37ea5f9ab68f9c90702b6efa
SSDEEP 24576:efwv9k9RX6wkyAIVPptKCDzLHfojswenwLQ4A49Me:DMnYI13K2z7+EVo
TLSH
T13985C029EADC04D5E1B7923C99B7460AF2B178691B31C7CF029A536D0E37EE46D3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 03c51a2c26d74f7bc494ddef0803042bdd1452ab8fbf53324837e95ab01b909a
MD5 34f7361ee9d0eb74060c3a289cc48319
SHA1 576af1552588f44a0c8e4fd38a07b16668f5fa91
SHA512 03cb93638acc45b8bf7c4d9301094b74403e104a0115e3499d0e3b6d3c567d56a6391e66d5275b4cddb153d02439231ab6f218783d905113090971c2fdca154a
SSDEEP 49152:tYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0e3K2z7+EVo:cySzPGa2/+E
TLSH
T183066C56A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 783102e98d73620f81055d5c202a85422e052fa3b5757c6ce8caead0f13a0b10
MD5 7826f9e25e965616ff44bc71f5b81f73
SHA1 940c1933cdfcb590f04672e3360c323efd7301b9
SHA512 0104888b3e7dde188214f55fd7e6be0096c65fa41201d43da1bfdfc29076fa676675f23c07be486a40895cbe46f865b169ae795e07d113a3fd2d1441a1c07b35
SSDEEP 24576:v47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYuPptKCDzLHfojswenwLQ4A49Me:v47JUQjqirIhCnDHUPfF/u3K2z7+EVo
TLSH
T1A165AE1DA3EC01E5E1BA927885154A5AEA71782D1F32CACF12B0837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 cfcbdf16d56985c09129e1fa36c54bf9d058330da7d9bb1ba25dfc4a69a32021
MD5 5312a88d01a9634a53f2b43e9cf4205b
SHA1 cff0585472bf4e25d6f80f83dff46d655e9fd8fe
SHA512 b3896002ab55c9da855dab301cab7d0efae88d22142bbe4bad3d7cf37e34fe39e505fb5027bdd1f07ceaea57f11a9c6e8200d00f83dbfb4c935aa1b5acb52b23
SSDEEP 12288:mnsf5PpHNKCDzKWHe31xHO45c0mojsw/kVa43iDzLQCYHYA49Ada15L:N5PptKCDzLHfojswenwLQ4A49Me
TLSH
T14E55F109D1A801D9D0AE9275C7964A41B3377C2587E293CB53D0FA3E0F7A6A16DFA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 896KB
SHA256 72d7ac437502eaf22c03e7a25e2ebe90cf1ebfff43c7cccfcd14bbcc2090525f
MD5 215942d774456a66d64bfcca2c702036
SHA1 d60f28cd6c06aabc0753f0b17127eb34bafaadc8
SHA512 1564e3428d9c780eb1ef430e2ac45ec92ca303457b72deb7047f6d6ed91bccb3da1b833925b1baa5bdcf1f993e672643fcc62a522b6a541c0b1d05a3e8c2770e
SSDEEP 12288:Wby+dU3fTA54dElIZRquep3ykbJGJb4g:W+uUPFClOquU3/ubJ
TLSH
T138151710766BD75BC6AD40321E33C2CCAB707D42EE059B0772C9872FD576668BAF2192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 350KB
SHA256 25f8df2af778dabb5337ad90a2d31acabc8bd556a6c08cc9c65e43787caabe5b
MD5 2acb3a41d231b42cc0955119a2d1bf83
SHA1 d705fdafdaa15186d9391ab0da7fd8fd52cae66e
SHA512 66dfff762d04401b2c8ca33defd3f9902f0e2afb1f544085d3af765965ad880617f176d8ed86936088c17fb20bd2e973b85876960bfb64624efa7d9c243ebe4e
SSDEEP 768:aEh/T2slToOlTPBlTz2+EQMFEhDwh/TWFnslToOlTPBlTz2+EQMZFfaslToOlTPU:qu8GX90mMJgHs55Z/oXpK8tK
TLSH
T14774D611B758E32FC4BA40774531939F9B79B8239F1213073BD81E84C8B325A3676BA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 52998f8c7aac6bb8ee7ace43301dd71689b7960cc374baf6eac1f29db52cc54f
MD5 c13140dd1ba80f1b249088fd92e9e732
SHA1 83e76c69feb93234a869429269bc2fa3d7478e9e
SHA512 083ef46d1794d630035e80a1a1f75583d5d6d8e5aeb7cc203cbdf66e293259a3f4053f82c91402b324de55e346c4b90c8aec3e6920384ef8c00fd38ff0da9b0b
SSDEEP 12288:N57hPpHNKCDzKWHe31xHO45c0mojsw/kVa43iDzLQCYHYA49Ada15L:bhPptKCDzLHfojswenwLQ4A49Me
TLSH
T11045230020AE0087E8EA97B0159A8660732DE9344F4257DBD589FB36057FBF67DBE319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 5023a934c6aac96f37c087007cb26a3f61a26e1d81960e0c53788a544df34cf3
MD5 3848c71c4fee41675d6fcb9a3f2dd458
SHA1 b15392316abea3d1119695e5e9e6dcb5ee0b7066
SHA512 4adcf24bbd287b09f2e8e1a2c5fc03e8c6da3d749eef2bfc10d5e00f48fe378ec7c3d1c3f768ef08b9bb65eb3ddcd3d14446e40868c0ddd8fd5d1d62f0efa217
SSDEEP 24576:hgb6bmBIi49WNNFpg1rSvFv7bYXPptKCDzLHfojswenwLQ4A49Me:hgb4mBIBhGFE3K2z7+EVo
TLSH
T19265AF1E22EC02F5E0FAD2B89DAA4417D6B278161732D2DF1151423D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 bc42076442ecb3725dc8493d6325b14b94a0ed0e4d75ac8385f9b81e35cbfaf5
MD5 b12d0fa606379e9277109a4a45c93d78
SHA1 1f2c2e673999b6556f21ab1628976f8b4e27c065
SHA512 363503249475821d75615d0466539fdcb883110a11d93ae188ad40d63695f559c74231b46fb93eb1b0da70fbf1825e9a2a7235d10eb57a89d4a21e333250d08d
