eb4643cb32a6f548618e0fbdd745283a0d97d71f314aefc480db1ca9c0ab60d6

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 21:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Size 2.0MB
Sample260805-1pgwsaxcpc
SHA256 eb4643cb32a6f548618e0fbdd745283a0d97d71f314aefc480db1ca9c0ab60d6
MD5 04a1c91dd8a59fbf4f4fd8b536704aa8
SHA1 d569cc713e0f56c6cd3bee7e2f719bd4698fd33e
SHA512 431298b99ebe2c94766848d18b43422f87ec0e5fd8cf6038c524ca8907093125188c4078518e00ca2f43d36e976b7e12008dee318172157d754de6d079158b68
SSDEEP 49152:UKKepYeEAYOW1+M5A83M+svqiaQXozsr8zlLwJIh:xK0W1+M5NYwFRKIh
TLSH
T14CA56B1177E95A29F1FB2B71AEB851604A7BBC615F31C7CF13801A5E2970AC09936B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
20	2548	Process not Found

Executes dropped EXE 13 IoCs

pid	Process
4712	elevation_service.exe
1640	elevation_service.exe
2356	maintenanceservice.exe
6024	OSE.EXE
4844	PerceptionSimulationService.exe
2392	perfhost.exe
2076	ReFsDedupSvc.exe
1768	SensorDataService.exe
2564	ssh-agent.exe
3252	AgentService.exe
3896	SearchIndexer.exe
416	Reader_sl.exe
672	RdrServicesUpdater2_x86.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe

Drops file in System32 directory 58 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ed2449a724febf98.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117953\javaws.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117953\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrServicesUpdater2_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sl.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000068abe512425dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fa2f8a952425dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007217ae522425dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000945c43522425dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001fe065522425dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Reader_sl.exe

Suspicious behavior: EnumeratesProcesses 51 IoCs

pid	Process
4244	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4244	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4244	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4244	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4244	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4244	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4244	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4244	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4244	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4244	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4244	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4244	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4244	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4244	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4244	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4244	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4244	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4244	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4244	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4244	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4244	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4244	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4244	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4244	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4244	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4244	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4244	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4244	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
672	RdrServicesUpdater2_x86.exe
672	RdrServicesUpdater2_x86.exe
672	RdrServicesUpdater2_x86.exe
672	RdrServicesUpdater2_x86.exe
672	RdrServicesUpdater2_x86.exe
672	RdrServicesUpdater2_x86.exe
672	RdrServicesUpdater2_x86.exe
672	RdrServicesUpdater2_x86.exe
672	RdrServicesUpdater2_x86.exe
672	RdrServicesUpdater2_x86.exe
672	RdrServicesUpdater2_x86.exe
672	RdrServicesUpdater2_x86.exe
672	RdrServicesUpdater2_x86.exe
672	RdrServicesUpdater2_x86.exe
672	RdrServicesUpdater2_x86.exe
672	RdrServicesUpdater2_x86.exe
4712	elevation_service.exe
4712	elevation_service.exe
4712	elevation_service.exe
4712	elevation_service.exe
4712	elevation_service.exe
4712	elevation_service.exe
4712	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4244	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeAssignPrimaryTokenPrivilege	3252	AgentService.exe
Token: 33	3896	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3896	SearchIndexer.exe
Token: SeBackupPrivilege	2076	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2076	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2076	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2076	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2076	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2076	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2076	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2076	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2076	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2076	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4244	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	4244	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	4244	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	4244	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	4712	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4244	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4244	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3896 wrote to memory of 4324	3896	SearchIndexer.exe	102
PID 3896 wrote to memory of 4572	3896	SearchIndexer.exe	103
PID 3896 wrote to memory of 4740	3896	SearchIndexer.exe	104
PID 3896 wrote to memory of 4240	3896	SearchIndexer.exe	105
PID 4244 wrote to memory of 416	4244	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe	106
PID 4244 wrote to memory of 672	4244	2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe	108
PID 3896 wrote to memory of 3448	3896	SearchIndexer.exe	109
PID 3896 wrote to memory of 2348	3896	SearchIndexer.exe	110
PID 3896 wrote to memory of 3012	3896	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_04a1c91dd8a59fbf4f4fd8b536704aa8_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:416
- C:\Program Files (x86)\Common Files\Adobe\ARM\Execute\3017\RdrServicesUpdater2_x86.exe
  "C:\Program Files (x86)\Common Files\Adobe\ARM\Execute\3017\RdrServicesUpdater2_x86.exe" R32
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:672

