3e34672c7fa6a7af1ddc7316cb072b41be0f84a05d786f9598b1e010f06ae2d6

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 23:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Size 4.1MB
Sample260813-2y3ehsztb1
SHA256 3e34672c7fa6a7af1ddc7316cb072b41be0f84a05d786f9598b1e010f06ae2d6
MD5 19b22d7558e3048364aa30baf586a3f6
SHA1 798a092427c9e36015b4ad4190eea303f424861f
SHA512 f10abce0ab3e590d3cef411e6b9e312daa6053340376d6121f67c43ecfa151d23381f33dd54c86ffa87eb5f22e336c290d26a8e0873d17984eef1ddc3ca210e1
SSDEEP 98304:zXZYey6sOA1E3r134YpWIZLyGFLOAkGkzdnEVomFHKnP2Aix8EVy:zpqIpWIZLyGFLOyomFHKnP2N
TLSH
T125169D307E6E84B6D4522233C9E8B6B8A32FBCA4273911C792517E1E7531EC14B3E567
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1232	elevation_service.exe
4604	elevation_service.exe
6048	maintenanceservice.exe
5104	OSE.EXE
2260	PerceptionSimulationService.exe
1508	perfhost.exe
1072	ReFsDedupSvc.exe
4672	SensorDataService.exe
5588	ssh-agent.exe
3668	AgentService.exe
5012	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1f5db83c8f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe

Checks SCSI registry key(s) 3 TTPs 44 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000007518892772bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000089cc4293772bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005c252291772bdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d6051492772bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003fd28f8f772bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2232	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2232	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2232	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2232	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2232	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2232	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2232	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2232	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2232	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2232	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2232	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2232	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2232	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2232	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2232	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2232	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2232	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2232	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2232	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2232	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2232	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2232	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2232	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2232	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2232	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2232	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2232	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2232	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
1232	elevation_service.exe
1232	elevation_service.exe
1232	elevation_service.exe
1232	elevation_service.exe
1232	elevation_service.exe
1232	elevation_service.exe
1232	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2232	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeBackupPrivilege	1072	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1072	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1072	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1072	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1072	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1072	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1072	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1072	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1072	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1072	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3668	AgentService.exe
Token: 33	5012	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5012	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5012	SearchIndexer.exe
Token: SeDebugPrivilege	2232	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	2232	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	2232	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	2232	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	1232	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2232	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2232	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 1816	5012	SearchIndexer.exe	103
PID 5012 wrote to memory of 716	5012	SearchIndexer.exe	104
PID 5012 wrote to memory of 3212	5012	SearchIndexer.exe	105
PID 5012 wrote to memory of 5232	5012	SearchIndexer.exe	106
PID 5012 wrote to memory of 3096	5012	SearchIndexer.exe	110
PID 5012 wrote to memory of 6048	5012	SearchIndexer.exe	111
PID 5012 wrote to memory of 4472	5012	SearchIndexer.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2232

