f8d4edafe8d6e1d00a2a082337c2a618f0f77314b6732bef316b3a19b9904801

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 07:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Size 3.3MB
Sample260804-h8pfvsaj8w
SHA256 f8d4edafe8d6e1d00a2a082337c2a618f0f77314b6732bef316b3a19b9904801
MD5 4a141611d4a83a39cea0a8973544d494
SHA1 2a7653282d7b274338c6ccf8178a9d1583851546
SHA512 dd40b1bc7da9410dca3650169eb38c04f5cee58c6483cd0f9751a6eeb7731651dabff64bf02bf0bfa8f3d0b3ce5dacf7692a72d956181d3fe8c0825359ab43e7
SSDEEP 49152:+ixAMxQnt7Lv7ywAeyfvE0Z3R0vnxn1o2d5PF0xulb5+Pl6bJTIZ5jdgpY:7GMxQntvnAeKtEnW2XFdslgJTIZ5Bgp
TLSH
T18EF5BF3172918120D5B3D270297EABEB5B79BC256F76408F32DCB6390B325C09D75B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3372 created 4628	3372	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe	80

Downloads MZ/PE file 1 IoCs

flow	pid	Process
29	3372	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\mbamtestfile.dat	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File created	C:\Windows\SysWOW64\drivers\mbamtestfile.dat	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe

Executes dropped EXE 12 IoCs

pid	Process
4108	elevation_service.exe
4484	elevation_service.exe
5484	maintenanceservice.exe
4940	OSE.EXE
2180	PerceptionSimulationService.exe
5100	perfhost.exe
1104	ReFsDedupSvc.exe
5764	SensorDataService.exe
2476	ssh-agent.exe
5076	AgentService.exe
892	SearchIndexer.exe
788	MBAMInstallerService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4d97e6fa83806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\4d43daf6-0562-45b7-8a34-91aea0b5a782	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\2345dac9-9a4d-435c-8715-6af8b88b975e	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000034f4495be223dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000024df8b9be223dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a6b11159e223dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009a2df55ae223dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b3a6305be223dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000018227c5be223dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000422e815be223dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
3372	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
3372	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
3372	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
3372	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
3372	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
3372	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
3372	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
3372	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
3372	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
3372	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
3372	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
3372	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
3372	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
3372	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
3372	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
3372	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
3372	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
3372	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
3372	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
3372	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
3372	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
3372	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
3372	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
3372	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
3372	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
3372	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
3372	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
3372	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
3372	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
3372	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
4108	elevation_service.exe
4108	elevation_service.exe
4108	elevation_service.exe
4108	elevation_service.exe
4108	elevation_service.exe
4108	elevation_service.exe
4108	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3372	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeAssignPrimaryTokenPrivilege	5076	AgentService.exe
Token: 33	892	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	892	SearchIndexer.exe
Token: SeBackupPrivilege	1104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1104	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1104	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1104	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1104	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1104	ReFsDedupSvc.exe
Token: SeDebugPrivilege	3372	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	3372	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	3372	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	3372	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	4108	elevation_service.exe
Token: SeIncreaseQuotaPrivilege	3372	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3372	2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 2052	892	SearchIndexer.exe	101
PID 892 wrote to memory of 5860	892	SearchIndexer.exe	102
PID 892 wrote to memory of 5060	892	SearchIndexer.exe	103
PID 892 wrote to memory of 1008	892	SearchIndexer.exe	104
PID 892 wrote to memory of 3744	892	SearchIndexer.exe	110
PID 892 wrote to memory of 3736	892	SearchIndexer.exe	111
PID 892 wrote to memory of 3820	892	SearchIndexer.exe	112

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:4628
- C:\Users\Admin\AppData\Local\Temp\2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-04_4a141611d4a83a39cea0a8973544d494_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Downloads MZ/PE file
  - Drops file in Drivers directory
  - Checks BIOS information in registry
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:3372

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4108

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4484

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5484

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4940

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2180

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5100

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1104

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5764

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2476

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5076

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:892
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2052
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5860
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2940 2944 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5060
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2984 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1008
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3744
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2984 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3736
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2940 2944 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3820