SSDEEP 24576:pG88u8FpJqH1hzria7/m+PptKCDzLHfojswenwLQ4A49Me:87ZFPqVoa7/X3K2z7+EVo
TLSH
T12785F16576E501F1D4BBD13889864663F6B1B8250360EBDF07AC8B521F23BE50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 e4b7442a990dcf454506a7733d9113008ba001f5c46e4dcd03e4e38a80cee1a9
MD5 5f5fca0177661c767b3d40f7c7f5ed4d
SHA1 ea468b57743545d9f0ca1239642d54d54ebe3b07
SHA512 d43de2c72b0aaedd0522eb793ffeefc14324e79d6b7be26bcebe614408cb2fee66cf52b427ba458b4497a775d2dd256070f17ac0c33fa2d660164ca3fe5999f7
SSDEEP 24576:/PUr+NQSPptKCDzLHfojswenwLQ4A49Me:/JQ43K2z7+EVo
TLSH
T19065E11E21AD18E5E6BAE17D85868719F771B462171293CF02D1813E0F67EE8BD3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 26868c5368b27a1fdab68d0e4f82d642657b906ff0dbf124a7768c711e54855f
MD5 821a61d75610402494c9093b19c6b135
SHA1 df0756a9973fe5f3bc9f461180d85d82cd5409d5
SHA512 718e7397e1ec65c6a4081e149e30f06850ad3daf0a57d5a545e8b3ea0129f8a8b35777bcbbdfe722f59af3f89cd5e14d8831c33e127ac05488d71d60ad872c7b
SSDEEP 49152:gBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjo3K2z7+EVo:bG05lO43bta2/+E
TLSH
T135D5C06E62EC11F9D0BBD17CD9C6460BEBB23825032556CF02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 83375f9e975ac4a433b64264377ac8cc348a51dc7694ca89d8fd4faed59cce0a
MD5 da1a78231bb06dd546ecabf037dc4beb
SHA1 6efe0d6b127ac305d46f59c28d3b5467d18d18a9
SHA512 f23fc377f103efe2380080b502704c0aa291a4eef542a731647b999a309480c18c55a4ef3801761826a7f6345fe65a06860aed5b6b0a96655a8990ab821f9119
SSDEEP 24576:Ufa5POZ3dpyWVM50JicR2hG0lasx2+47eidnQPptKCDzLHfojswenwLQ4A49Me:Ma5POZ3lJt2pasx2+mw3K2z7+EVo
TLSH
T15765AE5EA6FC01D5D5B9D17DC583861AF5B1342153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ebc20369695a63061cd5858fe89daf43201cb7e470d5552b77a69fbfa648191c
MD5 d8fc3f32f370c3c886dd162b5bc919fa
SHA1 7bd406d420a63dc1da61f3bb0ac92dbe5da50894
SHA512 27497f7bebedd2d726e13c7e3a3e6d47ccaaaaf014b1d90691f239773bd58ae72a91042384fa6915123f1194e697945525be2a06e3e06da30c9886d0531e2953
SSDEEP 24576:ZNcwHdjbyQ4nLC18lb/EOjowL7FkWPptKCDzLHfojswenwLQ4A49Me:ZNc/zEOVHF33K2z7+EVo
TLSH
T190858B1622E901E4F1BBE1BE89779546FA71786517308ACF0291851F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 20627b4100fd5196afa79383740e81e1e9c5a9e414d0bfd43bfbbc719eba8d71
MD5 e19e4ce87c4215616397ccd88686d4cd
SHA1 efc5f72854192f82287b97145b7fae10cb29f39e
SHA512 ea2c4ffe0ce4307f330000117849caa3f21355540179b4a17f68e1c36bbf9c77a9b15f84b2abd830aee1da69bd8b83fc7e63bed7f6a606bb64016a176460317c
SSDEEP 24576:FzkNvNnaFeYhJNtmZBmMPptKCDzLHfojswenwLQ4A49Me:FzMwBtOmK3K2z7+EVo
TLSH
T12455AF6EB6B806E4D1FEC6B58D238512E6727461073253CB9390C13F0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 36508f8d6f72bc66f592f20cf63659482c4e0d55b430605ed362e22be2508867
MD5 f9d72bd9df06f10a3d4294c2a5554e5e
SHA1 0d18c1fb14c91e0dd7aa31101f9257d74a97dc51
SHA512 7130859acd74ccd198cbd747649204a9586ae869e5bd230210230838399df9cac2f95e505f8c498238b50f7878d0a3001982c4872f3a3745276350523f899bd7
SSDEEP 24576:CD3FHshBIYQgANPptKCDzLHfojswenwLQ4A49Me:CDVHeBIAA93K2z7+EVo
TLSH
T18475E12DE69D00E5E47BC2BC96538A06E77138A9072266CB02D4D1761F6BEE47D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1268-127-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1268-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1268-133-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1268-136-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1268-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1816-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1816-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1816-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1816-142-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1816-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2672-61-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2672-55-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2672-53-0x0000000140000000-0x000000014016F000-memory.dmp

