54cb624ab8f4e4b2253d484dc10ed3f8db44232c0da53ecd9aa3663e03dce0a0

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 11:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Size 3.3MB
Sample260804-navswaab32
SHA256 54cb624ab8f4e4b2253d484dc10ed3f8db44232c0da53ecd9aa3663e03dce0a0
MD5 7b1c5f581ae6a5322aac2bc765a61169
SHA1 4d0d6ac776803439cc17ec35a800bef158e85a98
SHA512 7c7b0b37fa602f71d4974fa71d00c624aaef2abdb3631a559a5a6ffb962ba7c3c31666e7d43dcc3a1d62dae29d4a678c4d3cc9a85de7aabf00d2dc7bb0527d61
SSDEEP 49152:3ZBATAK7IjnDreNwL934vskEuJUNFiAceq58uCiqHUzj23P2vDmg27RnWGj:3ZuTWDreQkEuJURmGjipD527BWG
TLSH
T148F5AF317701C4B6D95202B0ADBDEA5F816DBE218F7414C7B3D82F6E55B19C21B32A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1088	elevation_service.exe
5216	elevation_service.exe
4300	maintenanceservice.exe
5884	OSE.EXE
4284	PerceptionSimulationService.exe
252	perfhost.exe
5744	ReFsDedupSvc.exe
3116	SensorDataService.exe
2228	ssh-agent.exe
5512	AgentService.exe
1820	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c895e3dc5387db0e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113265\java.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000b407f4380224dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e1571f7b0224dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000859910390224dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f8ed317b0224dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c2eced380224dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2560	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2560	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2560	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2560	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2560	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2560	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2560	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2560	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2560	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2560	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2560	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2560	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2560	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2560	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2560	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2560	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2560	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2560	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2560	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2560	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2560	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2560	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2560	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2560	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2560	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2560	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2560	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
2560	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
1088	elevation_service.exe
1088	elevation_service.exe
1088	elevation_service.exe
1088	elevation_service.exe
1088	elevation_service.exe
1088	elevation_service.exe
1088	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2560	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Token: SeTakeOwnershipPrivilege	2560	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Token: SeBackupPrivilege	5744	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5744	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5744	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5744	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5744	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5744	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5744	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5744	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5744	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5744	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5512	AgentService.exe
Token: 33	1820	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1820	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1820	SearchIndexer.exe
Token: SeDebugPrivilege	2560	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	2560	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	2560	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	2560	2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	1088	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 4488	1820	SearchIndexer.exe	100
PID 1820 wrote to memory of 3672	1820	SearchIndexer.exe	101
PID 1820 wrote to memory of 3036	1820	SearchIndexer.exe	102
PID 1820 wrote to memory of 3484	1820	SearchIndexer.exe	103
PID 1820 wrote to memory of 6032	1820	SearchIndexer.exe	105
PID 1820 wrote to memory of 4576	1820	SearchIndexer.exe	106
PID 1820 wrote to memory of 5472	1820	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_7b1c5f581ae6a5322aac2bc765a61169_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2560