C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
"C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"
1⤵
- Executes dropped EXE
PID:788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5d1ae25b3d839ef526bdc54cbb857f2386db0bb727a57c60d2682b43b2870107
MD5 baf9a68b95bef219469f957d75c7fcaf
SHA1 ea551d80c7a889cbc10b1a19b6c236a549217202
SHA512 43943cce1af13a6055bacb4a848c3b4e44b96069de297de21158fdbc602d2dadc55ef2624753b61c2b0b06cacca4b1357cfb1714695716acf98c0d3b586980e1
SSDEEP 49152:4b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnIb5+Pl6bJTIZ5jdgpt:S3q6mjBPslgJTIZ5Bgp
TLSH
T175D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 acaec4931e146a06329c3d505f08002bc30d43613fd677ebafd2404257a979c0
MD5 96008bed43d975b5c6e5428cda8e839f
SHA1 a0b56cab1d7d16e674adf0c6717393176e1caf77
SHA512 6ab5ba0aae2e9682b4cae86ac592f4f6f3265547d8a5918fa950b1c33382b71013fdf1aeae8e552bd9a55270a1b4c38ed36b3823f52cef32499b12b26ee1d6f2
SSDEEP 24576:DXYfDtczAAmb57GBiOl6a8JTth/RWZvR6wQQ92pN3/:GtcOb5+Pl6bJTIZ5jdgpN
TLSH
T11D85F11967E504F9EC67823DC8E2C611EA73B85587A0E7DB03B499265F233C86D3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 00a4a3201854db502d5926be3b3b895665a546e45e1095cd28a3fa77d63d861f
MD5 cdacde245ae6b4637aa2ac63c3b4c261
SHA1 b7836de22ee0c0106c14ec616274d11c29911433
SHA512 bbc69cd8d05fc925e56feef47c122ef5fcf9523d9bff9622d9201a06f57d11b1a35386b264553a73d5ef7c6ab145aa4de425cbf1ca7923133d8b5d7411888c84
SSDEEP 24576:30Le5ji0hmxyrMNmb57GBiOl6a8JTth/RWZvR6wQQ92pN3h:3Pji0AIJb5+Pl6bJTIZ5jdgpb
TLSH
T1E495AE16F6748335D073C0B9C5D2A68AED7230825B308ACB4296D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ed7540d52cc561831ce15b6f25210d809b775da7d270d4f6f2ec7c7259c0ea2b
MD5 97403cafaaa4b311a68a889618a54a85
SHA1 ef54f5d25703d0a64095a7ff497078cae08903f2
SHA512 13c9773d877e5d88e4b86e5a85b4b44e43fc52352b54a23c177e84a7ea14ebda40a4f70389e0c0dbb081a8b893f51e1ea9992de817e23ac66490827a4e3db002
SSDEEP 24576:0a7/ezSC6vUyD/aqgrvWj6q8wyufmb57GBiOl6a8JTth/RWZvR6wQQ92pN3l:j/ezSC6vUzPv+Hjy1b5+Pl6bJTIZ5jdW
TLSH
T1B6756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 faae3ee865b948f4059562fc099be87c6fe09e0882d3e3ac23fc85e68efb5c0d
MD5 813d3355e71db93701fc0337c6aea11a
SHA1 149daf236b7def78f9178e37cc05d4b9a28c5840
SHA512 027bc595a4e50998555a4b09092f33aa13831072a2f283c113a80ca500002d9d2606ddb463488a40fa429f00e8460a6af2a119a9fe9495e7092a7b9b982e307c
SSDEEP 24576:oVbqPb88hv/l+B8mb57GBiOl6a8JTth/RWZvR6wQQ92pN3D:oVO88hXl+pb5+Pl6bJTIZ5jdgpB
TLSH
T146559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 380051e11502aa5f22f5c48fa5fd9526ca9cb229fae2aa814b2967bd27db2461
MD5 071c6779fa98e25b623198092745b8f7
SHA1 58ea74caa2ddaf5b0e095556df66b8b3cf64cd43
SHA512 aeb3bfbc44bfc0fe98fa3ba8286d129fc641204e41069113c5d8f4011e06154d10e08158932f4e241cc79e0932e94e52d9b4351da98ceba7744c85377ee15eb5
SSDEEP 24576:xFJmb57GBiOl6a8JTth/RWZvR6wQQ92pN3K:Qb5+Pl6bJTIZ5jdgpo
TLSH
T19A6523434B6A30C5E5AB1739E9CDDB00F879EF55CD866B76C579282BF034349B85220B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 49c8b7ac703ed51a26d8830defb0be3affde048f9aa5a5007b84ec99f845ae4c
MD5 b68531af10c5d2bc51bc898298297095
SHA1 35aff4af0172c656a0ed7abdd033c09d341cfe49
SHA512 f7d51cddac8e043870105608ac8bf2d9f4cbe2aba280fc2d1e467ef37738666928c1a397b8f3e27c950584821ae5283f195e129bb12ff44f9963b76120bb8f90
SSDEEP 24576:ZJIUkmb57GBiOl6a8JTth/RWZvR6wQQ92pN3H:ZJIUzb5+Pl6bJTIZ5jdgp5
TLSH
T1AE85CF2BEE28FCD2C27A8D799A91C700E77278308F52A3CBD175820EDE235D55D7A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 eca8a637ea805bb430cb27b4b4e6b97e2983be5a686f2a8bbbb4e88b9a0274ff
MD5 d32e5e4f240dbaf5d3fc718f80776bb5
SHA1 39801b899da38045023b9f1124286acf3dd54754
SHA512 e45a4a6ce016b3383ae564e2c772d0418c833ab4a1a54d4a3257b2cf0144461688ee7cd5a9accdd0c2fa99b906f6463b15338cbd597959b36192d20c472591d7
SSDEEP 49152:ZQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THN:ZQvGAdlCEL8c/WRNw5CUslgJTIZ5Bgp
TLSH
T185266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 91c043ec5d3a8aa0804733bfdde253d0dde2c63ef2d533ecbe7fcabec2aae4ec
MD5 5f3345556d77c9a3dc1eafb8395cb37a
SHA1 b835a1d6ea9383a7bd968a825edc125edc5ff9f1