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:4296

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4604

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:6048

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5104

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2260

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1508

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1072

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4672

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5588

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3668

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1816
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:716
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2976 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3212
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2972 2968 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5232
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3096
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2972 2968 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:6048
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2976 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ed52e7e55350516dd68b3393c6272c2372d95b5bc3dd22f8937425938c0acd97
MD5 c94480d58eb947b09f12ff6f20ccddba
SHA1 05e212f733c319f5affba00673aef234c2db8840
SHA512 8e2ef261832387a1071f6d59249cf84c6bbc73f5a73d5b54a6dba9c5ec60b22fe0cbd14e8c584bb31ed99d5fbf136655c7704242e9a35d72e9afbae3185593a1
SSDEEP 49152:jb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnDx4x8EVep:B3q6HjBcix8EVy
TLSH
T1C6D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 3f6c48a1feb4c023db0d5245d893950a2508b2a439feb33bdba4990a2252810f
MD5 c42b9c7165347d7f1f42b68693470078
SHA1 c04fed81f33d87f1a1a9c68965afecfd32ee8092
SHA512 ac53ccd7637140c2090cdcf37fd8c85218e304c9cc63346bf8b7d99063a8752ef083035096e39d3d4674ac425b7a3d6f286199f5fc9882e53af5ac1e8bd761ee
SSDEEP 12288:G1XLsswWkxy2lRq2czAl+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:kXYfDtczAlyxknw4FYnshx8OfVe247
TLSH
T14585F12877D508F9EC6B8139CDB28512E633B8554770E38B03E4A5295F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 0924a6218e8291c7c2eb61a630e65645055d09ba4637ca6b70225c8d089f8a48
MD5 35beb298aa3dc174984251c52fd7b7b5
SHA1 9ababbb24920debc577bb6fb62c64acad7362c13
SHA512 e1468c19eb4f1c3e9584bd7207e0753721e7c3ecafb5e6913acad4f79ae0951bde4374282d18f31e602b59c69d66df993b7a3f5b5d858b02a4e5fa9fa80d9875
SSDEEP 24576:z0Le5ji0hmxirM4yxknw4FYnshx8OfVe247:zPji0Ac+x4x8EVep
TLSH
T110A5AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1135871aa94d68421d8ce1eb7ce54fea4cb7c2d4671577f5a3ef50ee8e77e872
MD5 4c54d9c5b0f060c979f9ddb2d4e5d04a
SHA1 3fa981c5bd8ceb2e1058d7e9db075803f331d88c
SHA512 87f7bd7b191bcc2d1e208d2f462abefb84ec2417cf1b09446430ad033b62c50ab6fbb52bb611a36c4cfd0c1f8de214a21f6781d9d8dedf7cf9affbf524269d27
SSDEEP 24576:9a7/ezSC6vUyD/aqgrvWE6q8wyuyyxknw4FYnshx8OfVe247:0/ezSC6vUzPvxHjyix4x8EVep
TLSH
T18C756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 edd8898cb6f8f030ef595c3539a895116d14d58779a196280eca03e2852ac36d
MD5 3bd7937153f93f183a8a6c299089b1fa
SHA1 338079dc3be0f88a30443e74af6be1ff29c9b843
SHA512 d5f568157a811fb965c8804671628644864089a4e65418ef53888db1f36d4aa65095aa32e88705d766a9abd69a803c2a68e45e2d00b7f262b406936e10afe703
SSDEEP 24576:2VbqPb88hv/l+6pyxknw4FYnshx8OfVe247:2VO88hXl+fx4x8EVep
TLSH
T1CD559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 a55b4b71463ad2eafb7215fbab8d747f6d12a45dcad32187896d38bc598c7450
MD5 f57356504380eb7ce7b6899f7eb4bcd4
SHA1 5b8cf44e10c51ebb4f9930405a36bbc85830af7b
SHA512 525eb4c1a2ae825bba4616cd5240919a8c983acdfd9e1c007c0a80235213276915db3363dd61e014573ce28e661edaae3569783fa66b7f5a49f7198f0c94bada
SSDEEP 12288:HRs+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:HRsyxknw4FYnshx8OfVe247
TLSH
T18E75237CA7DDA4E1FA5E14331B7572623616B9A4DA74C11BCB78B14EE0F0C60E06E623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 aef483d42592130a3fad56c315b507f6823cf2b630e1fe417b7379038bdd8016
MD5 b6911f7b1f200af58802678855623ac3
SHA1 309b53eaedba209a290ed2f18c7ab729a4db7a3b
SHA512 2c71dcd50a2aa0afcfc9d675f9635c00f52c7ba19e526be9e6f68e8258247f743f317ab702480f7e545a6da4329408b782750349b72e618aad59a329183929f8
SSDEEP 12288:SeBNUbTVO86UB+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:SJIUByxknw4FYnshx8OfVe247
TLSH
T15185CF7BEE28FCD2C27E5DB95B918200A77274704B6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 eb0955714778d7580d16bc55ed7994a3e6b8381bd44c823754621aacacae9e83
MD5 6a213aa42a78459109aabc103874cdec
SHA1 7859a839e5325523d83cfd7baa04298b1dc6b0a0
SHA512 758b6bd576904cd3e749cc74a45eea4a95ec5744b5a6cfd64d9c51fadccc2030cdbf57987e8537f14c219a22a141d044da1c2d7537cfdd720c7614c2e197e5fa
SSDEEP 49152:RQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THi:RQvGAdlCEL8c/yRNw5C9ix8EVy
TLSH
T1C7267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 261e902b37c29ca6e89b9485a7148d0bf09925a162695410438dc68af7151677
MD5 1924255223632725dd574b4c3f4cb4f2
SHA1 3856ead88ee08695dacae85fb5e79ba37cfe724f
