e1595d699cff1e1b6ac1f95e6bf47dd69dfdb39d51aa733956df5b56410d880a

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 13:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
Size 2.2MB
Sample260810-qvphpsak7x
SHA256 e1595d699cff1e1b6ac1f95e6bf47dd69dfdb39d51aa733956df5b56410d880a
MD5 a9c7ea8a371263d9f2aaaa3d7b0ba592
SHA1 354e7f0060f4c93afd42861e7d4b2e8f71f02fd5
SHA512 5b0c84af5079dafabd79086ded284739472bd640b5b35968045d5dda87ba0f9427a4551fe964a21b2bab3f072375e4b388fbc086e967f66114b87dba5bd4998e
SSDEEP 49152:M2stiiXqvQ9HXXxk+kpBASZAvYAWXzc5ZK9BdSdc++X+:vGX4Q9HHxk+kpBkv4BdS+V+
TLSH
T193B5BF11B642C073E59316B1726D6BFA5AAC7D3817B154DBB2C03E3E58301D3793AE2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5024	elevation_service.exe
2884	elevation_service.exe
2684	maintenanceservice.exe
4504	OSE.EXE
4092	PerceptionSimulationService.exe
5688	perfhost.exe
2664	ReFsDedupSvc.exe
5072	SensorDataService.exe
4036	ssh-agent.exe
468	AgentService.exe
5464	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\NeatDM = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe -autostart"	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a0fe2bdfe05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaw.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaws.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ab6aea1ecd28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000caba6f1ecd28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007413291fcd28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001a5b181fcd28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ca469b1ecd28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4060	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
4060	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
4060	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
4060	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
4060	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
4060	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
4060	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
4060	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
4060	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
4060	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
4060	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
4060	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
4060	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
4060	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
4060	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
4060	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
4060	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
4060	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
4060	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
4060	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
4060	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
4060	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
4060	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
4060	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
4060	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
4060	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
4060	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
4060	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
5024	elevation_service.exe
5024	elevation_service.exe
5024	elevation_service.exe
5024	elevation_service.exe
5024	elevation_service.exe
5024	elevation_service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4060	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4060	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
Token: SeBackupPrivilege	2664	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2664	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2664	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2664	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2664	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2664	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2664	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2664	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2664	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2664	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	468	AgentService.exe
Token: 33	5464	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5464	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5464	SearchIndexer.exe
Token: SeDebugPrivilege	4060	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
Token: SeDebugPrivilege	4060	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
Token: SeDebugPrivilege	4060	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
Token: SeDebugPrivilege	4060	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
Token: SeDebugPrivilege	5024	elevation_service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4060	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4060	2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5464 wrote to memory of 5960	5464	SearchIndexer.exe	101
PID 5464 wrote to memory of 2328	5464	SearchIndexer.exe	102
PID 5464 wrote to memory of 5468	5464	SearchIndexer.exe	103
PID 5464 wrote to memory of 4904	5464	SearchIndexer.exe	104
PID 5464 wrote to memory of 4728	5464	SearchIndexer.exe	106
PID 5464 wrote to memory of 3420	5464	SearchIndexer.exe	107
PID 5464 wrote to memory of 6064	5464	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_a9c7ea8a371263d9f2aaaa3d7b0ba592_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4060