SHA512 94d9e3fcec1bcc6c07e4d3a44881fb03b24470623ba4b5e2292d0633406dfb97bd748996f06d4f933835bb83d9606a8d42ab1eed0f325eef44be2f5b31a634c5
SSDEEP 24576:SOewsAjWmb57GBiOl6a8JTth/RWZvR6wQQ92pN3O:BljZb5+Pl6bJTIZ5jdgpM
TLSH
T17885E031FE75E036C2BB0DB65B65C706647DBA208F511AC3E3B84D9E99302C22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 6d1b37c0f616a411437d897b42eae7db486e5494ad67472b41379f6ae3a3621d
MD5 1919e3e2c25a578d62835683f82209ae
SHA1 578cca207eaeef5612be35cb14485d4e6af0e21b
SHA512 c72f420003a0098f485d7a8c13c8cda52f65b13fc26afa17c42165f556c5cdf1ab4cac196585d9c80df3e8e18cf3419b52488d0a8835ba3dcfcb2a4402b64cdd
SSDEEP 196608:RUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHtsT6p:RUEtQevvqc2W1cpV20I32ts
TLSH
T1B1474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 84db0acc7862a5722cb4880eb94c347d374b3173ca0ededec164e85b2bb098b9
MD5 2b79ff4eb9c5badfaf8335151c3455d5
SHA1 911844f69c6678e24a877e7709535c0418622c6c
SHA512 a7059b4c964ebd7e77f283b217389bd7d3a4116946b8330958c4b089346b4dfa92a43e440e8bc82f4433d5f519e2e72434024014395e297a8af1b2142c694e74
SSDEEP 49152:rCbRquA/m2yL5zQfFiV+XenmE3/z5b5+Pl6bJTIZ5jdgp0:0oqtVjnmgslgJTIZ5Bgp
TLSH
T1A7D58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e1a60824e44fb35e4193995c8326bdd6d1a7fb7344049a859c04e3a95901fec8
MD5 a970edd13e5b3e4f6b76a87bdd0798c6
SHA1 a71606039d5845ef29bfb7c37810e041b9f8bdf8
SHA512 a783da22eff20868a2d7ea311162fc9b9f753dff4c1f06bc1b856740c65b28feffb29f3fcfe01aa333e4c99281d0f5f787d5614713ff84c2e878206412f48fd1
SSDEEP 24576:5AhGL6IFoiwtA5l7S53zmb57GBiOl6a8JTth/RWZvR6wQQ92pN3f:5AM5Foiq56b5+Pl6bJTIZ5jdgpV
TLSH
T10F359D81EBF955D4F5B3AB7899B68570EA76BCA65E31C20F1160C11F1E33A40AD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 8a8d910c94333029386a3a7e926b123a2b15d69d5ab5425381895b490fb5781e
MD5 0c3295551dfeb5878011ab835a0869f9
SHA1 7025b0042dd13d66c7649f03385ecc8468c2c48d
SHA512 4976d4cd9c0e3cf7294fbb9559da9ffa82c31171473b78d623145cd2cf06d95eba614d5ccb6c1df3fba0351b655fbd4c1871402aace2e06f549c083a7c2f0017
SSDEEP 24576:XwuGOWqmb57GBiOl6a8JTth/RWZvR6wQQ92pN3A:XwNOGb5+Pl6bJTIZ5jdgpW
TLSH
T1E075F14666A51CF9E9A78239C587C632F7B2BC022A21DB1F4770C65BAF333517D2A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 b5c08681c6d5aee1f41eebc9dd50efecc5d5b683e1ffdb93f21d5174e995cd03
MD5 6ee1299e0a6820fd629c6e0bf02332cb
SHA1 5c6b41f8da2b35759c056d810cc51d786d5cb611
SHA512 984dac6f2d7f5863545f08b9458cffce416e178829dc82c44713a1947660b0fbca8a469866e79dac20064ccf0ea9a51ccaba99407cbef7ccb3505c4a60793fde
SSDEEP 24576:/ZuVmb57GBiOl6a8JTth/RWZvR6wQQ92pN30:Bb5+Pl6bJTIZ5jdgpO
TLSH
T10165128627A830F9E0A7523DCCE58B01F772B8529B7653DF4674056AAF32BC52D36312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 cbed50b56667fd79cd1c61254906ba8f32072dbf1acc3e174f40ef1a1fe05139
MD5 e0d8c14145313c209f6e1b014ab0faad
SHA1 68670ea16aab46aa9b0ff4930a1b18e6aeaa34c4
SHA512 8876496caff0340ea0526145ab42f199b1b9edeeeecb826b6f06737a628d640ea8ef0d3608f6793ccd594af9d5c4ca94aef252888e7409af7f839f78443075f4
SSDEEP 98304:yQRQyi36YOcPDLvw2gAf+PN3jslgJTIZ5Bgp:pQyiKanX+PNzsT6p
TLSH
T15A666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0a494db989fafa077c35f5b7d4e58cb719143ea3a0d0a5cf834aebeac4679936
MD5 f86fc9abc1768ff2a7443adab9c7e136
SHA1 52207c612f4477b65579d66e68717fa5e9a2af5d
SHA512 9e7a870c3237dec6907d329d12b9601a07eb6ea91cd282002d1d561e371bb4c5e20b6e1f94b42af3d16febefe3ed4ddb4546d80dbbbfd825ec311886f54b3ff5
SSDEEP 98304:xQRQyi36YOcPDLvw2gAf+PN3jslgJTIZ5Bgp:oQyiKanX+PNzsT6p
TLSH
T1A5666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0b79a0993682738a4a1baa1271f250fcedd75f9b97836831c270a8834229816b
MD5 e81ae63c01e6e4a73ea98ff4c203d10e
SHA1 c97eac725ff4d61dfb735efc2704c4caa397c530
SHA512 7a1a3814cd69cae2208e60e2d56aef491c7174a404c8fec27e9b22ab0b2efddc7e5ff4bae139bde165bc1e2fadf8c3a6faec5aa2e09f67a0a844d26aa62a9a1c
SSDEEP 49152:F68Qg55nhkeWu7PNU3/Jb5+Pl6bJTIZ5jdgpg:TthTRc/VslgJTIZ5Bgp
TLSH
T168B55A33B2F60099C44DE1769F4A872196E27C75CFE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 75fc5ebc8744861c1c37354c059a8f9b34dc6369f0da13f1b8e359b91a6d2965
MD5 acc2642f740d9ef009cb091aa9069971
SHA1 507eeebad2af54b3da599692109555a0eb5ed1c3
SHA512 00a985eaeb7e5b15da548a1be9079cc9e7071a28ca8cfa466747a5d11dfe675902474899056b23d4f45f39e4d4f81d16c9eb28593e757ed8ae0163bec40b0866