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4712

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:1640

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2356

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6024

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4844

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2392

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2076

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1768

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2564

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3252

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3896
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4324
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4572
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2844 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4740
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2940 2864 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4240
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3448
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2844 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2348
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2940 2864 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
Size 1.5MB
SHA256 0a2cfa4ae1a06103c92cc44d40f09f57ddcee4ed3a4371c80db8835f27cf78d0
MD5 e80d89124fddb4ff0a0b1795dfe3da18
SHA1 b9335e9bd0f0627625ed8f6560a4a23498c1963c
SHA512 94d1b7263dd1207562118407e25731d3942eca8f1b3acf2d3aec021bd001b3bad8fd527314e5ac54a1160468b85a7045d078eb0dc8a1cd33fbd3e3e21f4e096d
SSDEEP 12288:bFUdpps8CyPj+4IQ2fhrctYDwvXwtIEEITE8T4M8eHpCOOOH:BUdpq8B7jIQEhQt7vg3JTE8MveHk1
TLSH
T15475233B3A4B2B61EE2681B118A09BFBD07EED605F41A593A203B35759FC5D10C7462F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
Size 1.7MB
SHA256 89ee6650dbc3ec1a3d8f2fb621ca9e02245c829ec495b97c806b42bf62c27095
MD5 7ab47259b4ef2bc4f86c5ff7de12e590
SHA1 e2937a4d310cce51f368823dd3960c9f63f68fb0
SHA512 066558a94bc6b5ecc3c14cfc70fee789ef25e4c82aabf10705681931fbe37a59fe3920d8b0e2e32038580b0a6dab557c1eb57152250ef89f7489ad9b64336993
SSDEEP 49152:+SgouvAeFfenxyQ5XS7uQ0NIjpq8BX2Qt8ZTdaeHk1:+S1uxax1S7ukxshT0eH
TLSH
T111856A1267F94129F1F37B71EEB993645A77BCA1AE39C50E5280025E09B4E90DE31B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
Size 1.8MB
SHA256 df147f9bf215d235d6cea9de60cb372b95fcf5996468109c617d4de063501600
MD5 5a0bec02b9f7b765774698d002034821
SHA1 d16cdbaa5d3e982161b48976add231577e777a74
SHA512 6bb2aaf14bafcc9f68362c69895e6e76677c0aea0fd6f00d599bc2b74d607d1ba08ead13657aab5bebb6abf654fcd63975d876ffcca4880649851e3e6d92462c
SSDEEP 24576:k8TAbD+OmeZpq8B7jIQEhQt7vg3JTE8MveHk1:XTAGOmeZpq8BX2Qt8ZTdaeHk1
TLSH
T17E95E11037D08135F1B319768ABFD728552DBDB11F6881CFE389166E5EB06E0AA34B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdrServicesUpdater2_x86.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\Execute\3017\RdrServicesUpdater2_x86.exe
Size 846KB
SHA256 6a142c879a0676aef5c825d6fd6336800846167fab422d0f912096d286aa0070
MD5 a447c3cf3b7547e5a1e12dbb92d8c052
SHA1 d2b246eda6302534b21b2003719d9f911d0c77d3
SHA512 ce7446e337cc13a560a12b0b789813bfb5a96a6a9d25a8b3e2fc1ed884f0c4950f01937714614666befb9b92123d359b9597116e9ed9e8efd46b77a640d002ea
SSDEEP 24576:uSU4vrTQA/gK/c8DV5Wa1ZmPEKBLeiGA5nEJ:uP4j5gKU83W3FLeilVEJ
TLSH
T10C059E22EAD18073D563143102A66F368EBEB9310971D98FA3D41A4E5E705E1BB3F397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c35fd9793a382705ee094da80a49fc3b6c8bdd7fdb2290611a651b35b45c3817
MD5 19f152473ee945150c58c05be91548c7
SHA1 b3876633941c4cd82af2d89c981dc83986905ff6
SHA512 4c640f6e4f60fa05327520ddd1b4725f980d904065df79e69eb181e12a0b18be6a6c5d32ac7102463226ff4e0fc57a39a3247ee9a3130c0def4e2eec7611b4d2
SSDEEP 49152:zb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnRXozsr8zlLwJIh:R3q60jBMwFRKIh
TLSH
T1DFD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 79c63a2bae0781b2756ed01c62520422679d9b5fad15965e160bd9e6d04583b3
MD5 7de57b362f63ad1a64f037caddcae61f
SHA1 0a3b1231f22e9e8cf29c3000d994d869cf643cd2
SHA512 e0c61779f407ff6f0a273127d67fe1e5636875446308ea05afa88406bc332122cf7e05e9c4a1ffd6ffef63224e228b09ffd7dea5a2ed6d6f2c319b0ddc63ec0f
SSDEEP 12288:z1XLsswWkxy2lRq2czAZUksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlG:pXYfDtczAi9Xozsr8zbhN6GwXOGIh4
TLSH
T1B9850129B7E008F9ED678239CCA28501EA73BC5547A0E7CB03B485655F336D86E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 9a439aa7178379817b1b10e3e6e6ee6eacd2b9acd4c0b74246bf0bfdc804d802
MD5 411761657b4098b32c4c18e032fac502
SHA1 7164bfa2d818702f09524f496eb5a52c62efdd13
SHA512 7bfbb104f13622f578830cc116c7adb71065a6a12ec860a73f18403f8ee13ce8c84192c405d054da8203a59390ee8098037a75727a58db66be5d268014f1c90d
SSDEEP 24576:K0Le5ji0hmx3rMz9Xozsr8zbhN6GwXOGIh4:KPji0AhOXozsr8zlLwJIh
TLSH
T13BA5AF26F6748331D073C0B9C5D2A68EED72308657308ACB4296D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 966bf51ef1fea9e9414ece32f01ad50a6b1f3b58db1b66f2717cac839f0200a3
MD5 ec07cfcf72bd8bdaf8c8f2519d533191
SHA1 e71bac78e95fb710badacdd3b435c10329e6bb19
SHA512 8c20589bad2e125951629999820810d62905b166100554d8d29a1e79c748894687b7e318798650228e6fe0616ea637f71448e0f46255c7e42af94c4bda2407fd
SSDEEP 24576:ua7/ezSC6vUyD/aqgrvWr6q8wyuB9Xozsr8zbhN6GwXOGIh4:p/ezSC6vUzPviHjyiXozsr8zlLwJIh
TLSH
T1B9755C25F5788323D0B3D0BAC5D6BA99FE7230465B3089CB0246976C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9d929d349b801da9aa2702f15d1ee9abea586f0230758b54f28db7a8d31c03a7
MD5 5e5338c6f90a9a659b2873bdc86b471e
SHA1 1b5bda58986e7fbf747eeb7d515ffbd7666666ff
SHA512 a5692591964403b4591fb82d32c8d6ca340da6bb4d5f5477f7a00d86a239f4fac517029eb49bc01989b3c398aa8d5ef3a2157660dad6f3138efbecf2a3e79420
SSDEEP 24576:JVbqPb88hv/l+be9Xozsr8zbhN6GwXOGIh4:JVO88hXl+IXozsr8zlLwJIh
TLSH
T10455AE66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 f98de86d2501eb23419ff08e722c2dada38219a0575c3102bde07e639d2b7d6a
MD5 58678e175f919bde023a7ea6d88049a0
SHA1 b4e209edc9ece810560dd19ff36562020c1893ca
SHA512 ceedcae12a0c6ccff4225194dfe99f881b977af8b3ba772312f7a1ed7c12ab4188b824b0e9dee8e32e1fdc96f39faf53456655c4b1b870f7ef5880622496fabd
SSDEEP 12288:/RiUksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:/RP9Xozsr8zbhN6GwXOGIh4
TLSH
T1876523B7E691A442EF671F3139916AC4DAA7FD9E49811B5112382186CC7E43AFE31332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 8de543d245774425a79e92eb921d1d05067478a316a6fc0f7a1e12fab8b8eafb
MD5 0ffc37ef59873a0f640476e6e626acea
SHA1 9b7d3a3f7a0d1f8412cc072167646fa9db04d3be
SHA512 5447e3522d784dae9b0d24f3625e5a4aae22e5e630a9fbd0b439bd5e9775cf0beaeac3ab83cbac96b752b69467da572079c10e6c959751216e4e4d499e49481a
SSDEEP 12288:deBNUbTVO86UtUksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:dJIUW9Xozsr8zbhN6GwXOGIh4
TLSH