SHA512 08983a1745459a23ef754a4ec6a6a4ed1c06aa7b03ea96e9bb7cb111bb6cd10c65bb901ff8db9bd39bbd51727bece8121d903ff32997b3b558283c3daa9af085
SSDEEP 12288:8AwSfxL/2Dc34DLLmt0LDQewsAjr+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:hdewsAjryxknw4FYnshx8OfVe247
TLSH
T16095E030FE74E032C7BF0DB21B36D716142DB9604B611AC3E3E89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 fb1daa0f8fbd33666a68a2d46f88aaaf09bbadfcdf3acc2e90b765855a3e2883
MD5 e0eae8e416ed935ba2b4882f0f87a584
SHA1 673e2f9e4110b33c6b609cc65206bc6ca6c1e360
SHA512 daf9098b1fede32cc81e0e0fa2f95481801a4bc380486db75e5555a3a9a8d7d402b67ebf33361abb2dffaac8c0937e2aee020deb561a70bb9826afcfd201f12a
SSDEEP 196608:GUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHj:GUEtQevvqc2W1cpV2EI32
TLSH
T1F1474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ebec49d67a781a7f2c090a02ce24790b711dd12cb311e27a7045a786f18d2e51
MD5 f06a49e83353bf4602bd34eacd59745e
SHA1 2df422ff3af24d55320d0f8e35b16405cc414405
SHA512 7dffc56d18ff3d6a7367c1041f218a4069a4453fcd1b97ed24f70165e621a438ec4a110ea91aa55011b1b6048a8a383963f226d3288f68bc6b97f3610036fca6
SSDEEP 49152:VCbRquA/m2yL5zQfFiV+XenmE3/zux4x8EVep:CoqtVjnmRix8EVy
TLSH
T132D58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 de8beded5afb35d2f76acb162733e2f2009ce2d0237faa276eec0bd2e47c99ef
MD5 95d0d8750c33e367c2af332ede5ae895
SHA1 4a906704d90f733d9e4728ca5cb718ccc6e53fa0
SHA512 6acab6a89251c23140fe02c3ddb2f965992f21ee444890f4cedfff89cddb21ee8030ac43eb07ece977d3f405a191f6fc71a1875f67772201ac55ac69fef72b6d
SSDEEP 24576:zAhGLJIFoiwtA5l7S53+yxknw4FYnshx8OfVe247:zAMyFoiq5hx4x8EVep
TLSH
T19E35AD80E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 3351b645fcd982425c6d0509efca02a4d26eb1c75d83c4d20d12d872d2889248
MD5 87ffd93a5955b0979fc901468dc79c08
SHA1 70bd885ad11c4b22e5ccb120e2d5a3e91117005a
SHA512 fa18a15001f3078c6fe93642cd72be5f1682a628070fba4f32da5a55334fc889fe17eb410cdc4cc3e33c08a9c9cb4b7cef0bf933433747bf66b12900b3d75a80
SSDEEP 12288:Nmw5HEjsChNVBFgl0WDm+CS+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:owuoOW3yxknw4FYnshx8OfVe247
TLSH
T1C985F14977E91CF9E96741398697D132F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 0a64a0ff8cf1d89d42ef1079230448f0834a8f07927c33e9c21c485e85896c88
MD5 2cf8468050c9db2cfd38b30e3c04bf7c
SHA1 b8f0393084332430c8576d6505d5dce7ac4fc4ea
SHA512 93f4eb8a6605f39aabe7309a9e05bc9872d0dc42aa37336abf226c597418a648b08c0b1938cdee6dfd1a626ae2436a49661f313c14c87a7c84edd65521151939
SSDEEP 12288:TBZ1Iy7+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:9ZuQyxknw4FYnshx8OfVe247
TLSH
T13475126C33E860F1E1A7113A89F15205A77274A2677183CF4768625EAF72DD09D3E723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 dc05049b88a5e9f60087ba30e7fee3e6b4a4da6c20d2c760b1de0a78354a5650
MD5 b2e0dea27b23cee070e61df498171385
SHA1 69a8decc9c7ebe2b9a6d6b9a191d83f318ef0c1e
SHA512 ef0f4136071816e11d0a207e2a37719be48fb59527a57633d04e300a8ce23aed612cfa7691dff7f91cec75676668106ef4d6f54b8baab4c6d6ec7277af42188b
SSDEEP 49152:lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U+:8QRQyi36YOcPQLvw2gAf+PN3oix8EVy
TLSH
T116667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5131caf085ad317b825592b2cf1fc906d517547e11461591fbd7158b79cf48d8
MD5 e2895eb6f2e4778cb937650a3adf0865
SHA1 a820cc38cb85c4de61a7ed82bc73a4a98f173e99
SHA512 3f27de361d81e6b0a9d3613fe8830d3d941c3a2478dd0e9d42e0949151da98b0af0bbe35e68c536a44dc3a622c7fd0878b29009d140e5f1fc8b82271ad2dd46d
SSDEEP 49152:aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U+:5QRQyi36YOcPQLvw2gAf+PN3oix8EVy
TLSH
T16D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3126645e1f14f325e1da0b1a257a001fd4d6d195d5d104677f635d2f699efc3a
MD5 8e191052e65219ec9e531c0859ec566c
SHA1 aa01350d6f8b8167481428a0aa8983406d1eb316
SHA512 5369c33f917094eb4893b6223797eb2b03700167a216d22ba6f68a59a4e66461f002428b8da9c3c67278b0daf6bac763e074d709813567b65c1e3b18a1034c5e
SSDEEP 24576:3wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0Ayxknw4FYnshx8Z:/68Qg55nhheWu7PNU3/+x4x8EVep
TLSH
T1B1B55A33B2F600A9C44DE1769F46873196D27C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d59c3fb6d2524ab450766bcb001501f1a4b3d3341a2e3ffaa00513a115042357
MD5 7830ba7ede158ba76f8a685408483ef1
SHA1 5d7340db7673b737dbb9550022fb09c181ec7310
SHA512 7e294c3354d8630f81edcc3d35ee6dd04401690a103d44bae1e6e5b1e7516546247fd6a28e7bf1d6f2e9aab392ac746d932c6d19ce6698da38ac2b5d33b6eab1
SSDEEP 49152:j3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99E:2y5112gYy5azzVvL69nLKnhZHix8EVy
TLSH
T11D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 be6adc82deceaa89349b6558005e3e7da35a95a0ea69ea709413181d13f4e158
MD5 474e55e4a566b3e810da236890d607b8
SHA1 36c8789456a98c8c3fa2e2d05a5d4eb076d5efac
SHA512 08c8ae7c84794892685dee65d29b7019f7780ea95c55c71cd7daf9f65510dbcb8ec46c6b8af83b480c36b730fc52fe4e41584cbbab3870dc48e24c4f8f0240c0
SSDEEP 49152:VB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glgx4x8EVep:bu6JmVxd2dgix8EVy
TLSH
T113D59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0dc5d2e66c971256ae9f6c64409469e844973a074f777aa281028f0203cab023
MD5 7a1db744b49a0e34404d63a57c2120c6
SHA1 c8d6ffc82213d603e35fa299319a6682361c5245