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1088

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5216

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4300

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5884

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4284

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:252

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5744

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3116

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2228

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5512

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4488
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3672
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3036
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3484
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6032
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4576
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8c35aee245a25c3846c9e40a506a3ef44447ae8ee9677cfb61faf623f8949e7f
MD5 9d2fcb28952757540867d72b9e1f7a65
SHA1 1de736c22c0891128987f8f57d9212a8d2830822
SHA512 2c971adcc138a5f40da491f9973f4ee3da5d4814a7d1465e14b112050ce2437007e6428c82fb31e97adbc7ff6137c6ac930a709a2bf6c2ead42b26026f8416cc
SSDEEP 49152:7b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnzDmg27RnWGj:J3q6HjBMD527BWG
TLSH
T181D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 227cc2a9b0c99fcdffc1453dce13952051f5d9b0e42602592842a20b5a9d15b3
MD5 990d484cd3f55a0c81da420e253adc99
SHA1 ffa63ff394bb7571292bb9cb6e5191a9a8c7fd4d
SHA512 e8ae14e95ae2687854c2ab224918f392de1f46a20c2a7a5bd8788604a4925e6a07ce1650846d00846a4475346974e539761f05a57c3cf81b22fffc11efa3b869
SSDEEP 24576:WXYfDtczAUsqjnhMgeiCl7G0nehbGZpbD:VtcxDmg27RnWGj
TLSH
T194650129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.6MB
SHA256 d356feba60e4872c64352874cd3c1c1019d1a415b35b2428e2ca29afe7608508
MD5 590bc3277fab4a849ff3584feb95761f
SHA1 0c6448969f98015eb4ab103fe41071718630a273
SHA512 c104f3fb8d77733891c23d940fd4b415af585e8a75d9b676522ab31637829c81943ce46cdd9271070c4e252ed41f628ae0d22e1db4d32dc9466a5dafa518d172
SSDEEP 24576:j0Le5ji0hmx5rM3sqjnhMgeiCl7G0nehbGZpbD:jPji0AXKDmg27RnWGj
TLSH
T1A0859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a794469229909bec963ccdc81a718f18cab655ae2ff57fe54356caf866da90c9
MD5 6b59c0756f2082e65bbdde238be2e05d
SHA1 8835afad52fe52d624f3fc7782bd5d8145a5a538
SHA512 27eb9081dc280c17eb7ee696d8efb83d1e2cb371a3e5bf8352b47bc479d1a8b0d8a93945cfbd94fbc04d448c41200fd4d604ac779df68b525ae2d0d659347423
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWE6q8wyudsqjnhMgeiCl7G0nehbGZpbD:+/ezSC6vUzPvxHjyODmg27RnWGj
TLSH
T1F7755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b225256b85f430993cee5c31c6671abc3a415f740ff20e9c649ae15f865f7b7d
MD5 191ded69308990aa9d843bf2d885d0e4
SHA1 c475e48ea66cc824ac84d7247268daf3b66eb549
SHA512 d29eea9aaae151648c3cb64837365abe4f69de0dc67aa2754c0c966b974eb24f8fdc962b05229b8fb5d052cb87b012bec843f276c3d5ecda4b7c94668ee4f215
SSDEEP 24576:LVbqPb88hv/l+6gsqjnhMgeiCl7G0nehbGZpbD:LVO88hXl+PDmg27RnWGj
TLSH
T176559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.1MB
SHA256 fb4089f9eea286c0a572ccc8961c737f172485ff3e4a9408b177bf1e79c94b6c
MD5 faddab2bea4dc5bc18290f7f9ddae4ba
SHA1 abf67791a4092a5f5fbaea9a18d86101f8245e1e
SHA512 f61c5410b873436d5100b1f7bd6617e8b7835e0585a489d3c0ef45791db023c78c11203d9f9ec0741e3bd0b56a31920074ad9ca57e257ef8f402e6c937ded887
SSDEEP 12288:35zXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:35zsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F04523BE824C10DAEA7608B5C3E9F55DAC137E5698200C536A637DFDE6F5468CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 f942efe00f48fb4b847bfefea1198493f4f65059e2db82fab15a7cd2188f24bf
MD5 a0b4b41da2d0c0f5cadf1e4fceb0dace
SHA1 4305823afb74dc2df706e49cb5c260af784aeefa
SHA512 7209ba2d016ab4d9ae753c6d6fe40e704949d984e7910291a5c68b3cccf6a1601b49e6a33abbb55297f2c7eadaf3c8df787b29188166e2aa02e00d39c2bec95e
SSDEEP 12288:ueBNUbTVO86UIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:uJIUIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F965CF7BEE28FCD2C27A8DB95791C600E76278314F21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 eee2cc1d2feec94c1f0a5e667b861e84fc2467a1a29620b410abdf7cfd32ea38
MD5 d1665a4967c0ae8a6cb0ffe822961eaa
SHA1 805618b621b640d56bbb91edf0afa89dfc739e44
SHA512 bebcc84b5bb774c0eeb120963149edf39a4ddb841447581fed254b1ba39970b7760ccf292dac08e8baa5d163365282cd41f769c423ae7e21a57f3acb250c4d2a
SSDEEP 49152:jQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THH:jQvGAdlCEL8c/yRNw5CRD527BWG
TLSH
T17D266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.4MB
SHA256 afd350d431d209bd20aabcae29166fb25bfd7ad9fc185084a30543b36c7a2dea
MD5 529eeb9d635d87d5c137ddcb0850ee59
SHA1 fa2b339107cda3efb03f2599794089b9839c43ec