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5024

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2884

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2684

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4504

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4092

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5688

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2664

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5072

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4036

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:468

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5464
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5960
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2328
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2828 2844 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5468
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2928 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4904
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4728
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2828 2844 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3420
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2928 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:6064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5d06cf9b3f1ceaa6c73656c38997a8a6af276151063a8aeab753bdff62508e3e
MD5 4fd0caf0c3ae6e829766310bdf0cb8b9
SHA1 de4d9e48060eaaf5f6ee10ef224a21a5ef52da75
SHA512 57cd61b064594f098ee473df316bcf56569d0a290980441ef08613d9155d5c91aa002423b1c638e33b82ac6a285ec91a7fa729d5fbed6f7fcd7846a564113294
SSDEEP 49152:tb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnp9BdSdc++X+:z3q6tjBCBdS+V+
TLSH
T1C5D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 3acdf05cbbcb4173ccdff42ffee65b3d633563ee8c75902da768cedc95e8ab6f
MD5 9a7a0d272816fb60bb014ecb7e6c247b
SHA1 630d5ecf48470c676891132b22729cb080dd1e8f
SHA512 fd3c9d7777458b460e76e249905417b9be0a2ff1a0021d3fce9cb85150b4a5e24437c849d2fe65e573c74a1022385daa83b63d19af8595d94e4850ec1181aae9
SSDEEP 24576:MXYfDtczAyfbZBL35PGdu7scsp73X+X+d:rtc39BdSdc++X+
TLSH
T1F485012867E409F9ED6B817CCDA18502EA73B8414760F7DB03A496251F337D85E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 2bddb601e087fbb7ce90d220b58317c02bddc7be3cb16042541d690281743850
MD5 02c641c3ec1f54fc5b94f4cf5df416c2
SHA1 709290e2997efa755cd23f2bdf48bafd3a050d2b
SHA512 33874401175a73dae953f134003f382b6877d9aa8a93f06d6f227ed399bd510143b38de3dc2b5cba639a52ef06ae185d0ff26dc3ae798b83c2165e52a16bf2c1
SSDEEP 24576:V0Le5ji0hmxnrMBfbZBL35PGdu7scsp73X+X+4:VPji0Ax09BdSdc++X+
TLSH
T134A59D15F6748371D073C0B9C5D2A68AE97230865B308ACB4286D77C3F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 233307dfbb5e5498d8ce280d948e7d879836e015876c2232efdbfd858847c50f
MD5 6715fd80951daf9fb3333251c5f74c7b
SHA1 2a2364d04f7ed598bbcb720d555e8be3d2a0a4d0
SHA512 37f48bd7978f2f13c5dc1d20b5924deb2b332499a64d4321454757f4bc8f10f993fbc7300079ba00a3311e10b324b40d8c7a1b4c359fe6b9a1f02635c83e22d2
SSDEEP 24576:Aa7/ezSC6vUyDZaqgrvWx6q8wyunfbZBL35PGdu7scsp73X+X+/:3/ezSC6vURPvMHjyA9BdSdc++X+
TLSH
T1E2755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ae8905f57c0952725e9044466578d2a26484248df8630f0fb68e2b024f84c3c5
MD5 1f7ba358c530577dc4cb3d07fea49e29
SHA1 9d0516d482461960892733238f1fb34d260886fa
SHA512 5c2dd9c61f8361277d441bf607cfa25442c6994adbdd72e11601f2820b9dec390f5d6f8e339897c6a2f8ca1c811ab0935623cc7c95d502d319850bf38ff7addb
SSDEEP 24576:FVbqPb88hv/lV72fbZBL35PGdu7scsp73X+X+S:FVO88hXlV69BdSdc++X+
TLSH
T1AA559E65F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 8acda1397514192f61db9cc37436478b0e036a57ea215233a4eceb8bd9a67ec2
MD5 eea50233ab77a7c411ba942e7774adab
SHA1 45dd30892472361368dcc93a471e261083e2a3cc
SHA512 83c9fcbd0f6811401855be6ebdd1d0a08160ebb4ad4058b60175c82e493e89b8fed4c69a3e0108c4e63a1524cb23506e7c6ecef8b9e1517359a671bcd9e44a8a
SSDEEP 12288:eGlNdoCbZBL5l5PGdqtAeNiAxBGlHEqfxVNF1BjD+AA+SQ:eGlfbZBL35PGdu7scsp73X+X+9
TLSH
T1F775230C8F6917C0DF3F31B47668A2475A798F859541B8BBCB62730526B4BE8C5C29D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 a5cf5ecbf21f83262d4fe1dd2bc9bc9d458ef4a30cfa3b746b0ff3494484b83d
MD5 6633d0bc642cb9ca396e9095be9dc8ec
SHA1 dfa9974a204ec3786603b88c2d36e35b90f6335f
SHA512 fe4438d9823050ff2f856317bdb00e7ec3bcc75e555200db0cd466b27186d3d9c707e1f446eaeaf6230ad2d9038386c124ac6a9ca9cf6551e9a33951fb02b39c
SSDEEP 12288:TeBNUbTVO86UONdoCbZBL5l5PGdqtAeNiAxBGlHEqfxVNF1BjD+AA+Sm:TJIUOfbZBL35PGdu7scsp73X+X+z
TLSH
T1E085CF3BEE28FCD2C67E5DB85B918200D77278704B52A3CBD165830E9E235E45E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2bd5acdf1675e3eb1770b62c86ba17fdf34d3f98b2b337c07592207b4561f3b1
MD5 4ade31ee31a8f24e949a7d97ae973f62
SHA1 5e364b231fbe1fa709a2b96fd461f4b34d803e43
SHA512 4d721a719f9740c584616330fec4fb91c22446cac4a99620167325fd340d95717f85c7bdb7a50772beba0c71a03475fd91e43db450b6c7c1126053b2384a190a
SSDEEP 49152:PQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THB:PQvGAdlCEL8c/pRNw5CtBdS+V+
TLSH
T1CD266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 0fc3cf17c854f08fb7d31690ed5285310f9141f145f0f939984acc9fe3c20b5e
MD5 99698b34894fcb18b097475105212594
SHA1 55d33ee4e6f1b48e72b27f7b59d6097813dfa89e
SHA512 101bf7b83ee4e3e5008d15d32a496882fae4a0c38882125d3089df8206862f3d1d101ac0bd8e6296da5860ea908eec0b915f81739fa4f42bea6e5fafca02eed8