T18A85DF7BEE28FCD2C27A8D785A918640D7B278704F52A3CBD174820EDE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 97bac18f2f367e2fd05316745412ae7193337b788445cf54977953076ece4dfe
MD5 e7f2f5c52449b8630df204ec5d06d359
SHA1 596d49e5d2e80bdb6f5e3d9ab99af29a9df1f6ca
SHA512 4db839a194cbec2cfb3affc5c482b0b2a9b6944c3d833a09912b0ff8549a8b39f07fcaf540adb39890e8e9bc3ae4215f277bea33591f1110312164d5d75545d5
SSDEEP 49152:sQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THz:sQvGAdlCEL8c/RRNw5CjwFRKIh
TLSH
T1DE267C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 d8786e89181b5082aef21d2c93b641ce51ae78e6caf2c6154d6db4aa747528ab
MD5 96d3aa8100f2f177aaf947451e33462e
SHA1 04075a78a0c784853efd2e408068ba7216534892
SHA512 31b850da6868a0018d5b63a3f7361f129f96e13434558533ea9ec5f4f35ae71a9e67e6e8f4491e0d71e21b637dd8bcf6cc2720f50de1e95a117821681508ed20
SSDEEP 12288:jAwSfxL/2Dc3VDLLmt0LDQewsAjrUksLmONw/CX7YNmysags3R3DGwv5NjOytLs5:c4ewsAjk9Xozsr8zbhN6GwXOGIh4
TLSH
T17B85E031FE74E032C7BB0DB21B26D716587DB9604B911AC3E3B8498E99341D22776B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 db89dd9425d26b64d0d70a7cb96b28ab7009de6626e04cbf8f492b5cb69ab826
MD5 677c47f76a04a83c3e5b0cffac07d09a
SHA1 3c77047622e3d7a5fc1a5e21186c527ed0fe10b4
SHA512 5d2e86e5b24657336d2a948d2390dff73d6432fa7e489e2640494fde5cc03a7d3de2b756ff6b7eef88db3da598c8bc0d0f9ff2cfdc782ef18bc3cab088ce6dcb
SSDEEP 196608:0UEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHZDKI:0UEtQevvqc2W1cpV2RI32ZD
TLSH
T1CF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 defd85aad80f89515bb00723e831a2e6e3ee7858aa6c79e4404c9983d44082ed
MD5 ae139623565f867d32f13069245cbc84
SHA1 3b2e1daf333157b07b70423c623757221f948065
SHA512 de2487cb6c0ce9b719b6961577e0274ccd4f7b8b612bd730c05821e24912170a589d084b40913e7e37e289f8044f9ff55dab955bd5afb18e02c792f57773b381
SSDEEP 49152:sCbRquA/m2yL5zifFiV+XenmE3/z+Xozsr8zlLwJIh:FoqHVjnmXwFRKIh
TLSH
T1BAD58D1976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2862691d54f213ca0018b2469134b088e44a19980c2a9f1bf40afec4c2d8e301
MD5 200e8b97dc4753fe566d5ab0bcce1125
SHA1 bde914b71b74ecfbbfdfaa94a87c7063694ce285
SHA512 7b6f3a21b345b40ec7e6d1f37dc43c5f67227959d54865c10fd3a192063f8fd2761c7fff052a6f042963af099550e8f595764405a23221150dcd60101b7947d1
SSDEEP 24576:+AhGL2IFoiwtA5l7S5319Xozsr8zbhN6GwXOGIh4:+AM1Foiq53Xozsr8zlLwJIh
TLSH
T190359D81E7F955D4F5B3AA7899B69570EA76BCAA5E31C20F2160C10F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 ca5a665d97889cd57da6fc7c87f19618037a088451e537cf4035eb5871e9dc15
MD5 982ca69a35307f6c9a370b3f531d2411
SHA1 099d84c9ca819a34a09492d68e1e60676511a4cb
SHA512 05d190ac368fe8408c695af70fbf9ece16f463dcee3779ba45d3689c7f1ffb98d9d9af52905366a022d5b5f273d4a1168a870e7f9aef5c1b8187ab8398f03e06
SSDEEP 12288:wmw5HEjsChNkBFgl0WDm+C0UksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjL:twuVOWY9Xozsr8zbhN6GwXOGIh4
TLSH
T14F85F14676A41CF9EAA786398587C535E7F3BC062A21DB1F1370C25B9F37221BD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 34f12b363370472eb90afd98466548554c9398213dc3c6ead6b091b658447dda
MD5 ca7674aecf58c03e3dd40d81004f4d73
SHA1 ed0441a32511e1bd68a84608b076039b356fe944
SHA512 efeb1f873ff239b6bee03be5902290abe139cd62e493a84faa38125adb4bbc365bf025d751d9bc4af33d1b8be2f32d129df3d9097f307ad5df32cfed53a61814
SSDEEP 12288:/ZZ1IybUksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:RZur9Xozsr8zbhN6GwXOGIh4
TLSH
T1497512AB73E030F5E6A3473998E15A44D7B3B856577203CF1238025A5E37AD66E35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 022f7750eb4d6b5151721e7f42604a4d88c91d70fd26760075d57e12f25aeb33
MD5 45386526cc1394a2e4ddf034413f36c9
SHA1 7f4187700b7ecab558b5f0da862936a92d9eb856
SHA512 35e39487acb89c700ce8f6749a5d21b37d324a231595af636ceed3200ecf35fc7b44c11c989cabb716f48937c0fad7aaf787d1e8b97b50c8f4dfb7190482c98a
SSDEEP 49152:Oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uv:9QRQyi36YOcPhLvw2gAf+PN3owFRKIh
TLSH
T11C667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6f2c4097aefde9e2101ad449de64bdaf581c8b680f9f093d927c77d71a5f0b49
MD5 d6bc1e7baa017d4a60c02928a2b49126
SHA1 374b8693b91c5d0b11b60f2af237dfc60dfb2977
SHA512 67b053f5990f2c8035260c3d9910a55cf5fee23829e2288511aeddfde0af5b797807e715764eb7d9147213fda0961059119b4567cdf54d975f400c41f8ec7437
SSDEEP 49152:Zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uv:gQRQyi36YOcPhLvw2gAf+PN3owFRKIh
TLSH
T197667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 17ebecd3e81425d9e36a5eb69fb3cd220964e26f3d03b8e6e77867b030bd0e04
MD5 82cbb04c241c4338f3123d8c0297aff1
SHA1 0038b96410a7b1b860c7bd4eb9b7a36f88e3d066
SHA512 12c5281beedbf0116617dd8ebcc63f6378f3e3fdc96221a18680fe7b76e60c6b62390be17d8eb26c673f4c49c74eb8feafe3ce714714aea7b259b64441d8b486
SSDEEP 49152:i68Qg55nhceWu7PNU3/OXozsr8zlLwJIh:gthLRc/qwFRKIh
TLSH
T179B55933B2F200A9C44DE1769F4A872196D27C758FE1E3DB851572061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 98786436dd3aeb616aaca247ceba345e6cecf4d8fe1f43949621b93ff30f3407
MD5 a3bb988468158163ab5df253e4abcc57
SHA1 b1d9cff632432406782626e6d76cafd5370d5474
SHA512 5bdb3e62e7f79faab90d982f959ba86cf466007534824e8e7e92ed4bbdb53276efb2bf56819a8a95d596b23d1be2885f3dc559ec37ed715e290de9d468fe4f43
SSDEEP 49152:t3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99x:8y5112gYy5azzVva69nLKnhZpwFRKIh
TLSH
T165167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ad0cdc66dd28393883123e8b8f75368a1086b6b6a5400f64569e3f4ee73cb3ba
MD5 01ff02d3bb4ebc21c83870c43008cb93
SHA1 7e81120c4f807cda436c713d5aad47bf75d2cc4c
SHA512 ac766c9c3bfd839866377abac7c46e04186ee565a8694d5279f4d46e27a117487a2f6e5790eb6e3888e492777f0f27fe1388ece5184ce3326be5a133c7bcbc49
SSDEEP 49152:XB+taZ3usBWOBr4tEG20bqx0z+n217aau1glgXozsr8zlLwJIh:5u6JmUxd2dAwFRKIh
TLSH
T196D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f8f05106c27ec5955b94d41d9ab998cd478a6bb09c6b5ff4379bd143c0be2051
MD5 8aedd7e25384e51aed38e5fe53db0214
SHA1 c9afd10f7a79e08a972d427f595494235982ede1
SHA512 b9d15a8a2448e80a751cfe26f58371c8e51aac43c326b4812a528fdfd8fa4c9aba4cd2c2768a1dee1eb91a822e63f16ef13c1c050135536e6bf6a57e160ef814
SSDEEP 49152:01hpsNoJpF1A6BU44CwH7R4xEXozsr8zlLwJIh:0mifPkRXwFRKIh
TLSH
T127B5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BAE46F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2e3f4b9c507bce0acfe50fd1a1c4dcbb1eab22ac7d4a85e06bd772895429c8ba
MD5 76792e3c08a98ef6b39458e9e5f77a92
SHA1 6e5d89ef4846971c686c69689f934affe13b1e36
SHA512 78d35d74b1b96f0a265bfcf62c72da7bfd50da52ea0ebeed9142fe02d3dfe3291fca6e7f7203ea2fb49e38e72fc440d741033f2bf04e767bd73ab61861cedc9c
SSDEEP 49152:hSuZQIY0Be2KNRVtOnks6NMHqhXozsr8zlLwJIh:v5dKvi61FwFRKIh
TLSH
T16CC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 236f963731da43faf503a4db770d6d83e43089e512614dc0650a7982a7e10968
MD5 cb1ffec58899e713f0f267dc05b9dd1a
SHA1 798d90cab30fd0712c43e279b0c80cf631d1b2cc