SHA512 35505fc1a9885ce7cd32a5a8003435bd32e8052b5c50b5644082059e59af6b4338d8e700f602ed27424f4d8e65b6886eba1a234a474397543cb958b167639eb1
SSDEEP 12288:9AwSfxL/2Dc3XDLLmt0LDQewsAjWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:umewsAjWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A765E031FA74E036C77B0DB20B76D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a45c7583b90ec84d61dce933d3795063a2edc06f41bfe0da566e8c9ad2cee2f3
MD5 59d633d38275c393d5c4b3f9392135fd
SHA1 4f03347a26d80be6258521636d041b58fec174ee
SHA512 8cf45ad9a3a8621fce8581ee57292e011695237911311f90dfffe21aae0fe43779913c3a10d46736537a75040411dc314e10527b813cdccc24397a0269ccfa76
SSDEEP 196608:0UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHCVQBWG:0UEtQevvqc2W1cpV2EI321B
TLSH
T195474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b2868aa3287b33dba691283a2eaaaf57af38a639a15f36c1871cb3ab9651b4d7
MD5 65deaeda5e89e3e0c9002fce04b34045
SHA1 67d86cf445c8e1bb842e20b727c1fe99bfef62b3
SHA512 594bce1f2659d8809336d80f44c46f96eb36b594c4db0da9cde3ddd8893b08894f3542b3e05fa3e0ee2e08cd04f782378c2fd48b23088b0ffd977ad42dd7cc57
SSDEEP 49152:kCbRquA/m2yL5zQfFiV+XenmE3/z6Dmg27RnWGj:toqtVjnmVD527BWG
TLSH
T115D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ff5d2e6986fb7b5b362b329a99a2397300da3947d281bddb1fc319df9c96d50e
MD5 e77d389c7ce9ca2bbee336d55a56339b
SHA1 890d1ca507039be3e5d937a2abfea9e9f70db4c9
SHA512 e25757a4d39a63c161653c74718ce644a5696a86fb3238e2e0d0fd717a57aa0ce7a914a3d8afe47d64bde3c9e002c20ae966609f5b2b0aebfc56e4963d0387ba
SSDEEP 24576:FAhGLJIFoiwtA5l7S53hsqjnhMgeiCl7G0nehbGZpbD:FAMyFoiq5lDmg27RnWGj
TLSH
T1D8359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.3MB
SHA256 bbafef699a78d5b1ce570a5ae5184dd5937d4995dc0fc8f7957187a957833f71
MD5 46c1e00cd754069d7c54c560bc66479b
SHA1 ceaf97cdc33faa48cdc0687d7c6dd47f4a3d763e
SHA512 b47e74b2dda691216011b2fc5d4a73b7d73b56f10ae9a351cb4b00209c8072d8fe1b85097fcab354a1c70f41020ff539ceace9a32e13af40bdae9026b643aab4
SSDEEP 12288:tmw5HEjsChN8BFgl0WDm+C9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:IwuxOWasqjnhMgeiCl7G0nehbGZpbD
TLSH
T16F55F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 f11f42d0d8afe787ae6e27e177553471e675fe6e57c1924582bc5c387dcbf309
MD5 cd7888b9ace28db34a0376624217c0cc
SHA1 e861cb1c5b01e1584dcf2b2b2b38fec6d0499961
SHA512 b0a21fd4cd8c46f995b4dc7bf3c8cfccec0d277e92c81ac6462496ecf84c923cd43fbad2f569408d339055f186f6e01c6217a3e49dc9351b2ba8b9fb852ca2d3
SSDEEP 12288:fZZ1IymXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RZufsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BB4512AE239820FAE5634178C6E5D609EB333C53673003CF166656AA6F739D44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 787b521172decdc769dc561311437632d391bfdeb0d4619bd195395e43588e90
MD5 8a4372be12c26d27fe7be48514a1f64d
SHA1 e8c77ca967acd94ccc5629028a64bb01f0c8fce4
SHA512 db44cac5abe46d081f8f7cf91ba673bd9424372705635825ebcab96c0f546b255bdaefa0b0cf25aeaeefbd55b780d54dd6b03c53c9d652eba15a407081b558ad
SSDEEP 98304:yQRQyi36YOcPQLvw2gAf+PN3oD527BWG:pQyiKayX+PNYVQBWG
TLSH
T1D7667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 64ea8f6b3dac0d9457edf43e9045fdc40daa053b030dcaca9693413d18ff5fca
MD5 31dcdb792dac2e3bd0863796daec82e3
SHA1 49902aca236e11b0112354be450ec21f87e99544
SHA512 8db00535434301d3d7d9e4e1a1efc41093b990bc647d838a148ee0e2eccc07edefe817d8d0cafe10ec464be22513d380c12b70754ee4f1f8a12b2b4b995671cc
SSDEEP 98304:5QRQyi36YOcPQLvw2gAf+PN3oD527BWG:wQyiKayX+PNYVQBWG
TLSH
T184667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 21948119b910c8e39e160c50ccd855b4cf17c2969f0b7bbcd5aaed5dacf4df98
MD5 5cdb154ab270d20f76439b4cc6be3f78
SHA1 51b992c4b8d7d85c7ddd4e2e27f0150ca8af8ca0
SHA512 ec5813e5856b9da2c8de344d3fcd31221a0896790ba7152ff5fd6e36f106d075c16fccea161ec31923cff42ac98d19c0f166f099667999713270133b5ca29ae1
SSDEEP 24576:nwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0PsqjnhMgeiCl7Ge:P68Qg55nhheWu7PNU3/KDmg27RnWGj
TLSH
T1A3B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5edee141740eca253ded1f0d2568390df0123fbf3e199765df05fc29f4090e08
MD5 5217916eb0fa74026ecbe4abd7a08da7
SHA1 ab362a99b90844737385e0cb308d3b0ffedbb95d
SHA512 aa68925a6edc1a7dc5f60e99aa7d67bd47e2a1eaa983e1778cb9c399fdd082eb66217b758fd6fcc36374d5d75dd0f7d530b076e8288269d33162f1b53879bf09
SSDEEP 98304:My5112gYy5azzVvL69nLKnhZ3D527BWG:NLIHmWh9VQBWG
TLSH
T11D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5cf81012e33fb14195a07732514087b98bbee91eef43187fd35143422457ad85
MD5 f45f24b887d6ada0d17544645f88214c
SHA1 2d685106be40d9da8b341c009d47dc5cf34fc0e5
SHA512 7af389a9878cd71998325a18ce812ba6d5ca58dbe266fc7cc45cf7868c9ad202ae1966d116c330276a02358b0896347d9043c47a227935694712967d312a3edd
SSDEEP 49152:PB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glgDmg27RnWGj:xu6JmVxd2dgD527BWG
TLSH
T100D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 75e0b668db04e03914ab16740a3015a02cb2e9af00a057c43c0cbd2c29c54cea