SSDEEP 98304:my5112gYy5azzVvU69nLKnhZSslgJTIZ5Bgp:XLIHRWhosT6p
TLSH
T197167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 8867e96b87ce475280e8facc0beb805157f82f6d9c2437868622433b1557b8ae
MD5 2a688ed43e83d637325931b412a6aacb
SHA1 4ae7eeecc20bb791720a6e6c8f739288fe155ddf
SHA512 772c15cd74b062b43a19324d4f458fecb7dc65b18c9979412d9880e632b0e93da003282d4344a844e31c27f0da288b8b4057f5e8f44d7506ab29bdc6dff510e4
SSDEEP 49152:sB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glnb5+Pl6bJTIZ5jdgpn:mu6JmIxd2dbslgJTIZ5Bgp
TLSH
T17AD59D13F1DA01E8D06ED178974A9233F962BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2b5b29b3cfc565e7a35e2286fb1c8179185d5665f384ea4116f5e6639828f2aa
MD5 1a38f7238caea94ef4a99266c4b45cc2
SHA1 b38adc7ea8878870c4fa10c859b9d7cb35048515
SHA512 718ffad6de110e65156b4bf454fd998d830a37bfabefb40ca664236830235288211abdeaffcf094a0b3e1411d101ec83b99150e5315e44c3b2535508de998ee8
SSDEEP 49152:o1hpsNoJpF1A67U44CwH7R4xTb5+Pl6bJTIZ5jdgpD:omifPqRgslgJTIZ5Bgp
TLSH
T105B5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3065bfcb7b72b0ff059b88d68ae24864c8bc1d6e94500e5feb3cea2e7c255f9b
MD5 b1ee6688f2bae18fb2963aa8c466f83c
SHA1 51dae5b7d0446cc5c777204434043d11e9f5c360
SHA512 f0d3c81ad285adde5262ff39d2a61fe802efe8d0163aa09cfddbc654fafb3225bd2d0e85dbdaac8bd834f6d1cc4342f55492b4aa606957833ab2eb91ac7627e2
SSDEEP 49152:oSuZQIY0Be2KkRVtOnks6NMHqYb5+Pl6bJTIZ5jdgpZ:y5dKqi612slgJTIZ5Bgp
TLSH
T109C5AE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 38524d226ce0c346b229ded69f2e35befd1832353199a1c5afa93fa60c0efa7e
MD5 9082bf342dea4e0780cff22871d5b3e0
SHA1 11bdf4e4171c45b54e07d2b7b5437feb3fbceb27
SHA512 48cc4f68b3acab27d20ef1f697f312c2d13a211f4f3b2d9ada6e752fe402785fcdb1468cb77bd206ae1ed3ff6017daacb58db943e7646acb2b7c921c3f3ba75c
SSDEEP 49152:bhtSn8EApI0figjgiDn0AP5w3b5+Pl6bJTIZ5jdgpn:6X2iWphcslgJTIZ5Bgp
TLSH
T12395BE13F2D900E8D05ED178C7468632E962BC164B35B6EF0A90B6561F7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 76cc8b2b301a6a842c34446ddcac342bb75694f60fa1d7373681539d740cf617
MD5 c8bc448b9c93ac2380518259c751f84e
SHA1 058bd77cd2e3a565c900cd2847ea5545fe0482d8
SHA512 d83a372ec5cc3f716c798b8dd4ce2563cc8a6dacc67da41f32d13efde7e0577747b780f0c8db024c9519410d3f828095c918ffaa8bdba16ca9cc0800ce374ad8
SSDEEP 24576:oxmb57GBiOl6a8JTth/RWZvR6wQQ92pN3M:5b5+Pl6bJTIZ5jdgp+
TLSH
T164652383896B20CAE09B5779D9C9DB00F87DAF56DE8727B6C67D1427F130389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 56533a8ec6b6c2f2001511c1fa934ba15d393fd01150a5d278cccc19306a795d
MD5 41ed4db70a3aca37ad926a54d688c24a
SHA1 cc6fa2e77284be3619c09c0cef4bbe202b6e4a1b
SHA512 ead5b89a6729d0b4642bbcc8e89ad484af84a943b00a9c5bfed94115298b6d0b7cbd13dce6a345a5d6bb130448635eb31ffd372e44a56073099298a0cd14f5b0
SSDEEP 24576:simb57GBiOl6a8JTth/RWZvR6wQQ92pN3v:Mb5+Pl6bJTIZ5jdgph
TLSH
T1B26523838D6B20CAE05B5779D9C9DB00F879AF57DE8727B6C67D0827F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 bea6184c6d804b5ca481d4c5ab7168dac452ef4aaa2c3064e61961c4805b37e1
MD5 381ade92d8b0eeb5df589d10adff34c2
SHA1 cc723aeb988657de26ac2ed66b07b35b812b30cf
SHA512 1a3c4f9afc83d701e6c9a6b1e8fc1581277d0eee6ccb8c820f210a5aa7c2f8058a21931b2f5f483752db0a3906800f94691b5e5ea32c04072da0c1b16845beff
SSDEEP 24576:Wsmb57GBiOl6a8JTth/RWZvR6wQQ92pN3y:Ub5+Pl6bJTIZ5jdgpI
TLSH
T1F76523828D6B20CAE09B5779D9C9DB00F879AF57DD8727B6C67D042BF130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 1d36aafa276376c2227afd9b10312f2d14057b6bfad5ba6a2181ec3868843b88
MD5 72a9f1647eac115bad06c6b3a9737355
SHA1 4c24813a264364af4aaaf3a64235c6f5d37499dc
SHA512 72f6b96d22936b7217c770ed2cb3205fb340ce6b02aa873fc4e73ffa35451aaf47820f3d3f81e96c9b494f2ba0d08ca4028acaf5ac1d22ba9e5edaed87ae7d34
SSDEEP 24576:Tmb57GBiOl6a8JTth/RWZvR6wQQ92pN3w:qb5+Pl6bJTIZ5jdgp2
TLSH
T1E86523424B6A20C5E4A79339C9D9D700F4B9BE96DF5267FFC675082BA9313887C3134A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 baacf4e46b08fb81c36cc3caed180fc8ea8d5fe260ee455842406e6c2f96ddde
MD5 fbe03761fbb16fd45a3e131035bbb052
SHA1 57b0cec66e95561c7e3a95cf84e247dd5465bf85
SHA512 7c22446090dc448e4442e57e0b4552e247ea20f3ea22249e65f897f7b6c900542e22c4b3d877bb032e30b3bfc1fff8e54d41fa25438ecaa5d338667d25ab8568