SHA512 9e4020ada50acdef3ec951577a77eeb95e9e5f87c79e242c575145459fc82c896a8886703c51a8de906d4b964d8ab89502b979974070cd5811251f0f00264b77
SSDEEP 49152:+htSn8EApI0figXgiDn0AP5wwXozsr8zlLwJIh:fX2iyphLwFRKIh
TLSH
T19795BE13F2D900E8D05ED175C7468632EA62BC160B35AAEF0A50B7561F7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 2584efb293c5107a78491527cca360d1c58893687ed45cddd68b06b05bf59544
MD5 2ea229d9f859a2eb05b353d33af2fa5a
SHA1 3fd107fff80a38dbbdc7100ec860e68f12558059
SHA512 20f204eebb5592525e2d05c7c71361d570b0c77c7d391ccecaa8ad86cfd61ef2b1deb79c6bb8b4b5d32430b0d7e85964cb77f884e0a73df480f2eb5cf41d09e4
SSDEEP 12288:96UksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:9H9Xozsr8zbhN6GwXOGIh4
TLSH
T13C6523B7F992A442FB575B3129812AC4DAA7BD9F99C20791333D1042DD7A83A7E30335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 e8f2f22354d2f4fd4d164bb024dc9116041d8c3fd7c56c981ed620fee498727b
MD5 62b57ad8b46a4fce155ee15da3b495e5
SHA1 0d7ba8cf3b61dccbdc8eb57c357986ab4bf649b6
SHA512 c82e13d52e911a21c73dc5093def9757bd7d8cbecb68016916aace7afb396318cd55be92cfc207efb8a43374c9ce9a0a149254ef560bbbb3ba11ffb9970fb659
SSDEEP 12288:5HUksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:5g9Xozsr8zbhN6GwXOGIh4
TLSH
T1576523B7F992A442EB575B3129811AC4CEA7BD9FA9820791333D1042DC7A83A7E21335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 7656151af540ad5392e0eb0ab9ea5e49c62e1ea0b0b71bf50f18437899f8da4d
MD5 cad64c73081f98e2bb21c6581606f01e
SHA1 b3533642502697f05c58d836cfc793e506ee3a24
SHA512 c9bcb3fb4edca256eef8f974716aca1fff8fe21e96e675cdac10fd9ed917bafdc1751f5aa271db93fd4854a80d4049c4a099b3ff02edd18d2e602b1e864be4d6
SSDEEP 12288:glUksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:gO9Xozsr8zbhN6GwXOGIh4
TLSH
T1346523B7F992A442EB575B31298116C4DEA7BD9FA9821791333D1042DC7A83A7E30335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 87188f49e3c08bb7c89a1be9191605f8625dc7f74e817a25eff4b339bdb27bde
MD5 53a4affaeb1721f2940ad8d7dbfd763d
SHA1 dbb98676501dd22426a53bda3ece722c6763cefa
SHA512 b4f13af63053b90f52c9a0ad4947847cbbbf3906d144ff6e63d7edfee6f970a3a09923ce84319b405d2993e05cefb3ad29b159caac4d3cd22444681c3fcb756b
SSDEEP 12288:LV4UksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:b9Xozsr8zbhN6GwXOGIh4
TLSH
T19B6523A7F7A550C2EE639B3198915680DAF3FCDE9B5207DB232800468D76679BE30731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 8cf7ef0f1d542fc193b233db83b14ac35b04735c3a486d06dd692e183cc816d9
MD5 66393e4ff1e3aadc5901bee1e3baf899
SHA1 6e02eb4fd5be9bdce315c5a12280db7a247618ed
SHA512 822475fbc6161ee8d3d51476564304b0e115e5d9d44d4bbaaf6b74541cc9420e5436754b75157ab963bed417ececdede06ead09b5aba7f986ad6994dfb516bd6
SSDEEP 12288:PAUksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:P99Xozsr8zbhN6GwXOGIh4
TLSH
T1BA6523B7F992A442EB575B3129811AC4DEA7BD9FA9C21791333D1042DC7A83A7E30335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 d727cd9e475f8d8005382b6bc8da8951413cc792899c6de5baeb50b09bdfef37
MD5 045903f8f01de580119ca20badf868fb
SHA1 fb733be730ba8f402734c3c0cb7dc215af5aba14
SHA512 041d55d122a038137688a5abc7f13f1b405cffdb4f371e41f155dbb348ccc0f757734910dc2fd63c84576e8f021567a242a79c9e7cbce44158b1fc61b437fc52
SSDEEP 12288:hjUksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:h89Xozsr8zbhN6GwXOGIh4
TLSH
T13A6523B7F992A442FB575B3129811AC4DAA7BD9FA9C20791333D1042DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 5f474ebac368d6fc0fa0e3d717c9699ee4697469ddb65711361610efb569604e
MD5 c4875caa7ab165f910e3afb85c17a2a1
SHA1 d08ec1ddac38158df0e5be9e1a4d74ee2567d1db
SHA512 5053d990e5a62340c32d2958b73e34b65f6e51307225b7823d20d9ba27fa7e768d5809cf073faae20a4532a1dd30ab141ace8027bddfb9d056e3b48216ced9b0
SSDEEP 12288:+PUksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:+I9Xozsr8zbhN6GwXOGIh4
TLSH
T1C86523B7F992A442FB575B3129816AC4CEA7BD9F99C20791333D1042DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 bf99e66746b9caa1027a69e6860b3b5da18a518aa54dc5c8fb339de140904493
MD5 205c00ea99cac556f2052f7235353840
SHA1 0ab807129b573e64e7b7209b793b763a32804288
SHA512 e73174f849614aead810376eb5e9c833b8d1339acb850e53d84827738996d1f1f7aa17843716f3ae7b48fe27b06c82c004ed68869a940e72e91952774045f0cb
SSDEEP 12288:8iZwbWzzFEoS2cPvynUksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:fZMWzFVSOA9Xozsr8zbhN6GwXOGIh4
TLSH
T14C8501A6B39018F4ED67823EC9518905D6B2BC5A0BA0C75F13B832675F333A11D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 3a169a26d51b8347b3c0f054e41c14904dd0ca95df7d67e3bd91a1c7475a0957
MD5 e23e66da36c5b3bd6481d201b89193e5
SHA1 33f3856a80789defad922df6330e449aa4f46da5
SHA512 ce92ab6226fa9f7d66ae3fac903d6049f9214b815cd5a95ac9844e2c0ba2119a0c15fb1b94e3bc5f91292a9c73ce1096bb0920de688df78f6073a02664f50f11
SSDEEP 12288:NeUksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:N79Xozsr8zbhN6GwXOGIh4
TLSH
T1A76523B7F992A442FB571B3129811AC4CEA7BD9FA9C21791333D1046DC7A83A7E24335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 6fb19f45e8bc50b1bfd38094b9e35d6024dc78faf01e6b9aabe07054ae7c4076
MD5 cd0b94d3149c67bcdbf9e55e6beca24e
SHA1 6df3f322af75aa4048051a8111d0c8843e82cd27
SHA512 741565e24fd3258032c37c68e689368749365316707fae8d9d7b2c384ae57539f94a9c804913a785a4f9ec7579bcb2459e6430f54e80dd73b72c2310638f407d
SSDEEP 12288:tSUksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:tf9Xozsr8zbhN6GwXOGIh4
TLSH
T1EF6523B7F992A442FB575B3129811AC4CEA7FD9FA9821791333D0042DD7A83A7E24335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 1605b0baf1af9a0d8c2cce352df830f85927853b85ada2cd9b44523855be8b00
MD5 ebcf20712cf9ec21664bca3cdcf2d0ce
SHA1 647509b02f899a90f310725a38a45c821f8db430
SHA512 999823e59716591d66cc448a5dcb5627fcf7bd88d91eec7a6f75a219b5b70fe3a10d1cdc748be764ee00ef30feac14f3742fc154484af3c133b4410eb6929518
SSDEEP 12288:IyPz5L8bUksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Jzy09Xozsr8zbhN6GwXOGIh4
TLSH
T14B751257B3A130F9D677833588921A41F7B2BC764B604BAF137402765E376A1AE3A730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 906bb5979d1a0c749b7c2ea12ad5bb5b3d66d49b367c54217abf8dd046b9504f
MD5 f1489523dead38950eef067738dbe209
SHA1 5c8adcd7a70fe76c90550e48cd7b7684ae239921
SHA512 a712af712c2756e52c5efd24057171fecc38bfc3c4f17b62714f8309ecd6e6ad8874f1c3058b589eaa0b09db608e9c51d857ceaad4a88523d467a105d0fbe4a8
SSDEEP 12288:2eUksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:279Xozsr8zbhN6GwXOGIh4
TLSH
T1D16523B7F992A442FB571B3129811AC4CEA7BD9FA9C21791333D1046DC7A83A7E24335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 2a68b42156754c3e3736245e6a20fd6a9c41f2aff81e542f66b126a08c0fe75e
MD5 d1f48c19ea2463063ad613f90970d555
SHA1 e39ba2a448add075370bd57c72ab0dd667fbee7b
SHA512 22a5001ac1a0007c4c2c2c751457dc79787fe8721d7fc58a3c462cea51ddce1f7021b20e2231552f5f52d2d898734fa0b912a821b0a9273f8d05f5d8c79651e6
SSDEEP 12288:oeUksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:o79Xozsr8zbhN6GwXOGIh4