SSDEEP 12288:PAwSfxL/2Dc3xDLLmt0LDQewsAjkNdoCbZBL5l5PGdqtAeNiAxBGlHEqfxVNF1BG:YwewsAjkfbZBL35PGdu7scsp73X+X+S
TLSH
T18B95E030FE74E032C77F0DB61B36C706187DAA604B5129C3E3A89A9D59702D267B6E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 06cdb08d7662ce3c246aefa31c9e10457035bf3788956df53a46980a7fd543cc
MD5 c5b2e5c0f923e9825f738ccb813fde82
SHA1 900b40c5f24d0298245796430280adbd2e59c5f9
SHA512 066ff49fd12a6b98d2fae3d0d3d025cfbe413743c786d6efe23aabd109b78b14644da5355c656579a25aad3837c2529bdac15701f36e453035f8d45fbf9dad99
SSDEEP 196608:hUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJH4:hUEtQevvqc2W1cpV29I324
TLSH
T137474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 81eb2299f65ad93c3c4c79e79738a1f1fa94026d86dcf1dbc15892204a6d656c
MD5 037b6cdabb60e4d72f02e83a2ebdb54a
SHA1 725662b073ffe66df55933338391b7c87f0d8a34
SHA512 c46fc7e572c7589081c603160a7196d2f180004db07ef9097325215718b5bda07d29ba20659a87dcebe80afca37e9845a78e745a36e8e2a84c3ac6d32f99838d
SSDEEP 49152:ICbRquA/m2yL5zQfFiV+XenmE3/zE9BdSdc++X+:hoqtVjnmZBdS+V+
TLSH
T1CFD58D0976B882E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1921b06891f24b8f414747e53174f0d9206cfa1d8a9363c46474f7f871066344
MD5 d220f9c7d241b06273f850ec10325039
SHA1 550d879c922a45ba7356fd2f6f1042fc158091c8
SHA512 0769256f98d6f3a1457ccc41d76c1bd1d46065452c3aaeb68e5b9590905d6ba2703751ab70c4947840d4eb600406366786711cc8cbec83bc32dc4e463262e05e
SSDEEP 24576:/AhGLmIFoiwtA5l7S53TfbZBL35PGdu7scsp73X+X+s:/AM1Foiq5j9BdSdc++X+
TLSH
T1EE35AE80EBF955D4F5B3AAB899B68171EA76BCA65E31D20F1150D20F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 b0c478ce157a6344682129b1fda1124a2209d6eedcc40050f0337b51a4b6d973
MD5 65f48bf362d5e3095ce8a184f485c876
SHA1 782a01da44c4adc5bc07ebbc479afc4c04de5cef
SHA512 dbfdba85d022d5f25613e7c1577968f0fb1696094695260b1635c4eb711947c715e2872d3ec80463a70257dd427d8ec51b5147cf2f20fdb4e55935b71942356c
SSDEEP 12288:bmw5HEjsChNOBFgl0WDm+CHNdoCbZBL5l5PGdqtAeNiAxBGlHEqfxVNF1BjD+AAr:6wuXOWgfbZBL35PGdu7scsp73X+X+G
TLSH
T1BB85F10977A40CE9EA6751388657C136F7F2BC022A21DB1F4760C35B6F37361AD2AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 a0c0c2ec620b554f26068e619bd21b5777ba32cbdf60f916722f3d7115ba5857
MD5 a3a440feeb3ff2996905ac36fb44e7ef
SHA1 1beff508b2c2a36419c29d97642208cb582a982c
SHA512 d2eb6a0e837e3a3fab4651e05c919bd6bd51c21042ebb0f95503c55ad6f546afaf562e6f5ceaaf2b591ae86b67aa6a4e8c6f8d0648c279357200ef15fa7a8d46
SSDEEP 12288:sbZ1IyUNdoCbZBL5l5PGdqtAeNiAxBGlHEqfxVNF1BjD+AA+Sc:0ZuZfbZBL35PGdu7scsp73X+X+V
TLSH
T1E975120827E822F5D67B2278D9E49206E7B2B892633253CF072153592F71FD58E76723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e5959824df83e1ff11c6fd9f79ebfe9cac6468ed849c514c677738baa3a5c59f
MD5 2563c6ecad0279a715d268fa4d84317b
SHA1 50145109d70331ab7f6c6686e06f31927cd0273b
SHA512 7f803e19106d42c5c58ffa2d55027083233c2fba1e5a8f28a5ad30bb97dddb16602612c697b0a560143b5f15a0cc2ab3d5a28c0ca96e10399d8fac8ecd2a9a86
SSDEEP 49152:8j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23Ut:TQRQyi36YOcPuLvw2gAf+PN32BdS+V+
TLSH
T11B667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 17d9788ab55418f6fe97c6e3d490846cab5cef7335ac0502b25f9b968b2acd90
MD5 ec84cff861bb54d24e75b8dd0ecbc1ce
SHA1 2129295e704bfa1d2f295d02a77d9c017d72b5f9
SHA512 1c98d1106493e920c6a1026a47c918dccf389c8a8780059e062da7a8d00a782d8708c2794376046dfe9b35ef1bcfc49ae35636933baafe00d092141282af8eeb
SSDEEP 49152:Xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23Ut:mQRQyi36YOcPuLvw2gAf+PN32BdS+V+
TLSH
T13A667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7299af02a738bc46d29165a1ada31a335ef1f9dcf96637e316e9d87b54b302d0
MD5 f4b65e8bcfea84f06403f1a67a61c94c
SHA1 ac64cf61bf7f263b6052258844dbed007ff6f48f
SHA512 d0539831e005a0f6fd9d0137b5ff72634b0ddbfd25f5ebab3180b42f4d9b1f8da9faefa53ad9c11d26ceee857a51c133e5ab61a459afb40122d36d5f9152cdf5
SSDEEP 24576:1wvLof6SRQ+rn/fDboqxN1nnh6C7DaHGTNHu7PNU3/5W/ohL0pfbZBL35PGdu7sQ:x68Qg55nhxeWu7PNU3/09BdSdc++X+
TLSH
T177B55933B2F60099C44DE1769F4A872196E27C758FE1E3DB851172061BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ab1cfa62f19edc010b6bb0221c94726db6e6f723d8910e8aef92cbd40a9d700a
MD5 9a178c63d639c3603e05b6b0abbdaf35
SHA1 c79de8592e91bf7d90149aaa42f2467b012a4394
SHA512 3df65e6693d0bbea8e6b6c73661a73357d690cc69cbed4aef1a0a536f4bc884750369d975c7c51fc82651190abd0d6f100ccc061490dfd1928c6a6bed670fd8c
SSDEEP 49152:/3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99r:yy5112gYy5azzVvD69nLKnhZ7BdS+V+
TLSH
T13A167B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 58ecd37a3b277bdb619f62a0f987bd4a801036940b270cbb8d0ffdd9a9cb325e
MD5 2592b183b9e04bab9f2a1b7848c1af7d
SHA1 fa88b5ada2946182396d223d8c4afd272c956e0c
SHA512 bf8f7a59c3ff34da7ab07b6f1a00c8265b2f5c5acd0fc00714fdc7ccbc50df5a99897a93473d0ef665f1fbe2790de5540982d04d0936de30f097746e56734c3e
SSDEEP 49152:oB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glC9BdSdc++X+:iu6JmQxd2duBdS+V+
TLSH
T147D59D13F1DA01E8D06ED078974A9233EA62BC490B35B6EF0A9073552E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f976513ef775f3d04090351559a7a63771d70b56d442bb415a9215e8d4edbf17
MD5 c066f7cf3db8971d1ff387e60a221759
SHA1 ee5888ac43e3924a77268cfa33ba5385e814c94c
SHA512 ef342f9c5f3ad7c665ad0dba23007b8126bcd608461a78ba48393a3af9971e9956e540d2c0e94a028402983f8b923b75d7782eb361e1f85ca81e25ebb28410be