MD5 872d14f627da1a830d49ba25a560b0bc
SHA1 f5a824083262e58188ce17212de6d7f3511b1b01
SHA512 70d215b7dcf23bc41e59eb44f6b0b08009ed27fca55fedcc7106c26b7099cf92be7d09e071bb0e2fdaa3ab6153465adbcb5c2f7bc0aca45f51f775d09eecb37a
SSDEEP 49152:D1hpsNoJpF1A6UU44CwH7R4xUDmg27RnWGj:DmifPbRVD527BWG
TLSH
T1C9B5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f8b985542d3e52bd657f3b3926eab9d16ef85c8a18c7dd395584e34a9669e330
MD5 ec8193de07c6d6227f2c03dd127aba5b
SHA1 6d0c02f2de99c83099599422d69f93aeea7a49b9
SHA512 40a3560a99a286973bdd3530ee6c9d95fdb6961e6f9d6bb2f9f5dae5a35de57df30075c0abb6c218ab45be048ccd0438d64e4fc8d6c0709f517c22eb9c833b48
SSDEEP 49152:8SuZQIY0Be2KRRVtOnks6NMHqDDmg27RnWGj:+5dKTi61DD527BWG
TLSH
T126C5BE13F2E900E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 affc4f47ebbaa33153bd30c38bfbf74a63d5d8216c2f51d0fe8f531a2dab5a93
MD5 5d4cf3c26f21b3a9689125b9f4917d2d
SHA1 e171414fa68b3fb739e53c93c61a39691386f03c
SHA512 597be31a8baff6c1ba6c1824513008faa21779f25ba86b91cc3fc1bf3da32bd11634e4aca2cc0ac8350381be2cdb06f46579dd33ddff33dddc059f4b750361df
SSDEEP 49152:jhtSn8EApI0figngiDn0AP5wwDmg27RnWGj:CX2iyphZD527BWG
TLSH
T10F95BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.1MB
SHA256 ada5896060c82528424ff7ac1fc6073e18175f36784a2c3a4811028e1fecccca
MD5 55ad4cb89ad8b07a5fe143d32c86aa44
SHA1 0575440c449cd52620dc9f9534cc826af9cadae5
SHA512 77b2744cf9a09d4c34a7caec636c918e80edf7aa5aacfb0a941ea20b0f885e1fd0adc31a8ce47950bdf37ac4a7e504a818e8d1289d389302d622fc6915d9bfa7
SSDEEP 12288:IbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1804523BE915C01CBE92248B5C3E5F14DAC173E57E92004937A5778BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.1MB
SHA256 4448e4b5dc99131694121b6d80831eaec99bcba4fe0ba9a2db5289979e0013b6
MD5 b1e10c784638db58a668656e61691147
SHA1 46b4b267448a15c1f9dc26e9b6ae7bc7bb08ab17
SHA512 99fc12ce10ec6dabdc01f7879297673e806bbd6daa49e8b19171993c59afac03f215941ef5ab6a6cbac10da0d2d79e84c0f971d9ac8c907065863ae8a4c2eec6
SSDEEP 12288:+yXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+ysqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F34523BE915C01CBE92644B5C3E5F14DEC173E57E92004837A97B8BAFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.1MB
SHA256 6d7451a2939ac62d866793c613228224bb118f5649499bab99f38172da392b44
MD5 927938faf05c18eee671fd4fde2681fe
SHA1 e314a22f8002b3ac775332ad13497a98dda5e597
SHA512 2cdac44b6e338a0c21a2919425bd63f94008dc412e7122eb7eb1e1433e591af81cfa63aeb49c138907517c810376763e5f2761dbef60b5ae70b9117c6c12b317
SSDEEP 12288:ZQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15F4523BE915C01CBE92608B5C3E5F15DAC173E57E9200483BA9778BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.1MB
SHA256 c326ffbe44d681c53f4e3d183139941826e17ea9ce9995d5ba5db685d6b3a67b
MD5 170c262b7d48f86fb84db2a698eedaa4
SHA1 008ea984197a175db48af5e5dcb9dce980b8bb19
SHA512 78797fdd11103efdf728951d46ef49bad361dba83db95fe7d005e67c82513aeb2f4a47655f750561421a81bb7878f4dc895d5382d70998a772da39939f5dc38e
SSDEEP 12288:rVBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CC45236E535C01C6D83285B5C3E5E11DE8237D56EB3005DB6B532CBEAFB26944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.1MB
SHA256 efbce4cc159187a92d1cb4a4c6aeab922cb4ff6e3c2665fdc01eedc7b8c25782
MD5 c5dbe3e656137be43ff47c02c6ae4c16
SHA1 1040078295c6ebf8fc22623662c1237d82212607
SHA512 2d4031a4571d713a40e46ccc5da1db907d6ee85e4cdb65e09bba2681cb50d949adf11c141003bb56010a2237dada84cbe2d99bdbb2cea03382ae644e7b194eea
SSDEEP 12288:JZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A94523BE915C01CBE92608B5C3E5F15DAC173E57E92004837A9B78BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.1MB
SHA256 e3f1322ea1bd7119635d1855af7127eac428bab8995dc8759f1aab3e630bad37
MD5 56b41ff1e75e9bcef406dd6c4bf2ba89
SHA1 7554f84f4f8ad8dbc23e82147e9775cb7ac0e2c6
SHA512 441e02617f003c17ba1641732af4598b016f4b0315a30a262e30c627ea4a9d1fbcb7642176979c01c4d8667160f2f9a62655873b320d8b609a40b874e00548ad
SSDEEP 12288:h+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:h+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T14C4523BE915C01CBE92644B5C3E5F14DEC173E57E92004837A97B8BAFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.1MB
SHA256 ae569ace03ea064582be7d56bfe0d59aa3de403a644a5a41259705cc5c02fcb5
MD5 5ae298e047a245120482f88bd6dbec07
SHA1 fa2048a0d00373094bcec5b52216974ce63b4624
SHA512 bf2be528867cb28237ec5b821e60ea0009d13c6301c7629d8f160d3da3598eed61cc233f2c5ed16df101090f2fe97d93ac36e0f5af7b4d3b6c094d86592e5fe3
SSDEEP 12288:pKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11A4523BE915C01CBE92604B5C3E5F15DAC173E5BE9200483BA67B8B9F7F24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 19a33d4829950ddfb5cd101608ea37b4b91488db5a475ebaf4c57ad6df750ad4
MD5 452aba87c0c77673fb880272d71908fa
SHA1 405bc70ceb232eb9dae2860746490dfa7a8ab6ee