TLSH
T1C96523B7F992A442FB571B3129811AC4CEA7BD9FA9C21791333D1046DC7A83A7E24335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 e8ab7d0b3ca446411ad55e5575f55661d1d705faf4cc678c089a102dc1ef4cc1
MD5 2facad1870402b4afd86fef4a7c569ce
SHA1 28356e44c3410376af796b2e22c686fa25e17ae6
SHA512 224f5152466d5156e76c16ed02ea6ab0086b7243f758f2047c534df517be50d752bef803831ae372f7b7a67d4ea47ca7246c9dabec6f07baca1af1babd8507b4
SSDEEP 12288:ayPz5L8bUksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Hzy09Xozsr8zbhN6GwXOGIh4
TLSH
T13F751257B3A130F9D677833588921A41F7B2BC764B604BAF137402765E376A1AE3A730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 3335c2695094b85091d11b8aef26db633c7e4ea8311e3e1a2f25f01883400d7e
MD5 1d259379539706dcf4fac848c7d69201
SHA1 99ad6c05249d9793d5c7cb5899201311a79df708
SHA512 04aaff6d7ec4ac43d22a477323c143818e31f031db897d6796182e68548bf15e4e7697ad7451d062ddc47527ee9b8ef52d0b1cc3521b32cf981266e326d675ff
SSDEEP 24576:nTHaLl3z0zD+9Xozsr8zbhN6GwXOGIh4:nT6LljzXozsr8zlLwJIh
TLSH
T13B8501A5B39018F4ED67823EC8518945D6B2BC5A0BA0C75F13B832675F333A12D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 545325f49297643220f382b044ca0b0967a9920130978954de2b8c71ddddc5bf
MD5 7aa9326a8618133657617a6d76b39280
SHA1 621279500b8ed9ab910a614f438e1a1c143b3231
SHA512 720c965c30c7cbdf261c4d2c3358d1f2ab5c1b99ab7f3eb2c6187932e165368b0954721eb8c862549363aa307bd5427c2aa02ec4818f8c6b49b86b3ccf854274
SSDEEP 24576:a3Ld9CHKy7GZ69Xozsr8zbhN6GwXOGIh4:8Ld9CHKya2Xozsr8zlLwJIh
TLSH
T10095CF91F3E410E4F1B79A358D725511DAB67C9A1B61CE8F03A8251A1F33AE19D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 0059fe4b5d4a75c7013b048e527f9092e1b7da74131ca7031e2d4566af2e5368
MD5 04496e047368b78fcba2f70fee8a083e
SHA1 6e0d22ed334bde462057965582776f49098a96f2
SHA512 26ad1b5e066e91a0b189125b2178714da78d388692840282685d39f2aaadace74b86ed61d156f5dedcb65562245d8b4c6f378d5934fc1e1fd7fed8d50181f3a8
SSDEEP 12288:oFUksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:ou9Xozsr8zbhN6GwXOGIh4
TLSH
T1BB6523B7F992A442EB575B3129811AC4DEA7BD9FA9C20791333D1042DD7A83A7E30335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 e615093b48960ea5b8d85e3a668e1c9062c6ef65942a5ca6d9f7b0fa2c99c8e6
MD5 85d00d0a8ad559d1a00f55eb3f582a21
SHA1 9eb106c62a44eb0cb01f72955300a769c12794f0
SHA512 3cf621e255aede954683b268f0a567606177a27a6c9c39bc927413c13152ef216f07491a231a2a6a2496665d63bdc4234119dd4d9cb12a3e179baabb2ab834a3
SSDEEP 12288:X7UksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:XU9Xozsr8zbhN6GwXOGIh4
TLSH
T1996523B7F9A1A442FB575B3229811AC4DEA7BD9F99820791333D1042DD7E83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 384f59d62109cc5ad0cf5a96306908082b1517b534b08f9567908bb1c11046b3
MD5 7c9260b98a7acd08eef3a159563b8e98
SHA1 e76cccedce39fb313614fd4e196b86902e8f948a
SHA512 d529c3537ce1e1283ee17717289d8357da084f5d31941ac1f402516615d5c5df4901c7940d44fe75cf06076695e3f6a6dea9c49a9117761a78e16bd90496784a
SSDEEP 12288:xcUksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:xp9Xozsr8zbhN6GwXOGIh4
TLSH
T1546523B7F992A442EB575B3129811AC4CEA7BD9FA9C20791333D1046DC7A83A7E34335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 1da692d4f5280671bf5bdc0f858294e890069b63d1f419b4ef7019edb78e8ab3
MD5 cba87e6618b224c8c76f3fe1e9792f1e
SHA1 8a3d7357b015d31ed00d3c406acec26196e7d5c9
SHA512 acc25e72063d81fe3a16a24fd72016c9e9f4593da9b902188acc3a907371ed4aead725f1676aeda034d2fd9032a148c86d430cb7823a9ca8ea54781e1c9861f6
SSDEEP 12288:qeUksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:q79Xozsr8zbhN6GwXOGIh4
TLSH
T1CD6523B7F992A442FB571B3229811AC4CEA7BD9FA9C21791333D1045DC7A83A7E24335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 ce45bdee7250f96b1b6f7c99a4689ad431d1cfe8bbe69614c3cc4b45caa26653
MD5 e582fcd4af09fef21fc134b26dbf14aa
SHA1 78a4b738952d09d47a41627e366d0737631beac8
SHA512 e75974b68981325853bf231f0f5e5548f6f995cf42fd760f5322e62a1734504a1fed9e2ec7a1d70ea0b11fd5e26d79a0628bead262847584659332867dc0c0fd
SSDEEP 24576:afwv7k9RX6wkyAIv9Xozsr8zbhN6GwXOGIh4:lMnYI1Xozsr8zlLwJIh
TLSH
T1C095D02AEBD844E1E1B7923C99B3460AF6B178591B31C3CF125A536D0E37ED46E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 7c8f9657c4c06acbe1b9b803d818b29e493c3077e3219445796a0377fb6408c3
MD5 60efe522b462d1cdc8306905488d57cc
SHA1 dda30d5cd087eeafb83c7e6f40eeffb6e527c2e4
SHA512 6f1b91d56fcb1d97d2158e4c375477b0b363f0cd0b86b661a89f5069721f50297ffa22edeaa663b9941db42618aeafdd5f40f1f58fcc5433d5caf33ef6e0cc5e
SSDEEP 49152:7YvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0QXozsr8zlLwJs:FySzPIwFRKIh
TLSH
T105066C97A16841D5C1B9C1B98B07CC1BFAB134490335ABEB03E556935F6BAF0AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 5c4117f7c7cb318e2d1e03387e8c915b5944041c8d94232e33719510399b61ca
MD5 4d37e52ec9883aada7c95b173946ce25
SHA1 d40503814490c01c77a36b37e8c7414e232f03df
SHA512 8dff94aa7c06b1cd7a812bb52b4b75602a27b9c1643bb445ad46019815e625da1d02509202f0f3b858329b366f5befd1426165224a67ef877e9214f7badb3143
SSDEEP 24576:+47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYQ9Xozsr8zbhN6GwXOGIh4:+47JUQj4irIhCnDHUPfF/gXozsr8zlLT
TLSH
T1D365AE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270437D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 f5b0b9cb222fc642c188e4559b1c90933a94ab826fe14ca3ceae1a6e4e4607e9
MD5 1bda0c0a4c4a59ece1655cd9697861fd
SHA1 9c68577c954dba3216bd9718d1ed0e31a8b970ce
SHA512 acd5c440350e4c55a40aadc25106a01374001f3183937702fd07f73f1d8ee77ed9472fd8b5e01877fe6824d5743250033af005b3e8cbac5b533dea803d5dca72
SSDEEP 12288:WQsfuUksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:4r9Xozsr8zbhN6GwXOGIh4
TLSH
T10A75F05AE29411D5D16F6235CB414A80F7737C6A87E193CB22E0F03E0F7A5A4AEE9713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 b5cb214cfe9cc448c40a624514b095f86fd395ff3a5031181d5343fd87e0d33d
MD5 2007d587730947d54d9b5e1c490fa429
SHA1 21249c83163cd567c2c0087ac9b279f65fef19ac
SHA512 66e3fa374297575c56b8a34ba955c96647b5a497d20ef3e1920fae0893a115d12740c2a3d31bd99c25bc2b5ab08e4ac52426e1b4f0d3c5d69802682cfe4729d6
SSDEEP 12288:AvJkXtvaU3fdnfToT2PNVDPal5ZhlHTF8Oo5YXpTYSFBjGfNnMz8:AvuXtiUPlfRTalBl6VadY+BjG1c8
TLSH
T138451741762BC75FC6AA50321E36D6CCA7707C45EE049F0372C9873FD476668BAB6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 91431828271fefa2896d3cb231aef6b74572d823eb7bc66f27e1acdee21616d8
MD5 5e342737f655578296b9bcd82c343a9a
SHA1 de28c60e3144935201983ff18c6f0df3bab81b94
SHA512 1508e0bf67f25ab220d3d27612f27b754cd77bbac93c062801fd33827d7b402be466ad926539baa76b6d90c5ed04bd24c88b8009dd1cab618be51e15973a5133
SSDEEP 12288:j26jTi5XQ78ljHmAw99WnLYnbmtoA1jVdvsR0/YHvGSfeyKT6361G8xbReSCcPvd:C6jo9G3va2mtoCdvsRhwG8iPodzv
TLSH
T18F552A41A6B7E35FC9FB50374331868DBB74AC06B7452B0173848A3D886667EB5F22D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Rdr322955.txt