SSDEEP 49152:w1hpsNoJpF1A6yU44CwH7R4xu9BdSdc++X+:wmifPVRZBdS+V+
TLSH
T147B5BE13F29901E8D06ED17887569232EA62BC460B30B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 27a6fa75a7945543ead7c243900a1156c245d01cff0aa7ba50e7b3362fe128b8
MD5 2ed807ac98b40f61ef54282ad7a2844e
SHA1 780313bcacf8e348d23cde8abdfbf66fd7e6230e
SHA512 3d12b0081a9308321a4067f88b03924d4fab021a6d5843117f07a326b9537ad2ab2590637eb44f1c5baefe940135291505ab884e71eea3209a2f87baee454a3a
SSDEEP 49152:oSuZQIY0Be2KIRVtOnks6NMHqZ9BdSdc++X+:y5dKOi61/BdS+V+
TLSH
T17DC5BF03F2E941E8E0BEE67487659232EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 25c26474091f26a2c861fd15966250f664bea4755b5d6bce80ae71488820efa6
MD5 4323dbb351d326bff936f119aa5bcf85
SHA1 d5954b87fb040f56e5137b6f55f0cbe4cd5c5df5
SHA512 43f7d18e19b8f83df8891ba9fe14809abb0cb4f6c50b511ca5149c6d5d28fdd5d09e967a6fd945d97287c9c1ced1ec01e96264a0a3892eb2afda3fdece9a5403
SSDEEP 49152:UhtSn8EApI0figGgiDn0AP5wy9BdSdc++X+:1X2i/ph1BdS+V+
TLSH
T1DE95BE13F2D901E8D06ED178C7468632E962BC060B35A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 a5a74701607f808927800a462af66268b4f4883a55d0189cfbc5d8c32f5e754b
MD5 57a5965b244503f7992d3788e33994e6
SHA1 d62a812eecb72bfdd21fcffba8573a0b42c730f8
SHA512 25544012c799fc338e3832c77d437b7e1f2594f20631ca87a7795a60a27c230280ce63e33aca1070fefc996f856d9553311cd3fcb38410c759467512436ea2e4
SSDEEP 12288:69NdoCbZBL5l5PGdqtAeNiAxBGlHEqfxVNF1BjD+AA+SI:69fbZBL35PGdu7scsp73X+X+B
TLSH
T15775230C9E6A17C5DF3E31F466589246997D8F86E64270BB8B16730127B4FE8C5C28D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 baea491821bf76bceea84e01c438e9ab4a6d5e85a3a6da2cc8acc0f9864737eb
MD5 b8791a375bf4c98bcdfc9d28095d6d1e
SHA1 8cb18fb7b24c691bc5716a156a15243da7e6dfda
SHA512 1390182110dfeff6f9aa9ed9dfbd9169e615e982938654c128f5cee22aadd1433d39bfd586b003ab9f043c294999b6a30b71221ed5621e4b4459c2048348dd70
SSDEEP 12288:8oNdoCbZBL5l5PGdqtAeNiAxBGlHEqfxVNF1BjD+AA+S+:8ofbZBL35PGdu7scsp73X+X+r
TLSH
T11C75230C9E6A07C1DF3E31B466589286997D8F86B64270BB9B56720127B4FE8C5C28D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 c0d7a9ca69c23cf8b65d5e3153e84b26cd1bb101c26ab02ccd67d5ffdcdcdbdd
MD5 498045810a27733d6794c4eeeca2cff9
SHA1 3036f6926bde4e76c10c016aad90572e814e4e5f
SHA512 5546c64709a0aef6558b4498d9032a1e5bd7ab2ea8cdb394e9b6a377af7ab857c81db056edd089a76dd6d1fc50eeced0a2fc668b03795a5ed6d9aa8ca2fbeb60
SSDEEP 12288:ZGNdoCbZBL5l5PGdqtAeNiAxBGlHEqfxVNF1BjD+AA+S7:ZGfbZBL35PGdu7scsp73X+X+q
TLSH
T14E75230C9E6A17C5DF3E31F466589286997D8F86B64270BBCB56720027B4FE8C5C28D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 3b27f8e4a4a82ea74c4937623804979ef38bc7cb451b41d99982289bbe01873e
MD5 1827c64008925c6e57005aeddbd4306c
SHA1 dee58adbe3cc8ed3737e0596381f3a3d6ddd8756
SHA512 76975987247efc4700f03972bb15b9e84e7eef9e3d4e2f08f8e74cc46930b35a897e17d1269cd29eeb5284eabe0f2ffe462cd0d087c4d196fcb1b666d91a58a0
SSDEEP 12288:uVzNdoCbZBL5l5PGdqtAeNiAxBGlHEqfxVNF1BjD+AA+Si:kfbZBL35PGdu7scsp73X+X+v
TLSH
T1467523085F6903C0CE3B71B4DA659246E6B9BEC6E72261EF8B1122051FB0BD4D9D1ED3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 0b2f427f62577babe8f5ac1e20bce547329bad7afe9c8fa91be2a72c86151915
MD5 5c793e474c351997c3e56de92aa3941d
SHA1 a7c971d90375fa98db6ca35dafb192c92622c47f
SHA512 3f54727eb81fbc17d4b5c6ca47e97c5542995c6739e1cd223ce4d373accdc314a206dc115f8761e24b58ef43debe37fe1dac06378c93756feaf5180a333d6c41
SSDEEP 12288:wbNdoCbZBL5l5PGdqtAeNiAxBGlHEqfxVNF1BjD+AA+SZ:wbfbZBL35PGdu7scsp73X+X+c
TLSH
T1F275230C9E6A17C1DF3E31F466585286997D8F86B64270BBDB5672002BB4FE8C5C28D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 43a986ea625cc76264b24d001cae24ebe4ae215f38afe157ec9cee8b3811c79b
MD5 6518673e739504e45d8907a08a9f462c
SHA1 7c141854db1f0c76b5270dd64322930070d5803e
SHA512 6329393f6e0cc6f0e0c7fd24d6c7d177b07af01f8431635d5b558e81f9422100d5e56c7391a405d7dda976fccda8aa883529ca6f21c6b9b6ec83c5770bc3c893
SSDEEP 12288:G8NdoCbZBL5l5PGdqtAeNiAxBGlHEqfxVNF1BjD+AA+S/:G8fbZBL35PGdu7scsp73X+X+6
TLSH
T16B75230C9E6A07C1DF3E31B466589286997D8F86B64270BB9B56730127B4FE8C5C28D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 c450d2bd0d1782ed382c353e4a5a0af3393dfc728abdbc92fee1d408a6b3dc4b
MD5 587c7ef1d5e8c796d0f2d615cd7ceeea
SHA1 8ba451c4de9b07a1d2393c21eb864cb3a91693ef
SHA512 50a35f95ab8f6e49a7b02f58e1ced2fbb014f44d0f656852818644f65c9f0245f15e7cc4b9bebb77f5eb6c83be964530557d1032891954808017361e6a361bd6
SSDEEP 12288:zwNdoCbZBL5l5PGdqtAeNiAxBGlHEqfxVNF1BjD+AA+SF:zwfbZBL35PGdu7scsp73X+X+o
TLSH
T1FE75230C9E6617C1DF3E31B466589286997D8F86E64270BBDB26720137B4FE8C5C28D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 bb2e83af922d762bd6f01458a14597501a3109771ebc940f7340f055af31d98e
MD5 a0d7afbfb8be6595c7016b0c2de85580
SHA1 4617e355ee5a0caca8cb0816ca5b253c6ae90352
SHA512 bbef6a1cb5a353774e8c7f350181686c90de7080d7d0e3cc635d01de0778e44216c49c76a3472e97e2c5e7eda9d889299d26e4e35eb1235d27faf6843ff6d0de
SSDEEP 24576:hZMJzFVSOIfbZBL35PGdu7scsp73X+X+V:hZMJzfs9BdSdc++X+
TLSH
T1F5850158B3A018F4ED77813ECD258906D6B2BC5A0B60C65F03B432261F733A15D6EFA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 74b7ef2791092879679c91adf28119758998affdf07e519087576d5c412ff29e
MD5 5472935a054700ddb629a0f9b67ddc63
SHA1 0fabfe335d23d5a03af76a604b683b6c10e55543
SHA512 b03430d2ffa1d24e9f52accc674fe58296a0204065e4f5022d2dd383f25c7fb37e19df6a67ec59be906039761fc84f4640447139925990d4177fcce20d422d1b
