f531255105465f7363737ad05b5352acef6a62f11e334cf32bf50d936abd58a7

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Size 2.1MB
Sample260818-rx4abacm4v
SHA256 f531255105465f7363737ad05b5352acef6a62f11e334cf32bf50d936abd58a7
MD5 c22216be23bf163f4c415670dc04aa76
SHA1 18003aecf286c1ff164c179fa79989b84aadd844
SHA512 8718b694b42e053b87f1ea18404c7d386ba9227eaa8c4dabcd7e39535efec5b706aa520627079d50b01406ba019efcc8df7120a4c72040b7cf995312ca444e7f
SSDEEP 49152:pETvrAVde3TBf85PxpUTcqFOciydUdlbKLKrcUonA3n97IqRbh2q9b1:pErGzqFOciuoNn97IqRbh2q9
TLSH
T16DA55B1177E95A28F5F72B71AEB841944A7B7C61AF35C6CF13801A5E3930AC09936B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
24	4376	Process not Found

Executes dropped EXE 13 IoCs

pid	Process
1072	elevation_service.exe
3400	elevation_service.exe
3444	maintenanceservice.exe
4520	OSE.EXE
5272	PerceptionSimulationService.exe
4664	perfhost.exe
2928	ReFsDedupSvc.exe
4600	SensorDataService.exe
1472	ssh-agent.exe
2356	AgentService.exe
4212	SearchIndexer.exe
3984	Reader_sl.exe
5656	RdrServicesUpdater2_x86.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe

Drops file in System32 directory 58 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b6d3eb84e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaws.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrServicesUpdater2_x86.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ef926ed91e2fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000239007d91e2fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d2bf28d91e2fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008ff9e8d91e2fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e8b21ad91e2fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005b5db5d61e2fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000053b5cd171f2fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Reader_sl.exe

Suspicious behavior: EnumeratesProcesses 51 IoCs

pid	Process
3436	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3436	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3436	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3436	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3436	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3436	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3436	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3436	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3436	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3436	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3436	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3436	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3436	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3436	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3436	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3436	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3436	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3436	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3436	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3436	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3436	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3436	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3436	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3436	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3436	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3436	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3436	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3436	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
5656	RdrServicesUpdater2_x86.exe
5656	RdrServicesUpdater2_x86.exe
5656	RdrServicesUpdater2_x86.exe
5656	RdrServicesUpdater2_x86.exe
5656	RdrServicesUpdater2_x86.exe
5656	RdrServicesUpdater2_x86.exe
5656	RdrServicesUpdater2_x86.exe
5656	RdrServicesUpdater2_x86.exe
5656	RdrServicesUpdater2_x86.exe
5656	RdrServicesUpdater2_x86.exe
5656	RdrServicesUpdater2_x86.exe
5656	RdrServicesUpdater2_x86.exe
5656	RdrServicesUpdater2_x86.exe
5656	RdrServicesUpdater2_x86.exe
5656	RdrServicesUpdater2_x86.exe
5656	RdrServicesUpdater2_x86.exe
1072	elevation_service.exe
1072	elevation_service.exe
1072	elevation_service.exe
1072	elevation_service.exe
1072	elevation_service.exe
1072	elevation_service.exe
1072	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3436	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeBackupPrivilege	2928	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2928	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2928	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2928	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2928	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2928	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2928	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2928	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2928	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2928	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2356	AgentService.exe
Token: 33	4212	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4212	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4212	SearchIndexer.exe
Token: SeDebugPrivilege	3436	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	3436	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	3436	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	3436	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	1072	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3436	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3436	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4212 wrote to memory of 3484	4212	SearchIndexer.exe	102
PID 4212 wrote to memory of 2556	4212	SearchIndexer.exe	103
PID 4212 wrote to memory of 1208	4212	SearchIndexer.exe	104
PID 4212 wrote to memory of 4692	4212	SearchIndexer.exe	105
PID 3436 wrote to memory of 3984	3436	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe	107
PID 3436 wrote to memory of 5656	3436	2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe	108
PID 4212 wrote to memory of 5740	4212	SearchIndexer.exe	109
PID 4212 wrote to memory of 2760	4212	SearchIndexer.exe	110
PID 4212 wrote to memory of 2540	4212	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_c22216be23bf163f4c415670dc04aa76_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:3984
- C:\Program Files (x86)\Common Files\Adobe\ARM\Execute\14161\RdrServicesUpdater2_x86.exe
  "C:\Program Files (x86)\Common Files\Adobe\ARM\Execute\14161\RdrServicesUpdater2_x86.exe" R32
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5656