Path C:\Users\Admin\AppData\Local\Temp\Rdr322955.txt
Size 13B
SHA256 b633a587c652d02386c4f16f8c6f6aab7352d97f16367c3c40576214372dd628
MD5 c83301425b2ad1d496473a5ff3d9ecca
SHA1 941efb7368e46b27b937d34b07fc4d41da01b002
SHA512 83bafe4c888008afdd1b72c028c7f50dee651ca9e7d8e1b332e0bf3aa1315884155a1458a304f6e5c5627e714bf5a855a8b8d7db3f4eb2bb2789fe2f8f6a1d83
MD5 SHA1 SHA512

Submit Download

ReportUpdaterPolicy2955.txt

Path C:\Users\Admin\AppData\Local\Temp\ReportUpdaterPolicy2955.txt
Size 4B
SHA256 69bf0bc46f51b33377c4f3d92caf876714f6bbbe99e7544487327920873f9820
MD5 455831477b82574f6bf871193f2f761d
SHA1 f44217a81173869e08671753c52553646ff5d95b
SHA512 cbc0ee58e447428bdcf72fc8b03c8cfb086edbb14205b918e75ebeff1d85ff1dd254e9dcb387afbd3fa766c803937c306e0a2a79870c0d87abcb7ab93661cf85
MD5 SHA1 SHA512