SHA512 9f5c56d7aca5124931e51e05536fa73c9985ccdfbac641d06bf67ca9e5d998e8caad6207a37be65473aaee5f84461ef691488832b551354fb74b140bc53d2277
SSDEEP 49152:Z1hpsNoJpF1A6UU44CwH7R4xkx4x8EVep:ZmifPbRRix8EVy
TLSH
T16FB5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 96a1f14f74eaa3ff71fb7efe7816d319ef4029302777046bb63e22378e633a3e
MD5 ba907b5c5f4f094185b9ad258e3a0b8d
SHA1 9a0cd3817603822cf8a00a5a86b44fcab8adb274
SHA512 0415655267fa3b5e9a2807f7cd272e139b2269f3ef429d3a5672a3561788396b8d393f3a1be1ef9916c141db4180796c7c55965d0b59fa40e6cd4199a18c0335
SSDEEP 49152:ESuZQIY0Be2KRRVtOnks6NMHqTx4x8EVep:W5dKTi61Tix8EVy
TLSH
T164C5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d923d40009a9b5a6aeaa62db04645e7dbbbae0678799abdea29e67c64d009e6b
MD5 fb56c3b3db6075b6681dd1babcccd983
SHA1 b64841a09bc85b6ba023b24491c74d1395ef5e79
SHA512 b00652f9051b5b0cd10530881b3d3252dffa6bf48f570442cdfe6840ca967572ef5aac12291b8c04836e6981ecaffd956a6528725ba73e3cf34e62368fd55951
SSDEEP 49152:AhtSn8EApI0figngiDn0AP5wwx4x8EVep:RX2iyphlix8EVy
TLSH
T18695BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 14bfdc9ed8f32e4b2f2179c8238c84fb87f5ef7c98fe8b5568ad933877c8a3db
MD5 7e1e22fc3eef5b97fc2be977eb0ad18d
SHA1 f0bee9b4c1db300d030294cbd24414f8b007e170
SHA512 0c21b87769057e949c6dd3b13d1fa22333a34b8811ebcd3efb99eab7a27391af3af8b0c13424eacb780ec6d8aa25322c886e88c4fff8fcf9fc016022b8a09ec6
SSDEEP 12288:QE+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:QEyxknw4FYnshx8OfVe247
TLSH
T10A75237CBBDE95E2F50D11734B7173626609B5A5EA71811BCB6DB00EF1F0CA0A02E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 a90260c58d06b46965a6ac9e2c5cdcf8a7ad29f8a0dd0deabe0c40e46fbccde6
MD5 606f7740c063b18b3e274032edab674e
SHA1 39d5abc8bf0a101405d2db6fbc8add5092fcaf0e
SHA512 edba3524a7de52463f84404b29ea2ae34600dc02e5df248ce7b43e9aae3f58adba06b953a2fda7ee849180c6bc1290ff45b3864ec3673be728e540e7f154ebb3
SSDEEP 12288:o/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:o/yxknw4FYnshx8OfVe247
TLSH
T19375237CBBDE95E2F50D11734B7162626609B5A6EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 cbfb63d249ed99d9012772669778aeb69e3eacb6ccb99c3499fe8cbad2eecb57
MD5 cec56d295d24bb78fcf7e798f8c7d85e
SHA1 8c94e8d35305f0000eeee5543ddd1bbf605479fc
SHA512 9a4680d1738b6516675e8087ec8a487759fcb9db4674a3dc43431547170731a65f083c19d56d20d1cf4e936db92ecfb6f177eb8a484d30124b6454b38ca15937
SSDEEP 12288:dZ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:dZyxknw4FYnshx8OfVe247
TLSH
T11475237CBBDE94D2F54D10734B7263626609B5E6EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 b12f1e404b0f632d3f230f4d99d27446e46b12b4e11302f26a70c4e3f30d09b3
MD5 0d456d8ed67041445a608f447dd3d94d
SHA1 bef45168a0e89aab737ac741365c1d14f41c78b6
SHA512 1b05ea7cabdf18ed81d1c2a650cf516d918c92a3e992d8d29b220b516769b501286d6fca1b32e81c4a0a64ea1a2684bd0b5b3cf1d9b98aa2e2c18949e9af6611
SSDEEP 12288:vVe+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:8yxknw4FYnshx8OfVe247
TLSH
T14575236C77DE50D1E85A51738A726222B265B8E5E731C25FCB64700EE9F08A0A43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 5415ba070f2679e56b20038409b315712c4c93d1044e67ea2f68473b54f19f05
MD5 622ecf6aef0f1e6bb793b2e17ef6c76f
SHA1 fc90351d57bc3dc6a467053f7015e5ce1e78b67b
SHA512 c1cfda6d47125301ec10f66046e98c92f63f47367cb1050dcf3987a203fe4024919a11568a6403100a5825a2522ff784764023d726f67542cd8f0aa2f2cb699e
SSDEEP 12288:Wm+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Wmyxknw4FYnshx8OfVe247
TLSH
T10775237CBBDE95D2F50D10734B7263626609B5E6EA71811BCB6DB00EF1F0CA0A12E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 06d9009091fa490fb90841dfc8d80637ac5aefe6012c428d727598e05eee9289
MD5 36812bbf471783bdf10cf81315ead5dc
SHA1 6fdc27e65ad8bf334055b0592a70b4a652c29c4a
SHA512 0c0f6e1d1a95039162ae711a87a2873519916e69b4a3f692105f4d1fee567bcecb975806e370efa922a91317ceb0b9baa07e9e9703389ba1c21cd74091259e24
SSDEEP 12288:jD+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:jDyxknw4FYnshx8OfVe247
TLSH
T15975237CBBDE95E2F50D11734B7163626609B5A6EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 8ceaf82ad7ce623ac941acb2796da10d0c52de513ecd10dcb2edba3d4da23de0
MD5 bdab741e6bf0fa6405a9a2b7865f9654
SHA1 655678ed843fa29bb0675128e3fcda69a1f36a20
SHA512 3c8f548cd15c3dcb19308279e55f8717ab26a5c1f981b1b55b384da575dd508a38e486fac41d5decd1e2b3de86e90c6c2bcbf70608026bf2757bdb20592d51b8
SSDEEP 12288:Vn+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Vnyxknw4FYnshx8OfVe247
TLSH
T13875237CBBDE95E2F50D10734B7172626609B5A5EAB5811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 978d9f51e41c19db20908638d01725eb92dc56c13231e73c088d2df404257893
MD5 f9e92f0d024a4a9eb29db27a6c191adc
SHA1 6cef2dd70408e2687c03f13fbd366fe24d7908e9
SHA512 feed4b7f83b51399e49689f1ac150a21d42792103eb97ffc4a4d2f01271b14d89210c07e10a2239c89f9c00a2ea1391366c19af41f28e0223f942f055d88a7a0
SSDEEP 12288:JiZwb6zzFEoS2cPvyf+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:MZMSzFVSOfyxknw4FYnshx8OfVe247
TLSH
T18C8501A8B39018F4EC67413FC9259916D6B27C594B70C21F43B8362B5F736A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 4ef42dc14818f8ac01a200c053f124510be108cc719c0e340436644eadd6d3d4
MD5 a63596a7136194f25f34e717a259fc15