SSDEEP 12288:jJNdoCbZBL5l5PGdqtAeNiAxBGlHEqfxVNF1BjD+AA+Sw:jJfbZBL35PGdu7scsp73X+X+d
TLSH
T1D575230C9E6A17C1DF3E31B466589286997D8F86B64270BBCB56730427B4FE8C5C28D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 b3e1c94694edb35f311c386696c6ed663f12af73a61bd307d0853a5c485f10e5
MD5 9ada334cd23eba57af90a882c54e57f2
SHA1 9679c7878922abf1a100f2ec3b0dcdf87a6843b7
SHA512 9c93262dd93fcaa76c7f102f8a24c3aafe0ed217344b63b49c089e01704fa177eb0c3bb44b0f2ecb69c5dcfb40b2531c1a12c9b0aa696188bcff974bf090bcd6
SSDEEP 12288:yVNdoCbZBL5l5PGdqtAeNiAxBGlHEqfxVNF1BjD+AA+SF:yVfbZBL35PGdu7scsp73X+X+8
TLSH
T1EC75230C9E6917C5DF3E31B466589286997D8F86F64270ABCB26730137B4FE885C28D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 6e6ea0d41af72e9e6040f42ea96d78f5665117dfacc758ddc20c10f14bbde2b7
MD5 bd11ccce39705a1f16f6eda901581c56
SHA1 6f65d224b1f3cbf00c61947a9fdcb05b719f1eb6
SHA512 8c9c40bb75a2e1317f927051c0d7f4f5f8f476d15229b2bfd8dff1ed65c2c4816b97f677540ac0fd6d1b3ef60223dcf68f24e8986af4e69424f16a1f81ab8601
SSDEEP 12288:wyPz5L8UNdoCbZBL5l5PGdqtAeNiAxBGlHEqfxVNF1BjD+AA+SO:BzyUfbZBL35PGdu7scsp73X+X+/
TLSH
T1A885120B77A531F8D63B5278C9611602F776B87247209AAF476013362F327E09E7BB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 4df68e4ed14c3eff566a69bd6836eef3618484ceadc34e576d6376473d4db375
MD5 912169bfe03440bb0ef015bb7af9aa3e
SHA1 6f1caff0cc0ff9846682324dda1cfa7b375cf535
SHA512 7f0ebbbb08795b87084aa8d00da6be0cc6077ed2caa0c5ce0e84ff1db2e47ebb94be6343180033c4d9fbd5ca7ae46be0c1fdcec0274338592f6e84b37e1891c9
SSDEEP 12288:LJNdoCbZBL5l5PGdqtAeNiAxBGlHEqfxVNF1BjD+AA+So:LJfbZBL35PGdu7scsp73X+X+1
TLSH
T17E75230C9E6A17C1DF3E31B466589286997D8F86B64270ABCB56730427B4FE8C5C28D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 e0564ef7c57e7a10a6399c8eb5775a0ae61063fe1ccc427b32ee4b0161e5d970
MD5 885ecc17b708ba1abc12f4640d5c0025
SHA1 866b9ef532d554c7d4fcd76c5b761c1a9d512e25
SHA512 c3597fe8f9f1898bff5e97d728a8237db4898b51491dbfca720cf15bbd3496b0153a74d913a68ca59f0297774b585859d96fbd07d68c70a3b3f3c4a6e4e7ec47
SSDEEP 12288:BJNdoCbZBL5l5PGdqtAeNiAxBGlHEqfxVNF1BjD+AA+S3:BJfbZBL35PGdu7scsp73X+X+K
TLSH
T16875230C9E6A17C1DF3E31B466589286997D8F86B54270ABCB5673042BB4FE8C5C28D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 a05ece544ab84beced4dd128b77b14550a3ec26e7406bba336da03caf5870f73
MD5 98d810f5a67912fefc2e28dd05854776
SHA1 e6babb66877273df95631c6dcaadbc93e8a384d7
SHA512 18c13e549a7b517e8e56a9c45e6cd0048f6a7feaba6dc5d63e8f38d1f530bbfb9d7e6b8a94ad5f4650257ae915d8e87e53a1b5f93970d41441afc55266dd8896
SSDEEP 12288:kyPz5L8UNdoCbZBL5l5PGdqtAeNiAxBGlHEqfxVNF1BjD+AA+SL:9zyUfbZBL35PGdu7scsp73X+X+S
TLSH
T13685120B77A531F8D63B5278C9611602F776B87247209AAF476013362F327E09E7BB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.8MB
SHA256 35a985bc7fec652eedeee78804b259ce3785fc8b25b125f02110ebc39b919ef4
MD5 b90fac65bfe82f70272888b500952f0e
SHA1 e3c8d640f58e14f9f8d262573b55bd4c58cf89cd
SHA512 fab8f7f814798769ddce6371e5fb39e069e10e3e36dc7a67dd5dbaed7c2101ec0b2a10a26834c675ad35d9220f544c121aecdb79095dba85fd2cb2a86025154a
SSDEEP 24576:wTuaLl3z0zDWfbZBL35PGdu7scsp73X+X+V:wTdLljn9BdSdc++X+
TLSH
T1FB850158B3A018F8DD7B813ECD658906D6B2BC5A0760C65F03B432261F733A15D6EFA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 88eb028f7c26851dcaf8da8b37556c7bafd5577ac6a7ea655ef47d0409b0f3ea
MD5 a870fd1e5aa51e430074336a6f55aa52
SHA1 5f9063adc67775d79ec43eb98f905a3748543de1
SHA512 5e2786334bb93542515c63ecb37f2388b1cebeca5f6ccdaf0daf2153d1e4a716ac3fd7f5be640ea3133c844d1ebee5a246aecbaec3d396b1c2afba861b075362
SSDEEP 24576:J3xd9CHKy7GZqfbZBL35PGdu7scsp73X+X+5:Zxd9CHKyas9BdSdc++X+
TLSH
T16F95CF90F3E415E4F1B79A3589764502DAB67C9A5B31DE8F03A4221A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 26152c047515f4e7440544bd3912d10202690fbae6d2b55aae63ce55be20b853
MD5 1a9e4b81c582f614edc644c9a02872f0
SHA1 32003464e31e8ba201eff1fed89cb2db1dc49c9b
SHA512 d691d3ebf25ca5358dafe33e3102855f6b7de2f81050879e09c3849909d638f3b9187f17945614baa63ab96457eb90c2bd9e6431d8c96402dcf1a5606d8da1c4
SSDEEP 12288:vmNdoCbZBL5l5PGdqtAeNiAxBGlHEqfxVNF1BjD+AA+Sh:vmfbZBL35PGdu7scsp73X+X+s
TLSH
T11775230C9E6A17C5DF3E31B466589286997D8F86B64270BBCB56720027B4FE8C5C28D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 2acbbee8ddaf9c27a1b028923b5d7499933c5cb19d67a159e6aae161fc15594b
MD5 80f74d14ddb4de8cc5b91a773e01cfb9
SHA1 762e74365a173b29b869edf43fb3c8274ad2c953
SHA512 38eaf64d81b2f3e179935718555be35f39d6e2fca5a72b7fc251a1016494330c0a607fbfe09c783e91263c960a2e1fb1d87a836e9d82048514a4542e92cc6f81
SSDEEP 12288:40NdoCbZBL5l5PGdqtAeNiAxBGlHEqfxVNF1BjD+AA+S/:40fbZBL35PGdu7scsp73X+X+K
TLSH
T16275230C9E6907C1DF3E31F46658924699BD8F86E54270BBCB6672012BB4FE8C5C28D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 662c60b539af410e84e23651968d641cdc1ac371559760b058b6883a1b04010c
MD5 b84b436a164eac9b8c3a60d7505c42ad
SHA1 528a7c166595b56521b0d5486f0993809daf4c9b
SHA512 c749ae57e4ead4b62f13f74f40b6ce0cefd0241d5ab8d2577021669d6a3219400542e57f5d385c86a51b00b029cb7cbb6cf275a40b5cd851f14d34166b4f0899
SSDEEP 12288:nvNdoCbZBL5l5PGdqtAeNiAxBGlHEqfxVNF1BjD+AA+Sl:nvfbZBL35PGdu7scsp73X+X+s
TLSH
T11975230C9E6A17C1DF3E31B466589286997D8F86B54270BBCB5673042BB4FE8C5C28D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 e916ed28e59fe9ee798d1e4789152d094c6c4ebbfa766069d9a477e75ca55a43
MD5 b5a283043ede7a0c143127e2acd873b1
SHA1 9860efbcf1a0a94a6365b5e7ac78530756210c41