SHA512 a7359e3270a1fec5b95d0c1efe20798984eee01cd2e5c7efb3ba7edfc42a604ff43f1e3d57d1db64cb651bc5c05634161b5c9683b7cdf10beeab6855d723d51f
SSDEEP 24576:OZMhzFVSOSsqjnhMgeiCl7G0nehbGZpbD:OZMhzfiDmg27RnWGj
TLSH
T1096501A9B35018F8EC63813EC965D90AD5B37C5A0B70C61F13A5366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.1MB
SHA256 6525b79e45fb44e75b60f9c78d034e9d91f1578601aa8e2d8c8890e2e3357b01
MD5 990c5335230523153984c41ed3e5cb59
SHA1 c23c0815687b3f2c1791adcde55c8cc2006ce191
SHA512 abfdc8d3c9a01cdb407c1c155d40bd2d4fbdf2a13a80656e16a84fb0c335ad9b17da65df19f3d1041ad95b6d3c4d51c38820f4b146a39b506b81c1f34ba14113
SSDEEP 12288:OvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11F4523BE915C01CBE92604B5C3D5F15DAC173E57E9200483BA9B78BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.1MB
SHA256 ab9fb06cd583f6346a7d196908b342d47fb313b877f21292085e795d2adfa6b7
MD5 2e46670ecf22a65ac74ba08144d7e1b9
SHA1 37040f503f523f4f1b4fc6a1bc78ecfbd0db05a9
SHA512 06b91ba26187c936049abe8ab942cb2bb077ea2574d43761374ed0e315352160573176e04580fc6733eb4b786850207e5f8d24e1e1ca7e2a1b8d71c306dc4294
SSDEEP 12288:DDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1054523BE915C01CBE92604B5C3E5F15DAC173E5BE92004837A5BB8BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.2MB
SHA256 9e96931047aa20da3fb3f2116ee5fee70ae874771aa111a8d20b3f3acc8db1fe
MD5 786782bca6b22ba36ae98b21ce1b6af5
SHA1 552205896d80063b9ca969663ccb05030fd75ee0
SHA512 3a08aab1f5e285d87ed7885029f2f2d2d0d8c983cd9d984e18cfa921a1306050ba142a60c97cf6f121c6042f973ee3fa5629a9a0574e3d1acd31dd9345d6b021
SSDEEP 12288:uyPz5L8mXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zzymsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19B55125B73A530F9D1378138C5A29A06F7337C3247204A9F17A556BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.1MB
SHA256 1a5848bf7d76d36c6ab9b30ab16b2aca736e4556ce5f3f7dc70afc9c095e778b
MD5 fd0aea3f56e71a4c1f62bc02a52d449d
SHA1 c55743c9e90573920b924551c2a9d1d0467cb184
SHA512 a9a483f8ace70769287ef9298612e5b109b9cd1d71dd8f84cff47985d27941bac1e64ccc094cd91e8e044eff03bbf2edeb8fcf6f13b85c84b590fed1f30472e6
SSDEEP 12288:nvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1464523BE915C01CBE92604B5C3E5F15DAC173E57E9200483BA9B78BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.1MB
SHA256 6e9300ac7b97f74ae775d61ea28b9ae8d1ebeab5dc4915e2d8fc40f67319f430
MD5 3031cdc325ab6845663cb84872b0b0ad
SHA1 7f760db72034ec2283f207ab3d287a0daa8a3488
SHA512 4214926d1ee25bc3bab3107970895458c18c8b68c04c900765e3768f4d48c28c884ea84e8f93a529181e90e7ea87bdcd23870f68d646dafe4bab00a370556b85
SSDEEP 12288:BvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1434523BE915C01CBE92604B5C3D5F15DAC173E5BE9200483BA9B78BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.2MB
SHA256 45d5bd9a72a98518d9aee51ab4a20f1aeb59f1d63cf82f0847a6e47163db3396
MD5 c2d8e7f560d063a93e4755efeb156f89
SHA1 63ae76661ab1bd857b6c4aa4b18fa71e1c644a4e
SHA512 61188cc4be6e9f498b41a6c3069f96b36c75589bfe34fd0d6d1bae9122d0b2941af17127e17169b984e28ab2da5801560c04d3bc965e20d0ab5cf6449def5cd8
SSDEEP 12288:ZyPz5L8mXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YzymsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15A55125B73A530F9D1378138C5A29A06F7337C3247204A9F17A516BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 f09f24f6ed85d6c9c1c88790e32da54c248b5519e944e4545ccce10e26c38e67
MD5 d72c59917a94940113c87de1140d9d5a
SHA1 0dfc070a0672b5c1ae0348dccef761b142d099ed
SHA512 9953dd4358f41d5fc388526e47eeedd8c8c5c99ee44c3ef45fae16896a6a94106bfb59111eabc78aa0749ab2478603b93aa6f64d42a70cb7268576999bd7d549
SSDEEP 24576:STCaLl3z0zDAsqjnhMgeiCl7G0nehbGZpbD:STZLljBDmg27RnWGj
TLSH
T15A6501A9B35018F8EC67813EC965C90AD5B37C5A0B70C61F13A5366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.5MB
SHA256 95fad6f6dd8476f245ecf15c9b3304f170b5102a4857450eca49755d68a7e650
MD5 254a0ac2e53daa6ce49582571e2c0fb3
SHA1 49171238a2768dd025af9868e357a58d3c435c7f
SHA512 e274ee153a773219a9d5c56a7bd35409af2862a796e6a6a80b0563ad6f75cf848bbc18d362523d2c8996e7a4a71c08f0dbf986c8a88d0b57964593abb71f2bfc
SSDEEP 24576:S3jd9CHKy7GZcsqjnhMgeiCl7G0nehbGZpbD:0jd9CHKyaiDmg27RnWGj
TLSH
T10F75CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.1MB
SHA256 9b3a8fca16ab41bb879f7b5b5a7c5f660512cf0206bea84150c257d9d09a7cea
MD5 9ef1c73133e9bfe0e0f7a4bd22081d89
SHA1 5c7c428728d8d9e3d514f353c9bfe62dd116c913
SHA512 53ebbeba5b8647b81ac39ac4e8c37eea192fdeb58b9f2b8e0cb90981c3d6f55715a40e22bff7aa3899afffc2e76e53c87e50f79b6888778c6255278b82073fa4
SSDEEP 12288:HwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19D4523BE915C01CBE92608B5C3E5F15DAC173E57E92004937A9778BDFBF24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.1MB
SHA256 82f73d65cd0fa66a6fba668e2e17f3d6476f84ff93041e8c76a993f38d2a0abe
MD5 9909b9530329c31b531351f034b6edaf
SHA1 f6b32cf83d891a419be94b992f917f520f02bdde
SHA512 0a4599414bd1391c03d81151ccec8d36b7c884daf2817dc456334f757198acc04c9886a2521f5116be0f92fe05f73ecbdea59829194ac1025aa2c8b932b2ff69