SHA1 505f1178e42ec3ab6a002005816d13054c731699
SHA512 12c7b5e3dd96de303233ccbfd1914e04ea85b1986c2b73aa9a68b8831e43ce676bb98a6cd13e44897788df3b741118ab92dce5322a844f021ffca340ccf4e8ed
SSDEEP 12288:Jg+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Jgyxknw4FYnshx8OfVe247
TLSH
T15D75237CBBDE94E2F50D10734B7163626609B5E6EA71811BCB6DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 1a1a182d636022469ad08efe73b45cdac13d3447506ddda82e7fb6265c855161
MD5 2337c7507ea1e5557464d7dd319edce0
SHA1 b05399fc4fd53d4f4e27d62faabf219cf6f2ad16
SHA512 74be0fc34c0944da25238463905c835ae93c69b5082dc3ee51ede179faefa4c2ee3db855bb924246f637ec21d8312172b0ef50874c33b4ceed7b8beeb282965e
SSDEEP 12288:18+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:18yxknw4FYnshx8OfVe247
TLSH
T1AD75237CBBDE95E2F50D11734B7163626609B5A6EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 7c7202546661df2a81004a9cc41219d86c9c8223dc0306fa3126f7db4856588c
MD5 e52f94a45930942af91bd82682ed739d
SHA1 fc3bf2dc126841ab238e6bcf2d43105d036cf834
SHA512 63086a9570696fb4d7e41427385077fb6e9675ec6c13b458fa83d5668bb4358173afbec2237eeb03b592bba195cde9b53cc8bc7666bf789996d7c34100a13735
SSDEEP 12288:LyPz5L87+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:mzy7yxknw4FYnshx8OfVe247
TLSH
T11585121B73E530F5D12A4236C9621612F772B872473086AF87A4527A6E735E09D3FB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 cb41fc573c2a089fdacc4f9b14df1212b6444d1d7af14f85cb78a4401eedcb85
MD5 6eb8ae2af2dbed142b14d9e4cc064b65
SHA1 78ddeee3e7127f17d19d6eae9656a0f7d8500e5f
SHA512 67f3738b6b164b8595fb93db5a0d231fe1a8e96fc76e1141baf6ee3a2efb369c2c1985208ca9f0c2a6b29dd122693da81968d37044dd830b375a71df51b33d3a
SSDEEP 12288:ag+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:agyxknw4FYnshx8OfVe247
TLSH
T19975237CBBDE95E2F50D10734B7163626609B5E6EA71811BCB6DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 9a43cfae21bb60604b9474d185d20e28f4e84d2a8188235f26b4517cbbbeca19
MD5 f7f20f864a5709f6b6376be65f67e982
SHA1 d8649116fe357f1ac6512621d0bd5ad9e8098f45
SHA512 80e83a9d38f8f398468222a08610a7cfe4442baad93217122c785fd68d9f312f5dd34e33c131992cd5878bd34c146f1d8de8b5ce72a27493674f3a4e61354bd0
SSDEEP 12288:Ng+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Ngyxknw4FYnshx8OfVe247
TLSH
T19675237CBBDE94E2F50D10734B7163626609B5E6EA71811BCB6DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 c6f529908947ec65ebfdf1e9ab00e83c23476880405e30e4ef724328199e8ef8
MD5 83f2430bbc6bc128478b7b05e3e4326f
SHA1 9a3c6d68c7cbcdb63b80b6c24d1d5870740b9e83
SHA512 d1f0d90551fefb65badad37853058ef31c6bc0f20421338885e212e7e59d21d5cc40f8e36897c96283df18c7d63a51a5cadf049852385f76ec84aa6c51b6e80d
SSDEEP 12288:kyPz5L87+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:9zy7yxknw4FYnshx8OfVe247
TLSH
T11C85121B73E530F5E12A4236C9621612F372B872473086AF87A4527A6E735E09D3FB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.8MB
SHA256 633a15ebb5ef906c06df4f6717a0fd35037c23f792e836690fea9418379e9b1f
MD5 b53cb85837604dca5f51366c0e537ed5
SHA1 4fc656a0b16d6b3773390d4abfdbadea366d5eaa
SHA512 4b46574d888733b6883a5ab19adc9550170f54ab162d8c10485ea02749452f8a9c907713eb4dab479f8fae17ce8d6b539c4aca4733d2e5322054c979253dde15
SSDEEP 24576:NTHaLl3z0zDJyxknw4FYnshx8OfVe247:NT6Lljtx4x8EVep
TLSH
T1D08501A8B39018F4EC67413BCD659916D2B27C6A4770C21F43B8362B9F736A05C3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 eaea01ba95c2bdf706ded030a3acd2eadd309e52e39aea125fe9b39bcff5e91a
MD5 2a5b9f297b2ff01dc72ba5df6772af70
SHA1 a377e8b5373ef28ddd8fef9119a91c1f721c2563
SHA512 7dcc242e04d131c73ef8b2bc826f6b8a2ff73b207adef178e5e90ff659e3098b191c64ea8202a0ae089c6c99a17b9bccc258ec2356800b2dec043101a26f9f03
SSDEEP 24576:d37d9CHKy7GZdyxknw4FYnshx8OfVe247:97d9CHKyaWx4x8EVep
TLSH
T11195DF90F3E410E4F0B79A35CD765512DA767C9A5B31CA8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 922a19f46385d3fd9d2a7f426f60042e040663c07e33947ab953ee688081fc7a
MD5 fc9dfd3abeca1f16f88c28e5d4ef5cae
SHA1 ceb0924c5a43a27094d0c263c0e55884bdb17b39
SHA512 6cb47ec554583aad2837e479aefef3fe0ad0a55c576b29123bf8fe19624b3f651f906802214d06f166a817b756af764a7948832e4c10db6f347b6f980e4ee2ab
SSDEEP 12288:v5+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:v5yxknw4FYnshx8OfVe247
TLSH
T1B475237CBBDE95E2F50D11734B7163626609B5E6EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 cd94fb845a8101adb10fff0e671f179e7077737cd504cb112d42719bdca6ab91
MD5 8dda7d64dd2562fb7c464dd690b6a795
SHA1 19f4b6f769cfaa1a4e95e856ef4721bc767975e2
SHA512 43829b59557717f194e0d2f391e76ed1e06fe42037d2d6b4ab51360986b1001e70d80f9819c891b84c257a380aacb1092967c4016ea564e5b88cd74c937b15a2
SSDEEP 12288:0b+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:0byxknw4FYnshx8OfVe247
TLSH
T1B475237CBBDE95E2F50D11734B7263626609B5A5EA71811BCBBDB00EF1F0C60A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 d232fb0aa4a68fe916ddb6dd40b1949fdd697e5b4e4cbf3eb845d2c99fd79f13
MD5 6a336c524c2b04f5bf1a3834ffdef97a
SHA1 f337dfd15b7789c4af709f1445c87e45e740b66d
SHA512 37469b6fd9232dbc6ed018d81d849f734a61b36ab5f09f6f1322d466f257d0212d4121a1a60cf22f0c70a394d60803a0f1725101e64cfb583498d74b4ce5bdf3
SSDEEP 12288:ca+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:cayxknw4FYnshx8OfVe247