SHA512 522d25800707217c3ff65816a2d066c26075311d90be211c19e056c184d93030caf78f1f66e380ae4e0c452d034f0ea85c021082a983c91e7e421538597342a5
SSDEEP 12288:tJNdoCbZBL5l5PGdqtAeNiAxBGlHEqfxVNF1BjD+AA+SE:tJfbZBL35PGdu7scsp73X+X+p
TLSH
T18775230C9E6A17C5DF3E31B466589286997D8F87B54270ABCB5673002BB4FE8C5C28D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 bf9ac59e9bec5b898ded5d6fd5ebc48b320cec2c82e5c1ccd9153a21cae3685a
MD5 8444819b2669f80293a1405c6eebaa5c
SHA1 ba3efbd13be42b054648825440698c8f4725fd2c
SHA512 1b537b3575eab221e2fdfd13337c813e8e1bb851281e7b82897a29f572b23e310b612e8daa1fac99ebd652368c51871bc20bac63901912b2098a105981470b86
SSDEEP 12288:hmNdoCbZBL5l5PGdqtAeNiAxBGlHEqfxVNF1BjD+AA+SY:hmfbZBL35PGdu7scsp73X+X+h
TLSH
T1BD75230C9E6A17C1DF3E31B466585286997D8F87B64270BBDB5672002BB4FE8C5C28D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 5b1ca83ac8d3dc40d9bb65395775599f5471562003e4812a4e8397e5f1cca637
MD5 1c17b8589a488f5659d48f97f5515ff1
SHA1 ded1281cce25e51ad8dd553eeb8f092d8a725872
SHA512 0aeb1ebbf80aaf5fbf27ff87cd851831312ab3de329fad3a900360990ee942c84009c6d4b9893d504907fe466008c93715c7bc9d74726ff5792193db9ffcf151
SSDEEP 12288:NRNdoCbZBL5l5PGdqtAeNiAxBGlHEqfxVNF1BjD+AA+S+:NRfbZBL35PGdu7scsp73X+X+L
TLSH
T13B75230C9E6607C5CF3E31F46658924699BD8F86A54270BBCB5673012BB4FE9C5C28D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 64ccac903c619db8df190fd3b2c66bb422376e47795d5534999dac70672be010
MD5 f55eea8c4f614d038d7570832f497200
SHA1 de5ea1e276cb44fdc25999c3a2888f68b03fe7bf
SHA512 234bcb8bab17c8731d38244fcc90b9bff0c49709fb77b28dddb141e916b90e78ac7ecb2ace6a0f4149c410339a908dc0f93fa701efa1e149b72eff50d4356f55
SSDEEP 12288:7bNdoCbZBL5l5PGdqtAeNiAxBGlHEqfxVNF1BjD+AA+Sj:7bfbZBL35PGdu7scsp73X+X+6
TLSH
T11875230C9E6A17C1DF3E31B466585286997D8F87B64270BBCB56720027B4FE8C5C28D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.0MB
SHA256 728eabb831ebceb756f5cda9a02ced644056499d33ea906974c1ea367ab325dd
MD5 c101be56433c29a232c140bc32ad18ad
SHA1 c4e8a7fbd0e36321e22f7b38c3b32a150ed61c52
SHA512 4c18f8c33b146f3d823d2e6a72008899c2f426716c40f99f55c83a3d7b196a467540eae3a70a5ea9ccd79229781d106f5d8f3d97bdac108187972265134b429a
SSDEEP 24576:RfwvOk9RX6wkyAIFfbZBL35PGdu7scsp73X+X+y:dMnYIF9BdSdc++X+
TLSH
T1F795DF29EBDC04E5E177923C99B7460AF6B178591B31C2CF029A536D0E33ED49E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1eebffebc0d1f6fef8de0359d3455a24258aa5cf4a260b6df89221183c9ead43
MD5 961e745948ca7225d6c5be69ebe6b79f
SHA1 bcfedb593d9851b306651338016d08c5f72211b3
SHA512 4b7e4740da8e8fda5b751d99a4680089c5bdce6a22d7c50e2f185edf3dde0c9760720f39dba9ae8a6bc2aff2956b1724d3fc39a2f688c9d358304da3225e3619
SSDEEP 49152:NYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0S9BdSdc++X+:DySzPWBdS+V+
TLSH
T1A3066C56A1A801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 fa3ec08f6efa7a24a0fe7d92817f816c7897c50904ffd24ed3fe523fe73db30b
MD5 9ae34b23f2af18ea6523fea1a18bb601
SHA1 24cebf534ceed2529b2540fd27634aec47d3bc45
SHA512 cfb41c93a745b4fd9f6fec697fdbd480777499eceaff5fb3e0d54905f473648204ae93ac0f117c4991048868069338de52a8caf2c1ce3f0213f2af23815f6c4f
SSDEEP 24576:Z47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AY4fbZBL35PGdu7scsp73X+X+D:Z47JUQjairIhCnDHUPfF/C9BdSdc++X+
TLSH
T14565AE1DA3EC02D5E1BA927885154A5AEA71782E1F31DACF1270837D6F23ED48F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 de5f3952c6632c37c06c8d9b347160a4e35deb7f48b03d100327622d7d0a2e35
MD5 f5942f662017211bac4629e7092775fc
SHA1 3d3fe606eda117d380558d269a06face7c4a8083
SHA512 d54261531390e109e392cd6b27bfad9137f1c9462872e6bdf835bc876e61f5731fc903b7ae7e06ed3822e3af98059d83efe5814ad83b675d01b5416dd6087e1b
SSDEEP 12288:yksfZNdoCbZBL5l5PGdqtAeNiAxBGlHEqfxVNF1BjD+AA+S5:YZfbZBL35PGdu7scsp73X+X+I
TLSH
T14475F108D29802D8C52E6279CB558641B3377D6593E2E3CB97D0F23E1F74AD09DEAA43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 27da4161961d80cafaaf2b4bbec3d230ec15675dbbeb179e5cdd47341b34e26e
MD5 56e5af6561472553c566cc7fa15023b2
SHA1 0fe0d2b3e3242effbd146ab416ccb2b45ade36f3
SHA512 46f46d84c69f5cffdea73096c19c1da26ef341ad8b91d640fef54c02579eb1f7cedef394628d03e07fed50dbfe2341a50e53163893da5268b32c6956c10dc561
SSDEEP 12288:rmL+nU3f0/I1y7stwdIoSRWEGEzd1GdN4HmFtGgcdf2/eIQ:r2gUPFssO7SRvtzHGdNK8t1cFfp
TLSH
T1E9351810766BD75FC6A940321E33C1CCAB707D41EE05AB0772C8873FD576669BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 494KB
SHA256 329d5ef3f03437ba9b88edfb1b0d7c84a15d9059a4159735ccc615186663de97
MD5 fe367e4b9f07cb76946222f025ed4b27
SHA1 3f7a7aa36ba701482e478745a2efec22ed340172
SHA512 4ddf2944338201057d361e2c6701703e6cec2273c0e34a0aba5917f0e261fd73b22538e36a3db583cfb4fee8dbcbee97c5cd45da9810b6efa46f645fb866092f
SSDEEP 3072:/qE26jDnt+NCmFdG94dWCGUh3eFJGA2JdpGssv:/FND0XoHV6OF0AkdUFv
TLSH
T1E1B4F741A637E38FC0F6603206755B8EB778E843BB06AF1637C44979D866225B5BD3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 62015fcf1d371a645e831ce1ac3375c8ce1a867f03919cf973bf16d8ebb3e912
MD5 02f5196de11f75b2e961ab7be5169006
SHA1 170a1e2b4be3e54184e4192f4539fa649e3ccc88
SHA512 56f8a6d06a8f6d2e4e32e4a5a79da39be667ed8391683ca07463f2ed6dbad442bc3282ed262fd04a110f6e272ea279c7d54d40bc1ee5728aed925ccfcc0154a6
SSDEEP 12288:TM7hNdoCbZBL5l5PGdqtAeNiAxBGlHEqfxVNF1BjD+AA+SL:4hfbZBL35PGdu7scsp73X+X+i
TLSH
T1BD7523088F691BC1DF3E31B0665D9216663EAF859B01A0EBDB15730436B0FD4CEE2997