SSDEEP 24576:dLmb57GBiOl6a8JTth/RWZvR6wQQ92pN3L:cb5+Pl6bJTIZ5jdgpN
TLSH
T1BE6523828D6B20CAE09B5779D9C9DB00F87DAF57DD8727B6C67D142BF130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 7c1016e5e70ed9676dce9394b3b8019b5696220fa6f9a0e141663160eedad679
MD5 7c35c66aa52bb96cb893da704b1ab5e8
SHA1 751ced7745faaf4a2e58425544b68fc3192e0464
SHA512 0d7656210b40a5d5f80fa969766c5893847d1fe2bcf73a137e0bd1f7a53ffcf1ab26a46cf2abba6fdb9cf35d3eb08c821378c196f67ea358600e5bc5404b4ebf
SSDEEP 24576:Lemb57GBiOl6a8JTth/RWZvR6wQQ92pN3n:1b5+Pl6bJTIZ5jdgpx
TLSH
T12F6523828E6B20CAE05B5779D9C9DB00F879AF57DE8727B6C67D0427F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 f1072888782c39e93ec4969fcce432f5072389466cdcf6d24fd8a5ac9a80d8f9
MD5 0edd0fae3bcd83b709b6c5e15ce27b1d
SHA1 b39af0b054c207a618bd7713a4ee5815774aa71c
SHA512 b53355ba83765f469491acfc37ffec296162307748231777a1cc3e85fab69d404a34173954ef0a9f82a85243fc4cf95c69375531831c9c97a70d774eb1400755
SSDEEP 24576:hamb57GBiOl6a8JTth/RWZvR6wQQ92pN3v:3b5+Pl6bJTIZ5jdgpF
TLSH
T1E56523828E6B20CAE05B5779D9C9DB00F87DAF56DD8727B6C67D042BF134389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 5fa5f61d63a57e9c4843b210577640a3a9cab9c6b64dac6f79d6ab59bd914578
MD5 b2b2a9821f6691ebe01059802b74000e
SHA1 7f730c5099d977a188e4c9585218652c5f21722e
SHA512 5aefda900cef9c5de4004eca1c46a0825f8416855bef6db97525fd72ed9166bf040de69dd2eaf528e4d78df3d7e2d8c93303d06fe29258083134d95978bffdbc
SSDEEP 24576:wZMazFVSOCmb57GBiOl6a8JTth/RWZvR6wQQ92pN3M:wZMazfRb5+Pl6bJTIZ5jdgpq
TLSH
T10B850295B36018F8EC67823ECD958A05E5B27C5A4B60C65F43B836275F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 3d51cf34cc31bca6861c84a54189f58c08e944288101b1aafd026cfe3c16fd07
MD5 d05962b6bee56a2f919ebb1b55bc9f97
SHA1 dd52948cd00aca90e206b38e9c0e55870890801e
SHA512 4430b18fe6e6a7c513cf528ea33fd07afc75c78bb3351a3368edb1b4b00eff273b997b22f3a72d328f3cd5ed54e5e823f3add55216f704911870aa5dfe249bb2
SSDEEP 24576:2lmb57GBiOl6a8JTth/RWZvR6wQQ92pN3O:hb5+Pl6bJTIZ5jdgp4
TLSH
T198652383896B20CAE09B5779D9C9DB00F87DAF97DD8727B6C57D042BF130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 d31a42ca998bdc92c1dbdfbe0419cd44863279cf0947ea3f3c2c5a3401fd0872
MD5 3c5401d1c50f6f044fd59cbf9fd395c0
SHA1 c6abe5205579da44fc5599a751d406cc5a483b21
SHA512 221e66b1aafcccd912100be33348bed6b1735fbf1175d805966ccdbaca4cc1feb55e65b5e2e9f2e834d7c9660d5dc2ae1c78689778304d83a80483b55f41d169
SSDEEP 24576:sZmb57GBiOl6a8JTth/RWZvR6wQQ92pN3s:bb5+Pl6bJTIZ5jdgp6
TLSH
T12C652383896B20CAE05B5779D9C9DB00F87DAF57DD8727B6C67D082BF134389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 d9fc8d4f63c9f7ab3ffab63ff4eb106364e1ca4821cd1290d3553216b230f834
MD5 5cfac27228b36770a14ff627fcf17ebf
SHA1 87bcce14ac925344ee34331201a5affc5a0e182c
SHA512 6b52990521c166ba7e31b6c2d66c81dab3b47c1dd51effb94e5e41ab0f52e34f885f8ac24fe2e07d3f250dd387c376a5f40d7cf4c5aec26955ccf3b9b619295e
SSDEEP 24576:Yzymmb57GBiOl6a8JTth/RWZvR6wQQ92pN3+:Ymb5+Pl6bJTIZ5jdgpk
TLSH
T17575024767A630F9D0678239C8D65B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 baca470c7d9fcd0b4c067a19f1a1ede6d1ba7b1b0eb081af8b45e4e900846366
MD5 e530be623e223467c36ee2d2734538b0
SHA1 3912090290f03b34f91013761ea05a7c0255f581
SHA512 3bacba23f359f2738b5f5afbb8972313db28c896aee0042cb4b9a635e8821369ae56c574ea4d33711e2f15e375d77ecd780bbbc4b92ba461e5ca1ca04f0ee762
SSDEEP 24576:clmb57GBiOl6a8JTth/RWZvR6wQQ92pN36:7b5+Pl6bJTIZ5jdgpE
TLSH
T1E2652387896B20CAE09B5779D9C9DB00F87DAF97DD8727B6C57D042BF130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 032cde05b5e9c840ac7836fba1d703184e320dce501c2bfafbfffae37426b5c5
MD5 cfc7a09f431d0c826ec555fe7fd2bc44
SHA1 bfabfd77d2cadd5035f28135fedecf6d067f5ec0
SHA512 653435a5adde534a6127a0cc9d6369711993434d75370fb9114dfd77becbbb80843f886279ee21c1137dbe69e818daaa6e1f24b9576cdcb97d5aeacb58206350
SSDEEP 24576:ulmb57GBiOl6a8JTth/RWZvR6wQQ92pN3o:Zb5+Pl6bJTIZ5jdgp2
TLSH
T1B4652387896B20CAE09B5779D9C9DB00F87DAF57DD8727B6C57D082BF130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 d486ed1944deee2aaac625bb125e2e501592590ea4ff7ee998bbb21462ea8073
MD5 094dd4917c26707bc9c6fec2909175f7
SHA1 2e4b2ca032089f31332b3238aa4a8de8f68e23b2