TLSH
T18075237CBBDE94E2E50D10734B7163626509B5E6EAB1811BCB6DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 38ddfa2f9ccd66ea09f47bf32a648645b14820367075e3d54bb51f154f70c964
MD5 3f06403b19b2508d674303fdd09442e7
SHA1 fa265c7ad7b1311481b633097ce648335fdd1cfd
SHA512 fbf549b3c0df25322b3d691c8142a6bc24939cbb6d79ee9ccefd58875eeb4d8aae6b19cc864d12375f4ed5d8d28ab69594b944e404bc9f437c58121c696c52ac
SSDEEP 12288:Kg+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Kgyxknw4FYnshx8OfVe247
TLSH
T1E575237CBBDE94E2F50D10734B7163626609B5A6EA71811BCB6DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 4bc5eda3d5fd406d507cfbbb4d725812d9b927180a3b742d15711926ec970b20
MD5 e17791ef1627292b3aed5360a313cd9e
SHA1 5f642337b9a5cf0e1619e7b8d58b9e25fce9aab5
SHA512 abdbfd3ba62673f4a996b97bdb17c34caae4a276ab10230f5c8ea925deebbee601db7970adcd594ca2eda05ac04b0b5a5ed576e75091e05dc846906e26721f16
SSDEEP 12288:Q5+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Q5yxknw4FYnshx8OfVe247
TLSH
T17D75237CBBDE95D2F50D10734B7163626609B5E6EA71811BCB6DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 341037f67308610d51df6d2758a2d85745d9bb806e251bdc1812183389bd7691
MD5 41d335d64e34af8a7bd6e26c4dba744d
SHA1 c5cc7dbbd1df00e17335d64e0f28e3e5dc3952b3
SHA512 7a4dff2bb15c785ef02d0767f268ca02ed1a0d92cd8d521746e3f068a2d56460c45f285b6a7351a8f8ab10ae0f50b1f635803c3fdab842ea8f7f7971d66208f0
SSDEEP 12288:+o+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:+oyxknw4FYnshx8OfVe247
TLSH
T1AB75237CBBDE95D2E50D11734B7163626609B5E5EAB2811BCB7DB00EF5F0CA0A02E523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 51e46e359c137f32f397529c7733270f899cc3d54b053f5067a3c9b1e33f41d0
MD5 7b79fdda0df4989e37aa233d6e5b78a9
SHA1 bdaad3bd0f3d48eb8d1f414cbf174183f3da8cc8
SHA512 1237b0caa904cb0c26dd9c955ff9c3cc6fe1569e7b9953a6d756619db5ca4dc0b4b3e0a78453141138dea935fb3c21b26420ce9f0f1595eb4e236965781f5a3a
SSDEEP 12288:2m+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:2myxknw4FYnshx8OfVe247
TLSH
T18375237CBBDE95E2F50D10734B7263626509B5E6EA71811BCB6DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.0MB
SHA256 f8de76c078a061f22b59f7fb188c696ad491aacaa56bfb94ef00c2b005b53882
MD5 d1aa3e577c7fc04fdd51c8e47b7ec6a3
SHA1 1972aaf1b818167ebb6ff0488c923f6ca7b55d6e
SHA512 d2a89fbf48ea2c82d75ac8403457260641075fc212861fa0025cde698ded2482011c320ffba314f2662cd1d65fb13a45b6acb462e9c8b6000d08b66273b6b5a2
SSDEEP 24576:Afwvok9RX6wkyAIMyxknw4FYnshx8OfVe247:IMnYInx4x8EVep
TLSH
T17D95CF29EBDC44E1E1B7913D89B3460AF6B178695B31C2CF029A536D0E33ED49D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 d73f3aef610673cbf7fb98bfde8c2ad1738374ee7f183701a299bfcc59958524
MD5 938db2c49f320b6d82e6270c02ffdc8b
SHA1 9dfaf16b7e79428d484b5d2fdcd68432e91bd6d0
SHA512 1b054ebc6c2561f5227493aa4efd2836984d42e60afe3f175858785450b3bf39e10275506091d6bf54ff516625a530a040fa66675c03a13d3d547a830cfd0946
SSDEEP 49152:bYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Qx4x8EVep:/ySzPIix8EVy
TLSH
T1D5066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 a8b480f2b890c7baae284b199882adebb6e73f0504bc0dffb2fcf91cce6fe88f
MD5 feb8f7f269c54d447a05a749b006ac49
SHA1 c72b8bf616a7013b203b8b1b7bd1787aa4b88464
SHA512 4481e1dc6f1988da7ec0268554c5c1664ac75b54fea5babe04a40062f051f0c0819d7003a38ee32e8b3c28d32f746b2b3deb6ce32d2b3152e370fac2af262f76
SSDEEP 24576:947Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYvyxknw4FYnshx8OfVe247:947JUQj1irIhCnDHUPfF/gx4x8EVep
TLSH
T16565AE1DA3EC01E5E1BA927885154A1AEA71742E1F31CACF1270837D6F63ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 552e93bc141c8825f2f5174c363347558c2621dccb534d693230f9378a204a9f
MD5 d877849e4420261f8f1cdfda1fd17f16
SHA1 288a3ae0d6501e19519fb29dbf72853dfb2a8010
SHA512 2477670537c07abe0d7ae3fe8e90b80012c8f16355e262ba39aed34d8cd7dd56c5f1236ee1c6a5447b5a50545114f383107ee3c7b5a9fd637f82530e9f835ff7
SSDEEP 12288:aNsfQ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:TQyxknw4FYnshx8OfVe247
TLSH
T18375F028E29842E4D06E2176CB625641B3237C6597F1D3CB97D0F13E1FB1990ADEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 93f2ab2c1206bc4b7e820bf5a08b16ca37bd3a22edb22fc9361749b744557c5d
MD5 a63b94f0571fe45e4c0cfc7896d414d8
SHA1 9b3ebd6b31c07a08f456d663fd387e91e4366af1
SHA512 bff959814304c5cf24fa080a43db54db53ec9717748d721061a0a4bc4e09365f8512e0b0a094333e69b2ea32cee6ad4e8dd59a8c4088858a67624eb222e550c4
SSDEEP 12288:jA0aU3fWa9VoQy/zodRkmMaxsJN7z2XKzbkNc//ySiM+qk1Fype:jAPUPmv/cKNC0bkS//7iM+qk10g
TLSH
T1AE3518007667C74FC66980325E32D1CCABB07D11EE456F0773C88B3F9576A59BAE6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 1383f7a25756973c2480af97d985f6b2b6dc76b1b7f4abc7cc63f111d7927ba9
MD5 abfa5f2a693fede45d051a36b295e6e3
SHA1 e54520cfd1ce5787de71dc987306f10312ae72c9
SHA512 eab7088cb22eff0dde154f7036ef26b358d9607f8c57531acb41c4a9aaf610b017141fbebe2f8bf46d3a0a5f21c47395316eddd433676c7626a8203da0d62008
SSDEEP 6144:EhyLo0i7m39OQbxWxwAIVNBgodRkmMaAH7CxYlSENvsSsgtJC7bjk08SSqtMxBSG:yjQbcyhVwodRkmMaQDHY94PRXuFsp
TLSH
T1C265F8405137A38FC2B66032072A6B8DB764EC167B456F27B388453AD86BF15A1F93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TWAIN.LOG