SSDEEP 12288:nGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D94523BE915C01CBE92644F5C3E5E15DAC073E57E92008837B9778B9FBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.1MB
SHA256 bd745eede00077d721eb0de168d1a689de12d72ac5ca2baa8779d17c1215dae3
MD5 fedf34baa35dbfab0ebd38b6c37cd6d9
SHA1 320ee5ff32df6516516d6249f08607b8bb7ee71e
SHA512 c98eea1f3ed0a8653a88cadff2b611bd9f24c969deb93ae1a7ad1ab34728aa1b8286f741ac6fa2b2c9ed2edc7b52d7d4d3df41a1ad1f0765b04201500ca74caa
SSDEEP 12288:x1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:x1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T19F4523BE915C01CBE92604B5C3E5F15DAC173E57E9200483BA9778BDFBF28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.1MB
SHA256 a17e5028b5fc123c701eb391c6616665b388153fc4b2b3dfd1ea65fb37ee794c
MD5 9c77cef2dae09b1a58c19843a7b139ac
SHA1 5083f433e84a191eef60579741bf2fec91e75971
SHA512 1157415d426e42933113962b3c2c04cc294717064287087050b9b37ffbf7ae8b93b7698e054cb25d19fd4874e5b6d3e5a9443432a9f9ce51e0b3c0ef71408727
SSDEEP 12288:nvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1124523BE915C01CBE92604B5C3E5F15DAC173E57E9200483BA9B78BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.1MB
SHA256 d632bc13c3dff33502b0bdcebc7c75cc66db5b12d53cc94f42f34af5f6fd0d09
MD5 1449db42ce874d4a681ffb85f16c1910
SHA1 7763001e0431e336a45b98f9e91c917abaf236f3
SHA512 ef9834f04ff014abc463d22d4bb9b868b0e8bb256a9c1113041ccfed9f530540c789366f0985655b892bd02e8a60ee20d7df6afbb2d51f963f34ba1906e8d7f0
SSDEEP 12288:JwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1264523BE915C01CBE92608B5C3E5E15DAC173E57E92004837A9B78BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.1MB
SHA256 4d695ee7033e1c5778f99e311fa979868b09772254359f5a232ed05a0bb3e5ab
MD5 2136934f88fac6528e2c763701479f92
SHA1 ca2584d97f997745e321f16a6bed8d1bf86d8a50
SHA512 cc4cf8060b70a6179735b03181aa9464958ca090df5939450d967c361d6e234f3bd0478ebc6d04984ea1b4ea28a3b9a3d6540169b2317c0cd7540e722e541d76
SSDEEP 12288:QnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BC4523BE915C01CBE92648F5C3E5E11DAC173E57E9200483BA57B8BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.1MB
SHA256 03c8e67b276a3286398021ba664467ad25a1a8a1b320552656a2f4609e914201
MD5 7552cc3cfc439b9974bef691d63dc2c7
SHA1 d5bc7d2dd9d7be3cc11e642a6fae892398e198c8
SHA512 5a07269d8eacb10e04f1c8351699a635970b7e7a20d3ca896e9b246cd954250af85897482c99aa35c49104df632701f21927b2b13f3613e0874159aff4d3821c
SSDEEP 12288:ZZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E94523BE915C01CBE92608B5C3E5F15DAC173E57E92004837A9B78BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 175e4f1d73a3603ae2857415a22d4d53138ebe3311c494710f7612f6d2aa74bb
MD5 70e6a8bf0f70bc999a58c88b77846695
SHA1 86130405c116214b22c83d02bca068b944a6d614
SHA512 c296f4e68263446b48bf4718201e2950e10e4cbe93d421764083b87740d796f054926939b0b7a874066b0eeba4ff6dae187c3e7d25dcec30390bfb8a1e101809
SSDEEP 24576:ofwvFk9RX6wkyAITsqjnhMgeiCl7G0nehbGZpbD:dMnYIXDmg27RnWGj
TLSH
T16675D029EBDC04E5E177913C89B7860AF6B278591B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 9e32ca3ee4c80dc35199202248d5cab9a6bde5d1df2136bb8c869a4e4bcee9f2
MD5 4997e5a36c59eefbb95123d5eeeeab63
SHA1 123f11af19995599aa1c71839fa7ce6e6e148612
SHA512 3928cdead4c22a9e18217de84d06bb2e546c6a02d64f91e72dfaa9e8633f744d62798dba446bb6c462b1b5aa13c7db749523875bee05088b2cf751de6d6e010b
SSDEEP 49152:JYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0QDmg27RnWGj:xySzPID527BWG
TLSH
T1A9066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 19faa98646b8de85c8044b1ff2d986123207aec14e522710fdd54c3bbafdba48
MD5 73380b4a8617decc6d47c0b21482ce2a
SHA1 d0f608e5a3c364f78373ec6efbe8ce09c5ea0274
SHA512 a02c090e5b202e81de93bfabcbe988e712998c763fcfbcee2d4825ce16ac411d84288c217f965c6294d929417e8f1a05b9f84513756ba4995f6e24d82a76b314
SSDEEP 24576:B47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYisqjnhMgeiCl7G0nehbGZpbD:B47JUQj1irIhCnDHUPfF/gDmg27RnWGj
TLSH
T1F965AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.2MB
SHA256 9e3a4d4a11a1c2188baf9a48fe5c768daea3e4bd01fcfb93373adbcb463539ab
MD5 79d9bbb7444a1f97a9ba83ddc8505c78
SHA1 dd36c85143a6f95bee61521cd30a109980f23d7f
SHA512 9e8824fbbe06d062735a95e27e7d09429a33bccb4af0f7a39a2f8dc66531d59486f5651ee949b48b410c97c874837b70a35256157f836d146c1eaa3398c61bcf
SSDEEP 12288:EysffXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12B55015AD29802D9C06E5179C3969605F7333C2687E093CB67D1F87E1F766908EFAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 eb0b107cee3fccede6b3b085cad077ea7df19af2f561e66b92d9c65e0cc4c554
MD5 668682d3f2ab80f2f68b276aa610ddf1
SHA1 d25ae1224b0a0f7c2e50ca525258ea82f78cea07
SHA512 a20c54a368257ca4a7598646f8e5b75a220a873da4c03d645b13b0f47544f9025353e57c19b703a889413d1a2c435f6491fb28ecd05acdcc385b58b2b13d965a