Submit Download

Tmp8449.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp8449.tmp
Size 5KB
SHA256 aaaced351a90b2029c44c6ebb68084a331f296a0ace8115d9889f549d596564b
MD5 42ff6aa7e64b25f09ffb2a89ce7f36ba
SHA1 0dbf44a94dbd6801b3afba7a6c602f39c7d44732
SHA512 47337d9919bc26dedfea1af060dd1fa2ef4a3dcf35c0a84ac7bfe0333b4885a368fc46fec5bc317fe257abdbcab9cdff67104382b60e9a1aa5f755aba604adde
SSDEEP 96:6jX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yKSeTEnXtGbE:0ULc8pq8RuwdmL4pUQrNyKQnCE
TLSH
T102C13CA388946C05AC27FC00B4C89933EDB676A61EC1D0D3625CC1A58B913873EDE5FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp9D03.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp9D03.tmp
Size 5KB
SHA256 27ead591d4c7f8fadd0d9e5d32eb6c9bf8830f83fddf83ddd47e6b3b413f5b75
MD5 5a68f4aec3689d0dc750adcae8e60520
SHA1 ebd8482e30140da9e44bebde6e4da997a7391e22
SHA512 311cfca7e98c8db69d2d599c5845d26a4686d03d1ab1d79237952c008269928ce8434a877e3fe411e967995536e2171844df0db14add053037de278571269a04
SSDEEP 96:zX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4ycOr0BO:zULc8pq8RuwdmL4pUQrNycOrkO
TLSH
T127C12AA38DD06C05AC5BFD11B4D89A33ADB276952D81C1C3325CC2658F913973AEE2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpA5AF.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpA5AF.tmp
Size 5KB
SHA256 e6bcbcb70401d63ff0746fcbcc63230269058736f7644151393edfdcec8b8765
MD5 1b7ade3253fc67477dea69ef2147603d
SHA1 b71e8e749a3461c9b37ff2c3d099b1911d9cc6a0
SHA512 0edd5eb1635b1599e50b368cb254c94bf1588acf1d063e89f45fcfd6fa625e33d2c7764d9d00afd53dec2dfb342e9cfe199d256edcff8430ae183d357d4382da
SSDEEP 96:7NLX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yGtDwwBq:RULc8pq8RuwdmL4pUQrNyGewBq
TLSH
T16CC12AB388D06C41AD5BBD11B4C89933ADB272992DC1D0D33258C6A58B913873BDE2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpE6B2.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpE6B2.tmp
Size 5KB
SHA256 a86ac1b119a6653e0c3fc24c2c40e44a7bfdc435fd81c4442af9d5526ef64e85
MD5 5bc2d1f7a5fd950dd51547ead6afdabd
SHA1 90f4e48ac87f4eb9dd10f1a80d46a7063f06a7d2
SHA512 45f18bf24c7f1102c17dd30aa205498f27336259ac3869c1d6129609a40385e68d9a2f353e3b13f18f40e7d1d32c4fb31d10f7b2fa204e24e4411183bb749f55
SSDEEP 96:7sX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yQRlOelNMQtU:gULc8pq8RuwdmL4pUQrNyYlOefM/
TLSH
T13DC12AA388D46C05AD17BC04B4C49A23FEB2B2855EC1D1D36258C1A58B913973ADE6ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 4eb9bd7ef51d3678df74dcf4dc73b0c709628e9aadc54c2011e5a403c2b1d0ce
MD5 049973214fbeb63a3b222078920eef35
SHA1 0daa870624fa4978a3298792972090c203141846
SHA512 cddd3b4ea671e706492c02228b429a52ad8855de5e727db77e25aafb413612e69651eeace301b5a62d2349aff599f046e2514708abcc7f995a87200589c18ee0
SSDEEP 12288:ud72UksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:aT9Xozsr8zbhN6GwXOGIh4
TLSH
T1A76523B7E795A802FE771B30288556549A5BFD9E4F8107C332281186DC7A8E6BE31336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f76513859d641996020b6bc93a671949e33d55260f7e870822e34ef87ff09a23
MD5 b5689dcdbe3839c6391d6bbd737ad778
SHA1 64f0fc881ee530913ae7da41effba232ba1e9a62
SHA512 31bb57502af21ad2fd78ac780438f3cfb0f634b029fd82db523172189fef021108c1f5046cbd3545e9d1729773204e0526071c0590ea2eb4392314c9338022bd
SSDEEP 24576:fgb6bmBIi49WNNFpg1rSvFv7bYB9Xozsr8zbhN6GwXOGIh4:fgb4mBIBhGFqXozsr8zlLwJIh
TLSH
T1A865AE1E22EC02F5E1FAD2B89DA64417D6B378160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 b55652af34df309d076577b08b4254f77d64972162f6d384756dd1244f8ac91f
MD5 06ce55d3ce5ca701f5376e8013d7eebc
SHA1 b1224716a2b10323bd4381393474fafb79bbc4ef
SHA512 e2239cad3cdf472df7d67840dadeb547a4401a3c4d852db225d388e7d3daee33a97dd9f3335ab535108d53982c0d8c181ff6e435b7ca9c873fb27c6aa15560f1
SSDEEP 24576:rG88u8FpJqH1czria7/mA9Xozsr8zbhN6GwXOGIh4:q7ZFPqV7a7/rXozsr8zlLwJIh
TLSH
T130A5F166B7E101F1D477D13889824663F6B2B8250364EFDF07AC8A511F23AE55B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 293fbe1a60929ded0d3c18316a6072098c969386b02446fdb83f439a0e1a4378
MD5 06c3df56e422a905ee22283a843a0965
SHA1 4c78f773e61695c5ba71403c2c43ff09d9d3caf6
SHA512 e1f0bacce568481c52c1b998d052ef5ffc8f64968acf0e39ee69027b5ddfe1c36444ce3d1cafbb7c50fe6c9bed26f4d65f0215fc868702185a1b3850559eb58e
SSDEEP 12288:wHvUrBFrEjwaQTUksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:wPUr+NQM9Xozsr8zbhN6GwXOGIh4
TLSH
T15C85F26F72E918E5E677A13D89824709E772B866071293CF02A0417E4E77DE8BD3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 8eebfc7345a059a431e23ff5a0e0318e74aef1488a50059ca3c3bda9abdd296f
MD5 2d8ae2f1f95b3fc6848b0d8a05e52c53
SHA1 c8c2bd0ff4beb518c5cc14c7295f0ece51a28a76
SHA512 67d05351451b0278aaacd833193cab1e470977ccf4195c51850c09d6acf52432bdcad2ffef9ae453aed475cfdc6941ecd18aa08a7280bd4f03a2b82f7671ca5c
SSDEEP 49152:jBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjmXozsr8zlLwJIh:MG05lO43bRwFRKIh
TLSH
T1E4D5CF6E62EC11F9D1BBC17CD9C64A0BEBB23815032556CF02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7dfc3235513b7a5c0f6d1d6400e2fe4e89544c6c8cfa410b724701ee1cb7b115
MD5 7af49860aad0046c3f0afb5de720c16e
SHA1 5482da22152d28f172a3f1127c6d72b1a72b1de2
SHA512 8b5eac9171b9a1e3b37890faefd82c91db474b0513e8dfe637eb6125d9a69f35624a4c96d642ade0771b9eb3e9b184e61c5793731a9621b0bcd70b7a5aa80a39
SSDEEP 24576:sfa5POZ3dpqWVM50JicR2hG0lasx2+47eidnC9Xozsr8zbhN6GwXOGIh4:0a5POZ39Jt2pasx2+mOXozsr8zlLwJIh
TLSH
T1EF65BF5EA6FC00D5D57AD17DC583461AE5B1342653329BCB022182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d25d06edbd53c8f07c7cea10519518204fa947e07eb29be6acf228f45022ca56
MD5 78f4eb940e3726d5ec33a6a794b1fb41
SHA1 05a7a0d9d6847957490eb378142703702c1a6fea
SHA512 423641b13d0b9a32b5332594af4a51d2166a94d16f06fed66a128504c6394de530b9862d5ed70d4ecf255d0fd2e972fbd529a00e5e1ab0e0685f5b4f3b62a10e
SSDEEP 24576:yNcwHdjbyQ4nLC18lb/EOjowL7Fk49Xozsr8zbhN6GwXOGIh4:yNc/zEOVHFLXozsr8zlLwJIh
TLSH
T15F858C6623E901E4F5BBE1BE89779546FA717865133086CF0291811B1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 472B
SHA256 9d7407b8bcd4af6820eae7da00db7598246d0f58dc502ef3c89aacbd9cc8a104
MD5 150650f8b4ce06bf6720a55c29275c38
SHA1 c69a908cd7138d119f38c8db07031364b1d21388
SHA512 fcfb7f30078c6e1c43cf272b96b5fbd599fb6ea694cbb79a7a3e40de0eea9e031a4b67d1c2f348d3ab19760b48b67758fd7b4ddd921aab9f3e8d3a064c662bd4
TLSH
T198F0651725F54655E0F75F11DBF990B35B367C456D18846CA0C8031F0CD1A51D872BB3
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 596B
SHA256 550a13ba1f49e521874c12f8908b48d130519016d3abd734b9ba3e3695f2a8bd
MD5 dc1ecc554b3f04dc9600236cdecc8a5b
SHA1 5ae617e99bdded544273928e3e02147405e6a032
SHA512 5c18ad0696a910c5806e952965b6ea6a7943443714eab387cfe0437c5546b6b43c87d70495e5a21ecd284faaf545ab0b6c7fbfc5f89b27ab4779e3cef124f11b
TLSH
T168F03A5726F54668E0F35F15EEF994B31B367C026E19D4AC90C8031E0CE1A61E9727B3
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 726B
SHA256 c89ff4970db3664d4435522769ed127af57f09ba648689de94c00a60572db3c9
MD5 66912ae2193d013c3bf5b8b031c7a36c
SHA1 e5288840baebf03420e92c9deb1a60121f24467d
SHA512 c519bdc0aaf38be5206f763c6ec85e3b1d245ef900c36f2fdfc8865783430e62e09c53fb344e4559e939e4ac40a2fe4e81b79e396264be2dedf9a237cdfb1462
TLSH
T12B01D6962AE91235F0F35F45DFF994731A327C131E18C89C50C8410E49E1EA1E871B7B
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 910B
SHA256 29aad3c953b84d978bd9c489ec6365d819b090264d3f63d55b4dce568fffdade
MD5 a450581a2a8b8beb8dd3de0a9d645c63
SHA1 1bba5a58b4ba51023c189f482055bd4408b20709
SHA512 603c344f420bfcd2931ec5dce59a6bea8e078d8056ebb86f61a6a79c0e4f3b3410000d67e20fa5dcd840d2b9cfc304028d69682b1e118d1c9d7ad9ce27d65a4d
TLSH
T14211C4862AE91275F0B35F45EFB994721E363C532E18C89C40C8510E0DE1EA1E972B7B
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Windows\Temp\ArmUI.ini
Size 234KB
SHA256 790b06745f32e0f56a7af24c871ffce225ba05ebf0d8f8a71a00c727c97dcf09
MD5 cd12a965da4fb66e7f8a07e3f421196c
SHA1 f6377f231362acbd1063aff829ced283a2660b89
SHA512 3fa242c3f573c706e0f36b477ce03f47d9ba0712ef72b94eae4f426dfe21ebbaf1dbebb0981335970b5186d416b4d25e175773796486f39e17de1df0a68a9b0d
SSDEEP 3072:03IJ8zcVOWmxltum8PMkufNWwhEIrKNCpNugYWKOlCIr0YxbFKRWSp4Vf37FbAjO:BxJvW
TLSH
T124342A5667FD1209F6F37F41EEB852944B7B7DA2BE3AC14D1680014E08B5A90DA72B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b93b8c6279c0ed0db2016ab4b540ee610f8b82c3754564f98b910d7ff1e3f683
MD5 1cde199fb0b7a478e67344a3e229f5fa
SHA1 4d41ad29233ba12ddf870dd87b39bdf297db559c
SHA512 a96d0669d129bc748367ee81f8cd7b0453d79de13b199d880d235606a7ffacc9c5d701b408c074395b45a7b185eec82c64874d7c0123904077e3d533ce594ba3
SSDEEP 24576:xtkNvNnaFeYhJNtmZBmm9Xozsr8zbhN6GwXOGIh4:xtMwBtOm0Xozsr8zlLwJIh
TLSH
T1AF55AF6EBAB845E4D1FEC6B48D238512EA727861073253CB5390C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 c4bc38a8664490facb02ea0dc9a590bd4b39393d7c42883fabc2fa534fd079f2
MD5 c19b7061649f41317e3dccc773638572
SHA1 ce44e8a999bc6441f5c62a0543fce31a5564d1bd
SHA512 e4998ea5a726205a2d3303fffee34f2ac1e7b419cf521616aca6873ae31397d3ef7c6742d54905f846467629cf0fc97c3c666e444a37b10db3651eed06226b63
SSDEEP 24576:BD3FHshBIYQgAn9Xozsr8zbhN6GwXOGIh4:BDVHeBIAA9Xozsr8zlLwJIh
TLSH
T17895E17EE69C04E4E57BC27CDA534A06E77238AD032256CB029481B65F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/416-694-0x0000000000400000-0x000000000057F000-memory.dmp