SHA512 fddae2a988c4d5924a68ff2bc2e87bc0a40b796fdf4b1365b713895b81a2a16b5398d4111b7dde3fc0b8ba6665e11e68e1de54b33ac8423a80f3785b9757e626
SSDEEP 24576:5zymmb57GBiOl6a8JTth/RWZvR6wQQ92pN3i:5mb5+Pl6bJTIZ5jdgpQ
TLSH
T11775024767A630F9D0678239C8D65B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 5a170b474ed4f8ae8ad964a5c7ab40aeabddd6c7bb1ac69d2e64e3eb515b9ac7
MD5 c07d4c2a89d5158a62b2842af671cc05
SHA1 186bf5be726978a4c3fc2fbdc4deff219c468bfc
SHA512 53c84772eeec0d44239c209edb0a1a691497b75522af2e799497ed0a207363e830e58c1a9ae8118de60130a57c84c44ccdbccf3bff1fdbdd139c22a8990abd42
SSDEEP 24576:1T/aLl3z0zDcmb57GBiOl6a8JTth/RWZvR6wQQ92pN3K:1TiLljeb5+Pl6bJTIZ5jdgpo
TLSH
T1D4850295B35018F8EC67823ECD958A05E5B27C5A4B60C65F03B8366B5F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 c3e983adb9bab64ed881eabf4034c560f7745e766aa0b049bb2b2d33a7bec864
MD5 5b1d690d15ddc626bac4542557b53179
SHA1 00203ef59ca3f5e2877ef470912bb1c549dbc89b
SHA512 de6dee5a61507c98ce5b3ace9eeffc8661f3258a8cab46de711eb9d1a61d6204415132d69e41f48ff3a76589506c95145b1087ffebcb3aae7f41c02e70eed07c
SSDEEP 24576:/3Ud9CHKy7GZImb57GBiOl6a8JTth/RWZvR6wQQ92pN3z:PUd9CHKyaRb5+Pl6bJTIZ5jdgpZ
TLSH
T19495CF90F3E410E8F0B79A35CDA68611D9B67C5A5B21DE8F03A8251A1F337D19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 4b227691aad56fb0b04100ee1625bcba53fef8edffeffeb7f5f5b68c27c144f8
MD5 3ce66300696f1ee09ddbdbd3ed7d58cf
SHA1 79d66471caf29de1b43652ba16be9f74f83d65b1
SHA512 137838b0ccf7adb2d49b8c2b8a1157ba4af7681ba8ef0e6ac478df4c427e827342d9d4762e2b683065457cecee651d3c2ed38b69c408c2970edd8bbb6614bac8
SSDEEP 24576:3Mmb57GBiOl6a8JTth/RWZvR6wQQ92pN3L:Lb5+Pl6bJTIZ5jdgpN
TLSH
T1FE6523828D6B20CAE09B5779D9C9DB00F87DAF97DD8727B6C67D0427F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 c253cb815b87e3ad0b9766dbfd2f95fa1a59b22dbf2cf02683f6c2cf36a64843
MD5 6bee9c1d915bc0fbe9af8964448c72d7
SHA1 40f33b200ebfa17425e2d67b0bb5d8d698eadcc0
SHA512 7858218a1ac3694b44a82803498069fdab0b8fc4fe8e496ecc10d398bd6170b1e888872a9a67d27750f815655f83d93ac281e58bc8ac45fc3056c219711f3197
SSDEEP 24576:tGmb57GBiOl6a8JTth/RWZvR6wQQ92pN33:Pb5+Pl6bJTIZ5jdgph
TLSH
T1696523828E6B20CAE05B5779D9C9DB00F87DBF56DD8727B6C67D0827F134389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 8b4d106ff030e5a3f5b97f292aeda854d1a01ac7a9468ad414849821199d6dd7
MD5 bc270b369df8065cb697e2add97375bd
SHA1 676eb3938c04e88b403b484ffcd6a538bb7bc452
SHA512 2217a748adc3ed9368da76fdb8da33c61af35e40b187d5fadf25b9a369b10f4000a21d46d39416c4be635276490e1a9993f963f00ab8f11fa32f85161a359031
SSDEEP 24576:D3mb57GBiOl6a8JTth/RWZvR6wQQ92pN36:yb5+Pl6bJTIZ5jdgp0
TLSH
T18A652383496B20CAE09B5739D9C9DB00F87DAF57DD8727B6C67E042BF134789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 f987175c8e5420f3ff194e36c1e666945a44e642865f6dadd8a853555def0859
MD5 d81c610684335e748445f95498b73dd2
SHA1 3530595c65971232fffe27f5b8306147a0c33eac
SHA512 e6adfe0d818ea1c69a54502f9428c5b7967a5fc09527c84e5f5be71228ed63c40917bd70a62502c09164481b56443ec9d86e0993d598e18b0f71466d86883eea
SSDEEP 24576:ylmb57GBiOl6a8JTth/RWZvR6wQQ92pN3K:lb5+Pl6bJTIZ5jdgpc
TLSH
T10A652383896B20CAE09B5779D9C9DB00F87DAF57DD8727B6C57D082BF130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 053dbbcbc3ae3d653d1b8d4c7bae08ad0b5372746fdc7330973ca227a5b62274
MD5 e1b357588c0266f3a7cdda54a0e5dfb0
SHA1 ee910a612b2f90424d7bafd42f4f1460172d8165
SHA512 759bc23b368ab5ebd39778ca303f4afed0f38c0cc12fd8657319f75a4ee651509bf48c5708382a4b24cf1a8012ea0a05cad871dd20d95793b3ee427fe2137db5
SSDEEP 24576:8Mmb57GBiOl6a8JTth/RWZvR6wQQ92pN3o:ab5+Pl6bJTIZ5jdgp6
TLSH
T16A652382896B20CAE09B5779D9C9DB00F879AF57DD8727B6C67D042BF130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 53509cf20c34953fb8150f17d466359faaccc0d20067f3f68818312769b03e70
MD5 ee90cb4a05709a1f932b8c4b3a5155e9
SHA1 e943ae128ad0bafdc45537d60ca40fd4c6d3a1a4
SHA512 32910963aa7c5819b1e5e3379300e6bd46c679500ecb169e0486051a1c0ddf9cb32b03719c1c936dbc437d354ccf13c5478b67b3cb684047e48dc0e753d07b6c
SSDEEP 24576:j9mb57GBiOl6a8JTth/RWZvR6wQQ92pN3C:0b5+Pl6bJTIZ5jdgpI
TLSH
T1B16523864D6B20CAE05B5779D9C9DB00F87DAF56DD8727B6CA7D042BF134389385220E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MBAMInstallerService.exe