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 d69f996f7a11e487edf0d3774d2ba30a60e55b1bf48bc089c4407e9749782fc4
MD5 18e08332d788440c54fa2dc3f552a488
SHA1 ef70f063cb8b014f542e604e9527574eacdac93c
SHA512 1a65657f5692b1b8141c2e4016bd80bec782733634e96f2bff30bcda53b6429018137d0f3ef6ac9d3c6a6e5e60e2244e9e646aeacc688adbf58fab7bb96f4aa6
SSDEEP 24576:qgb6bmBIi49WNNFpg1rSvFv7bYnfbZBL35PGdu7scsp73X+X+j:qgb4mBIBhGF49BdSdc++X+
TLSH
T19665AF1E22EC02F5E1F9E2B8DDA64417D6B278160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 a9663b7d9db1460e499e289b3e9c787569c8ee7fc634e08c14f45bf62b37a5db
MD5 01880cfaa743943d39d777a54a6d2890
SHA1 fa5da973bc70ef68f173abba3af5d1afcff5b3e9
SHA512 dec34d1af58a3543a02b0a5b5dd0575e1801fbdd9e3b71982590212905fc8e7636af5c6a6cff2cf91246a5986ca5c7ba2ff468a6a86a9768c4acead64d40a440
SSDEEP 24576:xG88u8FpJqH1nzria7/mIfbZBL35PGdu7scsp73X+X+g:U7ZFPqV6a7/P9BdSdc++X+
TLSH
T149A5F12567E102F0D47BE1388A864663F6B2B4151360EBDF07A88B551F23BE54B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 80f0d2b78534617c25e3094d1ff1bc296f88c48975c21d258d057efd927b4f0f
MD5 90eef8dd3d80e2d4cebc5c12b1d522b8
SHA1 29ed26092b74eed35bb8e129920d6a219c6e2400
SHA512 f7b98039271aef33d389bd72ad1fbcf9b743b7bed35b11b741845f502037345d60c5d5e91f2a797b9a6ac22a42d84a351e1cb366aa060fcd0c16af062dc7b22f
SSDEEP 12288:CHvUrBFrEjwaQsNdoCbZBL5l5PGdqtAeNiAxBGlHEqfxVNF1BjD+AA+SR:CPUr+NQsfbZBL35PGdu7scsp73X+X+I
TLSH
T1C185F11E66AC18D5E67AA17C85868709F771B4521312E2DF03E1813E1F73EE8BD3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 582f5fefc53233ffab3bf426aeab3bf64394a0627e6890e7ade2954778949bce
MD5 35e837037c186f2d6be6003403529337
SHA1 b4182e905fbf48f174176741d16209aef95889cc
SHA512 7fd0eafe85a2f840877563b9db1bf1f7d7b6d176c4a52841761b6df2eb628c02e5c1d9dfce4fbbff4a1310a26738a94b8f5c48766d150d527318bd382b64a627
SSDEEP 49152:oBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj89BdSdc++X+:DG05lO43bDBdS+V+
TLSH
T174D5CF6E62EC11F8D1BBD17CDAC6460BEBB23415032556CF02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 202e564deacf1f5b608bfcbdb573eaa8c75d9c442ca1402c34e5746ddfee72e1
MD5 bcf3abf2da76faae8b44eeabb86c0bc4
SHA1 90864e13cfead01aa91ffe0056fc85dbad22f857
SHA512 38e5765dee1ef4b47f3e81f052733eee80aa46e4c4ee8a98058cc2c4feb2fd1e4f92939ec20c7215935f25cfb4aeed9a340ae3fa35803d566edbeb9e73c35054
SSDEEP 24576:Cfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnSfbZBL35PGdu7scsp73X+X+X:Ka5POZ3hJt2pasx2+m09BdSdc++X+
TLSH
T16F65AF5DA6FC01D5D679D17DC583861AF5B1342253329ACF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ed149b0f238c66a711b0e278cc00b91b6187f08461188dc826bdbcd7c31e4371
MD5 e4f4776a05c0f7e162b3aa428f725e9a
SHA1 ec9404af7ddea27f5c1a632bfdb8b96eb8218fda
SHA512 2a3f0a6c04631afa1685b909b59b9393c3b082de5305244aa65276f3f1ccb0dd4c30df273f939170b44cbce24191aea7d9c72f66abf0de5d208394dad8da38e9
SSDEEP 24576:dNcwHdjbyQ4nLC18lb/EOjowL7FkAfbZBL35PGdu7scsp73X+X+/:dNc/zEOVHFv9BdSdc++X+
TLSH
T11D857B1623E901E4F5BBE1BE89779546FAB1786553308ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 73b988f938162e45c8a30656e000604210dd27bba6f8373b577b430389065991
MD5 1dab142717c2d8b7baf7f64e614e6905
SHA1 19e9cab2c559a448d965ddd71fc513b3b2a89159
SHA512 4f1c64bc84ff9f3d557cbb91cbd0012d930b2516ed8f0cf22b597b534f9b6d646b2f2e581aebe12abc46d19241e5c225642f1d2f7d1bca0b02bf079ee1c2378c
SSDEEP 24576:z3kNvNnaFeYhJNtmZBm+fbZBL35PGdu7scsp73X+X+I:z3MwBtOm+9BdSdc++X+
TLSH
T1EF55AF2EBAB806E4D1FEC6B4CD238512EA727461173292CB5390C13F1E679D89D76F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.9MB
SHA256 5bc2c3af1f16fbbf771052e6ee2bc533fbd5e865e901f0f121534439d1522af9
MD5 99fd59275c13eb0dad2e556b2641037b
SHA1 6d3ddab32f02277bd25fd87c61c6758d37db6d61
SHA512 661793de4f223bf6ff566d20206a09466d2b6757db7d7192a6376c51f6049ccd35d64c3ff6c9494a6902c7fcae2605decc22a0d213ff8354a5e38751eadc8124
SSDEEP 24576:PD3FHshBIYQgAdfbZBL35PGdu7scsp73X+X+H:PDVHeBIAAd9BdSdc++X+
TLSH
T11C95E13DEB9C04E4D57BD1BCDA638606E77138A9032265DB029081B61F6BFE46D3AF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/468-134-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/468-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/468-126-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/468-132-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/468-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2664-346-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2664-89-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2664-96-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2664-282-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2664-347-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2664-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2684-39-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/2684-51-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/2684-40-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/2684-46-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/2684-49-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/2884-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2884-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2884-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2884-142-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4036-115-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/4036-114-0x0000000140000000-0x000000014031D000-memory.dmp