Download

memory/416-594-0x0000000000400000-0x000000000057F000-memory.dmp

Download

memory/416-547-0x0000000000400000-0x000000000057F000-memory.dmp

Download

memory/1640-110-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1640-111-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1640-224-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1640-117-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1768-382-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1768-190-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1768-396-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1768-397-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1768-184-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1768-183-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2076-593-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2076-592-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2076-374-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2076-177-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2076-170-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2076-171-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2356-122-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/2356-128-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/2356-134-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/2356-132-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/2356-121-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/2392-362-0x0000000000400000-0x000000000057A000-memory.dmp

Download

memory/2392-160-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/2392-159-0x0000000000400000-0x000000000057A000-memory.dmp

Download

memory/2392-165-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/2564-198-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2564-204-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2564-196-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/2564-398-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3252-208-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3252-217-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3252-209-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3252-219-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3252-215-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3896-226-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3896-232-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3896-399-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3896-225-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4244-647-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/4244-1-0x0000000002510000-0x0000000002577000-memory.dmp

Download

memory/4244-7-0x0000000002510000-0x0000000002577000-memory.dmp

Download

memory/4244-0-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/4244-169-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/4244-6-0x0000000002510000-0x0000000002577000-memory.dmp

Download

memory/4712-182-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4712-97-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/4712-103-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4712-105-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/4712-104-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/4844-147-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4844-333-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4844-149-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4844-155-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/6024-136-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/6024-302-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/6024-143-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/6024-137-0x00000000008B0000-0x0000000000910000-memory.dmp

Download