Path C:\Users\Admin\AppData\Local\Temp\TWAIN.LOG
Size 417B
SHA256 c6e87110dbc22d6a43ba6b92d0bf6ac32f362286c48c7281d9cd0def66d6379b
MD5 87bf8a5bb922099bf29642b6c3a4704d
SHA1 8fcd2ec7082c5c53df4ba96e9cfd1b6b4d3d44a2
SHA512 1178ba77ca3a6174eee544b413503247e47f0b6ab449d6b3b7ebd4e68f9acd8df75bab44ba545b6712706133df4b16b3db8bee13ec5a02cb0de0a975eadacd8b
TLSH
T127E0ECA7E41C207FF03BC41CD30E47B390518773D1424134F641767A752E15957268C3
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 e0ea84c507718ed3bdb8c9d2d8dd5c796f5ebc0fea46c715b94aabd28ef85f20
MD5 7690aa5bb146fd3cb44c98c3047d2c30
SHA1 2e3ffe1fee66b88492fdc7fcbc005a704d414322
SHA512 0abcafcd80b2e6fb9ea559650c2e87c7c7a379cf0f2a64e8f25bf85975efaf66caef598c124314b80c28fc5f665baf8e2149bd9115375dbaf80deb60904e9b79
SSDEEP 12288:iM7Y+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:fYyxknw4FYnshx8OfVe247
TLSH
T13675237CA7DD9892F86D11730676A231360AB5B49B70C0DBDB28B14EE0B0CD0D97E617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 af77682fc22e310cf362888ddc550931f963d6c702ed1d915d371f0acfeb90bd
MD5 214dade8e2b528e41987cbe7792317e4
SHA1 6fd3d31872748113c97e9abad3a0f7390ff09a47
SHA512 c7beaacad795a951ba28c0ff5822f3a03bd835b0df5e10a09c9b20b902720d42c3fb6daf75c7f1998eb7074cafb383486614d2076098ec4c8510368b734a6c4a
SSDEEP 24576:Qgb6bmBIi49WNNFpg1rSvFv7bYyyxknw4FYnshx8OfVe247:Qgb4mBIBhGFax4x8EVep
TLSH
T1A665AE1E22EC02F5E0FAD2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 07712c94c728165854da5dc510de822f69e6c1cb24487d01d99362b18c3ebbc5
MD5 6a9d76f22f1de55b58de24bf07d2a3e5
SHA1 54d01d9835a0a00881d97f4b94c04f56e6b5be3b
SHA512 41ad0b706311bfbdf53e655c3837e306662767b99620f12ca215c75bdf1fd8b90b099d64aaf6c5316ba12250eb323d9375e42a5187df02f8e814af8263c4d7eb
SSDEEP 24576:LG88u8FpJqH1bzria7/mfyxknw4FYnshx8OfVe247:K7ZFPqVea7/Vx4x8EVep
TLSH
T1BEA5F16877E101F1D47BD1388A924663F6B2B4250374EBDF07AC8A551F23AE44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 5aa133f49de5c923d84aed65f65b4c19518d8e04142b4785cb448962a9e0cf3d
MD5 3a7080802c75b6273d7f4e2b95cedea0
SHA1 26b8b154c3a54f7a6b11001a63a3ea7a3301e53f
SHA512 6aa98f3b2e1a49d9d6c8e2bae3eeefd2deaac7d9306eb4c22246b1d1c1874c87cecb74a068d90108c09eed176c20db128918f2348fc7f03f3f02d7a10abff469
SSDEEP 12288:JHvUrBFrEjwaQT+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:JPUr+NQTyxknw4FYnshx8OfVe247
TLSH
T16385F12E22ED18E5E67AA17D89924319F771B4621712D2CF02E0817E5E73DE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 f0b0a5fc4bf61e683f837da0dcf832430d6795a9083af388fd498c9195b61234
MD5 6327bf01b0d7a2b0192b43772b0c0fb5
SHA1 78278d20dece971f5b653d5c45a6f9d4ca1a019f
SHA512 5a5e252f4cea57bcbe9244fabee77323abc188b06813e115d504f0e39797b4813f073a209401774787b8d24ac545d12f697545860049df544cbbcfb20f7e8588
SSDEEP 49152:mBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjGx4x8EVep:JG05lO43bvix8EVy
TLSH
T173D5CF6E62EC11F9D1BBD17CDAC6460BEBB23425033556CB02A486A91F23FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6516d3165ce8cbae899ad266c560f036195830252496c024ea3b136d7023f4d3
MD5 50bf86944382b19acd78eecaa8ccdc47
SHA1 0770427a190f39149edcd619c6db9dc03c4c0077
SHA512 edf6a5a66849da69f1c86d8bf815255037621c4eb912503569663ce1b1ed29b406085b5ac7697ef6473bd29674a9218cc67143d1fd8018fee5802737e30dba3a
SSDEEP 24576:7fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnFyxknw4FYnshx8OfVe247:ja5POZ3+Jt2pasx2+m+x4x8EVep
TLSH
T14465AF5DA6FC01D5E5B9D17DC583461AF5B1342253329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ab6fe3a89e99ce8270d4b4aa203cb2a8a13079f769754bba89091357191a2259
MD5 07e3dd4fa02dd9ae7681ea2418dda762
SHA1 c153d381eb6743c979c47283b5b4dc575620e884
SHA512 e9dc001feefd55e87033224236836a88d3d57c31c2fb792aeddc6ff24be451a40f5aed59d46e5c5909a703db45efe7282cc3d4514848aac7f6230525be27b0ed
SSDEEP 24576:TNcwHdjbyQ4nLC18lb/EOjowL7FkXyxknw4FYnshx8OfVe247I:TNc/zEOVHF1x4x8EVep
TLSH
T14A857B2A23E901E4E5BBE1BE89779546FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 719f38c1dba973f8d3055c82484371c231ea147113dbdde17c22a4e2dcec5854
MD5 a362845306bd25478bda8ad57e4975ad
SHA1 0fa45628351614179b601e8c6da03a8ca40231a6
SHA512 a649463c1442e078a162b3fc4886225034aa3e43007642570c53295d48ead7dffb85ed823cabdb370084f3a9abb1017389040b47df57117734dc3f4e932fe494
SSDEEP 24576:L8kNvNnaFeYhJNtmZBmRyxknw4FYnshx8OfVe247:L8MwBtOmUx4x8EVep
TLSH
T10E55AF6EB6F846E4D1FEC6B58D238512E6727461073293CB8390C13E4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.9MB
SHA256 e2138ff658b2e3211104b74626d8b563118fdb8d40fcdc3c562f570da37f1c4c
MD5 868040ff89bb1f045256c4e98c9421eb
SHA1 d5f88b61fe5f7f8647a9f350a868a6ba75af5e40
SHA512 5a810ee9ecbb28e80cff010f0c58f18261ad944ae1f4c74248162a3d87e4ad3311e588662e5760550af6934b1946ba25e28a32a1521b91dec57492752f87d147
SSDEEP 24576:yD3FHshBIYQgAkyxknw4FYnshx8OfVe247:yDVHeBIAA/x4x8EVep
TLSH
T17495E17DE79C04E4E47AD1BC8A638606E77138A9033256CB029491BA5F67EE47D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1072-102-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1072-322-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1072-103-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1072-109-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1072-340-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1072-342-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1232-25-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/1232-32-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/1232-33-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/1232-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1232-31-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1508-92-0x0000000000980000-0x00000000009E6000-memory.dmp