Path C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
Size 10.6MB
SHA256 d10e04217f81b44667c6237971f1f2843d132220c8712e8a855436e9f1f73baa
MD5 cdd8c06c1f88f57727813906e3a58fb5
SHA1 4ba873161c0ab0f489bb0c82a267aac8b0cb91dc
SHA512 40fb64f723481e9b8e24d88edff74dbb85b2e63790595c067b01cc5986ac3a0fdeef0d8083e4c86c0e2681837cb53eb98e7bda2bcb22eb77d1b8330e2d72ef73
SSDEEP 196608:PRO3j3Ld/5Mo9/vEvt2teG35tTdnXo9076gZCN3R9i:PROT7d/6o9XEvt2teG3p42Yi
TLSH
T10DB69E17A6B400E8D4F7D238CA579A03D7B2B81643B197CF0690567A1F63BE19E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 212a6988648dccd72bb2f005ced6c19789083015f20f99c7e27c3e734185ef14
MD5 80b1b1d482546f85d13e1a2d670b7a70
SHA1 be86d6e962dd79e592a71c2b6e2ba9dc064deef2
SHA512 5e80961bce17647d26678e32d367a2f704cc7a96edb855becc6ecc8e4753b2fd3092854b0df7fa3d9b6c4df6d1681a7538d747f304367573774b743eee542d6c
SSDEEP 24576:Ffwvhk9RX6wkyAIpmb57GBiOl6a8JTth/RWZvR6wQQ92pN3q:SMnYIkb5+Pl6bJTIZ5jdgpo
TLSH
T13495CF29EBDC04E5E0B7923C99E7460AF6B178595B31C6CF026A536E0E33ED46D3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 83d04d8925ccbf8784b67cc73af6070ad5bc2fc69228ebb1d6f1479f6c594a67
MD5 09916b29e7032b42960e3f03d4026550
SHA1 28a9ff208b5fec591af6dcbd114b7171f9b039a3
SHA512 405f3b06421db6a96d863f28bab0cf0b92ca0449bdc6656e102827a49e61261cce3bfe73f79f19933ea8d27eca82049d8094e2a819502112b8c166b7da81434f
SSDEEP 49152:FYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Xb5+Pl6bJTIZY:0ySzPDslgJTIZ5Bgp
TLSH
T1CE066C96A16801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 ee312d322b462feb617d14e015fe732eaabea9f731b9833018867c3b67334981
MD5 551e043258e45c48997a681c37e5392a
SHA1 8fe9ad69931577ce20800e08a3f43857c0590c83
SHA512 d0fd71cb6824f277114a7f529f4487ebeda6558d9216d7ee4c247cc10136e7e0215cbe9f04e4f10bc52d259f06d949648bc39f4aaff84ec69d0659d4ad8dcd2c
SSDEEP 24576:H47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYSmb57GBiOl6a8JTth/RWZvR6wQQ92:H47JUQjqirIhCnDHUPfF/nb5+Pl6bJTM
TLSH
T1F465AE1EA3EC01D5E1BA923885558A1AEA71782E5F32CACF1270437D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 84665bff53292559e9da7903a87a4491f263ce4fb91397424db93afae8e8dd57
MD5 708169c9707532bda3266d60a0c28f65
SHA1 74742d26b38e1f3dbd56311c360a29a20cd4ade1
SHA512 8776e949a378e8bb68fb71c4776c11ece83903996ae4da679111e1fae0ae5bbc996e5ecf5508d07e26a2612ca778934653dbd2967ffb7d8f2d2b50abe1619aad
SSDEEP 24576:kVmb57GBiOl6a8JTth/RWZvR6wQQ92pN3D:jb5+Pl6bJTIZ5jdgpN
TLSH
T1A475F14AC29811D8D06F6279CB858A00F7777D658BE193DB86E0F43E1F366846DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 e4fdf20a23d2487304f6e111a460833e6e3395ed663db32e6835982962e63bf4
MD5 f4aa4e0dcb90a38145f53a2ecdc707c7
SHA1 35c5333bd240ff1d292161e1110d57036561c103
SHA512 a92084eee02f887a32d1506de2a8ee2b0385164254e6605af1dec379671c8ef1d7b69e9950e0266302889f30948724d5965231d8c41853bd242988ce4b4379e3
SSDEEP 12288:cAqMU3faw4vb5+hCXSoNw0oPO/ZQxaPY2GgLikEa:cA7UPapbk2SoN42ZQxaA2GtkE
TLSH
T1CF350750766AD75FC6AD40321E32D2CCA7707D01EE05AA0373C8973FD576669BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 cfb469c32c20ac3e85b18991abda4f16ec51be67bfdd0ca2d1e3ea6b910f5595
MD5 63ec7163ecb6511d902c15975c0d83ec
SHA1 99ee921eace5e97a06a2267a02e7528257e7fcbc
SHA512 32fd98828910473fd0830a500dd99344b3602f3a52d6e93814ee385916508b04d5f73ae908e1aa6186214c497b590185ea2244809ea1c123da99361b2c370f72
SSDEEP 6144:Gt36jEMThR7Y7Yq5bMdze1RMrEAzp0/ofcbVtMxOcbVtMxGTqqv543+GrcIa:jhR7Y7CK6igR
TLSH
T17665C8815537E28FD1FB6031072A6B4CB7A4EC13B7059F2677C8447AD86AB25A0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 f73df3c5a65b18cefd74b7eb56382b495e4f1e3a35cbe03debd9806697909514
MD5 e454364b1fd4167ed1fed4b01ff14557
SHA1 9013b79f77450120ddb3f9400266a2372ba42a29
SHA512 d3222f854dd8e515c2cb1db3cc66ad0e979c30ce0142710ab050a413f6945916d610b83ff5ed7d4d7ac50caff0d2eeb2cd8d560f0527656cd6017097a2cc37db
SSDEEP 24576:Atmb57GBiOl6a8JTth/RWZvR6wQQ92pN3N:Awb5+Pl6bJTIZ5jdgpH
TLSH
T1D26522428A6A6086E4AB5779D8CDD710B83EBF65CF8566E7C529142BF1307C87C7230B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 a10a560422ef5e0eff990d906a5c1f994d937dbf68d0c6314a6f8237bda85700
MD5 bb1d6ed97dbd77900f0c00c1690ab79e
SHA1 37f89ab84dd28101762f4d3502177604dcfa512d
SHA512 419509b24814ad09b6f04e53da5069459369bdc3bdc077ecf24de0e6c3209366d303c423b6c3a865d10d9435cec267515319d6e0b23e8fee693a8a340e54df12
SSDEEP 24576:fgb6bmBIi49WNNFpg1rSvFv7bYfmb57GBiOl6a8JTth/RWZvR6wQQ92pN38:fgb4mBIBhGFdb5+Pl6bJTIZ5jdgpG
TLSH
T145659E1E22EC02F5E0FAD2B8DDAA4417D6B278164731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 0bf2fa03f856ef60f25aa0de2729e794fb2ea5e0919f347b674eba58aeda9e2e
MD5 f9ceedf2fd51eee8833b1955974a9002
SHA1 bccab058fbe40627a10e305311a1680bbd3cc681
SHA512 f393e92de6d14dbb3b3cc56c4aff1234dc209d983204e5a7fd9d257aa33d9a5db1092b056c63a1f234aed104ff325e200ace8946f59222a5adde57c37e743928
SSDEEP 24576:GG88u8FpJqH1ozria7/mCmb57GBiOl6a8JTth/RWZvR6wQQ92pN3J:N7ZFPqVXa7/Wb5+Pl6bJTIZ5jdgpH
TLSH
T1FA95F16567E101F0D47BD138C9868663F6B2B8250364EBEF07AC8A561F23BD51B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 6654438cfe32f8993298e3826b3dbdbccd7802dce73a3818598040df176e6215
MD5 7ad3449ebe76395b576ad782d4786ae5
SHA1 883a381a946a07011cb1d09033f137989df1faf6
SHA512 db1a940a13a9be7ec24aad118a7252de6364bcbeffc355f7fbfc3fd42f4669cbf3e7799d5f3ab792ce746c6c4b960f579409be1f65a38b6c4d189c2c1d4de6d7
SSDEEP 49152:XBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjBb5+Pl6bJTIZ5jdg/:IG05lO43baslgJTIZ5Bgp
TLSH
T10FD5C06E62EC11F9D0BBD17CD9C6860BEBB23815032556CF02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b03eaba8ad1bc266026fe0e0727169d6a268e198b75d64d71a41234c65135197
MD5 36971a6ae00f2ea3fb14818ac18f1ae3
SHA1 99a768d6c4f113e4759690128b7be678a3023f76
SHA512 9e81a38450e88c49eded15bd054790154b6ab56c2831b79c9db5750e5f5f6adb7395092c51b4f0a46cdbc31bc1aed863e93166d16eb18ae92cef767ccdcf753c
SSDEEP 24576:Pfa5POZ3dpyWVM50JicR2hG0lasx2+47eidngmb57GBiOl6a8JTth/RWZvR6wQQt:3a5POZ3lJt2pasx2+mJb5+Pl6bJTIZ5L
TLSH
T1AE65AF5EA6FC01D5D1B9D17DC583861AF5B1342653329BCB022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 8c125b910f19e7d271e118b2a0b6339cc7cae416485e245c634692f0e38cce66
MD5 9bd07058e82308dca744aca0668c1c04
SHA1 f785bc1628ea8beb47b16a8307cb83fed8f90234
SHA512 0ee360c70d7c19551174387f6c23b17528a4b03733e7de4ef3798a3b4e04ba9b5848f0b4083d5c2bdcf7a35c0b2b3c5c8648d386665e7b0f241a05ed5f10c7dd
SSDEEP 24576:tNcwHdjbyQ4nLC18lb/EOjowL7FkKmb57GBiOl6a8JTth/RWZvR6wQQ92pN3X:tNc/zEOVHF2b5+Pl6bJTIZ5jdgpx
TLSH
T15A858C1623E901E4F1BBE1BE89679646FA717865573086CF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 cbdeb5e5fcdf8ddae57283a21c4b260de4b51aa1c55e4b8b8cac3b7aaa812b56
MD5 6c2670f647d2b588510aac35828fd8f2
SHA1 4cf70bbdfdf718dccca74f4a4ed0f9053449c429
SHA512 5a1315c74b2858024801b0d6c9fd79de0d05e2ae392a3b7160bce7fcbd496052e08a9c81e6c7e5c7498d7cbb95bd3affe9f129c0778982eeb05a049b4af6b6a4
SSDEEP 24576:6zkNvNnaFeYhJNtmZBm0mb57GBiOl6a8JTth/RWZvR6wQQ92pN3Y:6zMwBtOmDb5+Pl6bJTIZ5jdgpS
TLSH
T1DA55AF6EAAB805E4D1FEC6B5CD238512FA727461073253CB8290C13F5E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 0dad0858995723123c8a1600c9e9564ed1642e3498af7b7ba44dceab9ae4c42d
MD5 f24ea2068e6eee1e6f32d95fd25a2fe8
SHA1 d80466fd332958bec2c854971e811822438026cb
SHA512 3afa4d7ff749daab16af08d888466591243cd53d31eb46ec30fdc6ff2c3c37f053daa7e744bdf630f7fd9158768e4c13e30b6854d1b1edc560bb172dd121075f
SSDEEP 24576:hPUr+NQumb57GBiOl6a8JTth/RWZvR6wQQ92pN3h:hJQRb5+Pl6bJTIZ5jdgpT
TLSH
T12C75E11F26AD18D5E57AA17DC9C68709F771B862471292DF02E0813E5F23ED8BC3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 936f0caff43c1fee2949d37bdb894205c281b99d0bdb9941a3b5aaebddb5bea1
MD5 60db42f1434cb16cc57b5443688d7bb4
SHA1 dc039d0685c1a6f505bbd23308bf54469c5f0224
SHA512 f4a179a335618bbe4421a5de2f0f0e6844653f77df86823fd3944ffa2d01ea36a622a40cd115fa4f9293ca72f7fcb27216bbe12ce73db5b75efcb83f345f06c5
SSDEEP 24576:PD3FHshBIYQgARmb57GBiOl6a8JTth/RWZvR6wQQ92pN3a:PDVHeBIAAsb5+Pl6bJTIZ5jdgpI
TLSH
T1A585E17ED65D00E4E47BD27CDA938A06F67138A9472266DB02D481BA5F2BFD43D39B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/892-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/892-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/892-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/892-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1008-401-0x0000021D53920000-0x0000021D53BAB000-memory.dmp