Download

memory/2672-222-0x0000000140000000-0x000000014016F000-memory.dmp

Download

memory/2828-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2828-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2828-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2828-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3520-293-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3520-338-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3520-89-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3520-95-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3520-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3520-337-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3836-6-0x00000000025A0000-0x0000000002607000-memory.dmp

Download

memory/3836-87-0x0000000000400000-0x0000000000632000-memory.dmp

Download

memory/3836-1-0x00000000025A0000-0x0000000002607000-memory.dmp

Download

memory/3836-7-0x00000000025A0000-0x0000000002607000-memory.dmp

Download

memory/3836-0-0x0000000000400000-0x0000000000632000-memory.dmp

Download

memory/4548-312-0x0000000140000000-0x00000001401DE000-memory.dmp

Download

memory/4548-113-0x0000000140000000-0x00000001401DE000-memory.dmp

Download

memory/4548-121-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4548-115-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4800-54-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/4800-40-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/4800-39-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/4800-46-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/4800-51-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/5252-319-0x00000274F2430000-0x00000274F24AC000-memory.dmp

Download

memory/5328-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5328-300-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5328-313-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5328-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5328-107-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5328-101-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5392-77-0x0000000000970000-0x00000000009D7000-memory.dmp

Download

memory/5392-280-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/5392-83-0x0000000000970000-0x00000000009D7000-memory.dmp

Download

memory/5392-78-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/5788-112-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5788-22-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5788-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5788-14-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/6092-255-0x0000000140000000-0x000000014016B000-memory.dmp

Download

memory/6092-73-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/6092-67-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/6092-65-0x0000000140000000-0x000000014016B000-memory.dmp

Download