SSDEEP 12288:cSyPiU3fXz1447aZWk8Y1vJbm0+lOZWi45lpD5ywODV:cSy6UPXzu4sWm1vJelKWi45lptywO
TLSH
T179553741766BD78FC6A940321E36D6CCA7707D01EE45AF0773C8873F9476668B6B2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 a582a7a08f3ecec3c26685528be91372af16e5669907919df761893774a3d0cc
MD5 0d48fc68d6aaf8b1caacd2464ef9a680
SHA1 8513f4b17938f0cafc2580b106e13753b626fa3c
SHA512 fc17d6e86d4a937e4cea3a2a98ade4d273a8269c20a407d3107d8d2e510d2e8a6d641bdb7bbf7abc356aae8e5359ec1716641cd66e3a611b337ed98c16b8cf1b
SSDEEP 24576:jblGVdxBJDMhO6t4+6rbTu2DR6WKyoyoVZNJ:w3xBJDMhO6WzTuEkPXd
TLSH
T1C3553A4165B7E35FC9BE9037433286CDBB749C02B7463F0573448A389866A7EB5E2392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.1MB
SHA256 bb71a90ff856c040b90ef140735e1c41bf544e98d6bac0b51defb8fe941c8360
MD5 a4d2f2b1ad4204c30fb59ae98bfd04d1
SHA1 8f15ba8bb2238c4e127fdae8f8f4f87d113e06f1
SHA512 4829f4e83a99986d7c6a2f2cb9d62a61cf7d3cde1aeb1926eeacf826998dafaf1fdba401f4d371eaed228cdd9270e70fac5a1b800c4d73178f91db7d69308449
SSDEEP 12288:o07XXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17E4523BAC34C118AF93605B482EAE12D681B7E669F1004C3BA5778FDF6B18D48F39517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 cdcde991d4d51754958a9438ff5e942b17cb54f550466a9ba5be68d25b7bf3c0
MD5 b0d3e74933562c69e51a6aaf920d252a
SHA1 891b07dd0e04f6543304cc20b6c661d8194cd713
SHA512 7cec530a49c247940a504c2fffa13e8b845250caa73b865647f6a5d34278581a71aa26fe637e4c2e14e2fb72c6c31c612d7b2c8322e770c9fe73e1ce40ff5b3d
SSDEEP 24576:ogb6bmBIi49WNNFpg1rSvFv7bYdsqjnhMgeiCl7G0nehbGZpbD:ogb4mBIBhGFmDmg27RnWGj
TLSH
T199659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 498fb461bb0deb429f7320aeb4d57ea6bbc3c25faf12366ef85c1b65ed1910f4
MD5 2c5a8ca8e5a2dc909684191c69fd93b6
SHA1 7f755c364dad4f4afe2d45ef72ad0a4715f942dc
SHA512 45c85c0af269ca8c4f4bc316190deea6f382b4d6a3ef58eb8488611da1500aabc01c8fb9939864d0035b05c37eb9a8d2c7ae1b2b550ba10f6bf0974f80ec531a
SSDEEP 24576:3G88u8FpJqH1Wzria7/mSsqjnhMgeiCl7G0nehbGZpbD:27ZFPqVha7/JDmg27RnWGj
TLSH
T10D85F16577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 d3e8b1b5c442237937659484f7882de9157fc36841652341ae4b1b23cab35b44
MD5 18cf834b0dee355d401f2d76242d902e
SHA1 e7111a809b775b66d6a9b709bacce4998b21bc69
SHA512 04c0530e826610b9835fc37efac2a5e74d5e03235af78d6d03d05a910066128eabda6aa90cea6907b840ae89da6c245697a1f83663ebae420f2a118c7ce62765
SSDEEP 12288:/HvUrBFrEjwaQOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:/PUr+NQOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13755F12F62AC18E5E676A17DC682C70DF6727862171192CF02E1817E5F63DE8AD3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e6e83e668bd7bf3bb4463d05c3b25cd264f1bc70adb280a7e77cf2182832b1c0
MD5 1942e65f831a0b012296abe4644fd452
SHA1 f0de107291201305a317aae2a36f21d8ba3aeac0
SHA512 cb8a6d29b9f24502f4bdbad95f1f12454c3261cd164fb00661f0938e5f7eaac669817bf78d491d59f82bc80e242e1b97f6cf92e82f7f60ed929b8dcd34d9f192
SSDEEP 49152:dBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjSDmg27RnWGj:mG05lO43bfD527BWG
TLSH
T104D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f9027eee39ffb47ad8840de12c75bc5c22ca4780245608a1b56d09739069260d
MD5 9d3cae4a9bffee6db7b15d9fad011f5d
SHA1 ff563bf4f365af4f451bfefc17ae1d682fbad69c
SHA512 feb21eb8a0f817bc43f585c18dfc32d7976a643686040a40fccf5a8508dc06cf40dd30887395fa8d0e88a8262dbd352aa2b19e34c26488c4d32388fa12059e6a
SSDEEP 24576:9fa5POZ3dpFWVM50JicR2hG0lasx2+47eidn0sqjnhMgeiCl7G0nehbGZpbD:Na5POZ3+Jt2pasx2+mKDmg27RnWGj
TLSH
T15765BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4aad349a053b42cf80a28dec68b3f9ae948ef224eae762a03f798eb7d281d6bd
MD5 54da2fa40fe21723a063e02ff201f86d
SHA1 c733a2648fa67b818da84bf15a7e1b89f9962971
SHA512 3eb646b216b3176708e51b3bada547d8a8f01478befefb3d2a233ec87c831faed05e32602006752e1290f40bb754d2d44ea1f73f9db4bdf021f79a1a9ef99409
SSDEEP 24576:9NcwHdjbyQ4nLC18lb/EOjowL7Fk6sqjnhMgeiCl7G0nehbGZpbD:9Nc/zEOVHFpDmg27RnWGj
TLSH
T10B857B2623E901E4E5BBE1BE89779546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4c1f365254778ee19db6608d304581803b20bc1475c0b4051ca0ff724d66e5ed
MD5 e68cb1542a7bbc7d28faa8ff88d85d62
SHA1 1cdd7920546ccdb5c4557fec6c16cc2a5bc8a489
SHA512 419ff44205e6f06dd64f8b7b553d5dedc6f1f01cf13d24b0d9f33bc05a460a3fad36b43a9d4fc08261d016e5d27a4a26a177a62c803e7527d3a32a8b2da4c185
SSDEEP 24576:V8kNvNnaFeYhJNtmZBmYsqjnhMgeiCl7G0nehbGZpbD:V8MwBtOmEDmg27RnWGj
TLSH
T10C55AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.5MB
SHA256 83f5fa01bb29bd753d4d3474a3da23a14554a7ddf709ff42c29ace380efc6062
MD5 841fb7f837adb526a87c904b4fb28ba0
SHA1 f0458106dbcb7583aaf4060080db49c316cd0677
SHA512 0de0f18a6ee9d9e8a9df9a9bb438fd387a1c5472812911ce15e50ec671fb1d985043b1725650a616574d970f2a782161d525a4ed9182b140252ddb773db608f9
SSDEEP 24576:WD3FHshBIYQgA7sqjnhMgeiCl7G0nehbGZpbD:WDVHeBIAAvDmg27RnWGj
TLSH
T1C275E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/252-82-0x0000000000950000-0x00000000009B7000-memory.dmp