Download

memory/1008-329-0x0000021D53920000-0x0000021D53BAB000-memory.dmp

Download

memory/1104-94-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1104-88-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1104-332-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1104-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1104-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1104-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2180-72-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2180-66-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2180-279-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/2180-64-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/2476-311-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/2476-114-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/2476-121-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2476-115-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3372-76-0x0000000000400000-0x0000000000745000-memory.dmp

Download

memory/3372-5-0x0000000000400000-0x0000000000745000-memory.dmp

Download

memory/3372-414-0x0000000000400000-0x0000000000745000-memory.dmp

Download

memory/3372-6-0x0000000002630000-0x0000000002697000-memory.dmp

Download

memory/3372-0-0x0000000002630000-0x0000000002697000-memory.dmp

Download

memory/3372-7-0x0000000002630000-0x0000000002697000-memory.dmp

Download

memory/4108-22-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/4108-113-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4108-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4108-14-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/4484-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4484-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4484-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4484-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4940-60-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4940-233-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/4940-53-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/4940-54-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5076-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5076-127-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5076-133-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5076-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5076-136-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5100-83-0x0000000000970000-0x00000000009D7000-memory.dmp

Download

memory/5100-78-0x0000000000970000-0x00000000009D7000-memory.dmp

Download

memory/5100-294-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/5100-77-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/5484-51-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/5484-38-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/5484-45-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/5484-39-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/5484-49-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/5764-106-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5764-100-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5764-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5764-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5764-312-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5764-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download