Download

memory/1508-97-0x0000000000980000-0x00000000009E6000-memory.dmp

Download

memory/1508-320-0x0000000000400000-0x0000000000674000-memory.dmp

Download

memory/1508-91-0x0000000000400000-0x0000000000674000-memory.dmp

Download

memory/2232-0-0x0000000000400000-0x0000000000821000-memory.dmp

Download

memory/2232-90-0x0000000000400000-0x0000000000821000-memory.dmp

Download

memory/2232-7-0x0000000002760000-0x00000000027C6000-memory.dmp

Download

memory/2232-1-0x0000000002760000-0x00000000027C6000-memory.dmp

Download

memory/2232-6-0x0000000002760000-0x00000000027C6000-memory.dmp

Download

memory/2260-79-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/2260-306-0x0000000140000000-0x00000001402A8000-memory.dmp

Download

memory/2260-85-0x0000000140000000-0x00000001402A8000-memory.dmp

Download

memory/2260-86-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3668-147-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3668-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3668-141-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3668-152-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3668-154-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4604-46-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4604-139-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4604-38-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4604-45-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4604-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4672-121-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/4672-115-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/4672-327-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4672-114-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4672-325-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/4672-323-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5012-163-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5012-156-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5012-157-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5012-328-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5104-70-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5104-64-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5104-63-0x0000000140000000-0x00000001402AC000-memory.dmp

Download

memory/5104-201-0x0000000140000000-0x00000001402AC000-memory.dmp

Download

memory/5232-331-0x000001ACF2860000-0x000001ACF2A2A000-memory.dmp

Download

memory/5232-408-0x000001ACF2860000-0x000001ACF2A2A000-memory.dmp

Download

memory/5588-324-0x0000000140000000-0x000000014031B000-memory.dmp

Download

memory/5588-126-0x0000000140000000-0x000000014031B000-memory.dmp

Download

memory/5588-129-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/5588-135-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/6048-74-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/6048-52-0x0000000140000000-0x00000001402B2000-memory.dmp

Download

memory/6048-53-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/6048-59-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/6048-76-0x0000000140000000-0x00000001402B2000-memory.dmp

Download