Download

memory/252-280-0x0000000000400000-0x0000000000522000-memory.dmp

Download

memory/252-76-0x0000000000400000-0x0000000000522000-memory.dmp

Download

memory/252-77-0x0000000000950000-0x00000000009B7000-memory.dmp

Download

memory/1088-13-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/1088-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1088-22-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/1088-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1820-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1820-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1820-149-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1820-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2228-113-0x0000000140000000-0x00000001401C9000-memory.dmp

Download

memory/2228-115-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2228-121-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2228-311-0x0000000140000000-0x00000001401C9000-memory.dmp

Download

memory/2560-7-0x00000000025E0000-0x0000000002647000-memory.dmp

Download

memory/2560-0-0x0000000000400000-0x000000000075D000-memory.dmp

Download

memory/2560-1-0x00000000025E0000-0x0000000002647000-memory.dmp

Download

memory/2560-86-0x0000000000400000-0x000000000075D000-memory.dmp

Download

memory/2560-6-0x00000000025E0000-0x0000000002647000-memory.dmp

Download

memory/3116-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3116-312-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3116-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3116-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3116-101-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3116-107-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3484-318-0x00000195AB170000-0x00000195AB33A000-memory.dmp

Download

memory/4284-256-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/4284-64-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/4284-72-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4300-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4300-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4300-38-0x0000000140000000-0x0000000140160000-memory.dmp

Download

memory/4300-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4300-61-0x0000000140000000-0x0000000140160000-memory.dmp

Download

memory/5216-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5216-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5216-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5216-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5512-138-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5512-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5512-133-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5512-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5512-127-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5744-88-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5744-295-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5744-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5744-94-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5744-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5744-327-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5884-52-0x0000000140000000-0x000000014015A000-memory.dmp

Download

memory/5884-53-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5884-59-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5884-217-0x0000000140000000-0x000000014015A000-memory.dmp

Download