Download

memory/4036-121-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/4036-311-0x0000000140000000-0x000000014031D000-memory.dmp

Download

memory/4060-0-0x0000000000400000-0x0000000000632000-memory.dmp

Download

memory/4060-77-0x0000000000400000-0x0000000000632000-memory.dmp

Download

memory/4060-7-0x0000000002510000-0x0000000002577000-memory.dmp

Download

memory/4060-6-0x0000000002510000-0x0000000002577000-memory.dmp

Download

memory/4060-1-0x0000000002510000-0x0000000002577000-memory.dmp

Download

memory/4092-246-0x0000000140000000-0x00000001402AA000-memory.dmp

Download

memory/4092-67-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4092-65-0x0000000140000000-0x00000001402AA000-memory.dmp

Download

memory/4092-73-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4504-221-0x0000000140000000-0x00000001402AE000-memory.dmp

Download

memory/4504-55-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4504-54-0x0000000140000000-0x00000001402AE000-memory.dmp

Download

memory/4504-61-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5024-14-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5024-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5024-22-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5024-20-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5024-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5072-108-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5072-102-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5072-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5072-313-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5072-297-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5072-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5464-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5464-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5464-149-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5464-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5464-316-0x0000000002FB0000-0x000000000324E000-memory.dmp

Download

memory/5688-78-0x0000000000890000-0x00000000008F7000-memory.dmp

Download

memory/5688-83-0x0000000000400000-0x0000000000676000-memory.dmp

Download

memory/5688-84-0x0000000000890000-0x00000000008F7000-memory.dmp

Download

memory/5688-273-0x0000000000400000-0x0000000000676000-memory.dmp

Download