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1072

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:3400

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3444

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4520

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5272

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4664

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2928

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4600

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1472

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2356

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4212
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3484
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2556
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2756 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1208
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2920 2932 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4692
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5740
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2920 2932 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2760
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2756 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
Size 1.4MB
SHA256 998c51d10b79db39f5abb2c7d6cf897e780d8a539ce4d0ac0498d5f0bde6a410
MD5 a08e2e8b60e6a019d3eee9d81d18b74a
SHA1 f212db354aa1b37cd9491f670e9d9a3cf4ac9604
SHA512 99a68c4a40ccf8e9015162f564fa6074fec134244b979c5770d9b65ef4df76901d395311a5700364eeba1ee87ebac49ac8a777bebf17eab60f435c96af33c1ba
SSDEEP 12288:oF0Y7wkGWCyiAjr7psiIqH+Mh4kbqD5FSTSlKhOPICqND4g/3l+:G0RA3n7psiIqHx2kbqDrXKhQpqNDb1+
TLSH
T142651243758B6BA2D99289B274E99B98D0BED830EF6427A36356175B0CFC5C00D3219F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
Size 1.7MB
SHA256 152c9ca807df7c1e33b1a964a56687d97e32810bd237590d4dc22b2107bb5c5b
MD5 f4a735f502afb9de3d1eeceb6e99ea5b
SHA1 8fdc452c6a5bca41e2ec83290378ade6c82f7585
SHA512 adc25c893a2f25a53d5d7d75db8577020074e7a34fe46ef49208901f249184e480d004ed61eb42e774d8c057c0245ac8b8a7c9f1ea180d3dfbb238487328cee0
SSDEEP 49152:2SgouvAeFfenxyQRXS7uQ0NIvA3n97IqRbh2q9b1:2S1uxaxdS7u/n97IqRbh2q9
TLSH
T154855A0267F94129F1F37B71EEB993645A77BCB1AE39C50E5284025E0DB4A909E32733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
Size 1.8MB
SHA256 604604110b5e72b9b1e8bb9f90112beedfc00dc4ba257493b5118a8f06f0007b
MD5 ce66e619b188b022113a6325b5bc61ac
SHA1 2581a3441e6fd915f05cc3cc5d1a373642db1ac8
SHA512 103ecacff528028661eaa3ab3d09f31e4a1210f3cb3e42c3a09eb74a94730cbe986715bd69ad315e4d9a9a1ffb538f062ad1e784dbff207e6766f459e055090d
SSDEEP 24576:iITAbD+OmetA3n7psiIqHx2kbqDrXKhQpqNDb1+:VTAGOmetA3n97IqRbh2q9b1
TLSH
T19B85E01077C1C135F1F329768ABFD724546DB8715F6842CFA3881A6E5EB0AE0AA3171B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdrServicesUpdater2_x86.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\Execute\14161\RdrServicesUpdater2_x86.exe
Size 846KB
SHA256 6a142c879a0676aef5c825d6fd6336800846167fab422d0f912096d286aa0070
MD5 a447c3cf3b7547e5a1e12dbb92d8c052
SHA1 d2b246eda6302534b21b2003719d9f911d0c77d3
SHA512 ce7446e337cc13a560a12b0b789813bfb5a96a6a9d25a8b3e2fc1ed884f0c4950f01937714614666befb9b92123d359b9597116e9ed9e8efd46b77a640d002ea
SSDEEP 24576:uSU4vrTQA/gK/c8DV5Wa1ZmPEKBLeiGA5nEJ:uP4j5gKU83W3FLeilVEJ
TLSH
T10C059E22EAD18073D563143102A66F368EBEB9310971D98FA3D41A4E5E705E1BB3F397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9730729e88c698f2511554e216e360e4a997b468b8b5de35b75b70fe82609889
MD5 fa9b6fddae6df786be46c58299ac1d50
SHA1 96c6a565dffd628ec932230559333e472ab756e0
SHA512 b94aea5ea42e2d07a967ba2d351bf4ceb580851b1d06a1c37c090b356d40704ee42fb5eb3511427bfb7567aa09b213a7ca06c4f04953c864fcdd6866e8c87fe0
SSDEEP 49152:Ib+632BuPkFKRrdE6ohQstBhuXjfS4LWxnvA3n97IqRbh2q9b1:i3q6tjBjn97IqRbh2q9
TLSH
T149D58C03F2D900E9E06AD178D7469132E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 79e38cc0e8919c283ee73a6ed2739455fa4df1acc489ee85a169ee26939b271b
MD5 f6bedba5d7da5c03471dca885112cc74
SHA1 08e3b550361cc43c41538795a76a0546b1233305
SHA512 b1ece364845125420e2a4d3ebf151f0432dca778f6b8bc86e2de50323a962b62f5f9780993160fdc036ba49608ccace0df6a9d78f5f59b0e111dd7b0d5294905
SSDEEP 24576:eXYfDtczA8A3n7psiIqHx2kbqDrXKhQpqNDb1+:9tchA3n97IqRbh2q9b1
TLSH
T16675012873D509F9ED67817DD8A2C501E633B8658770E79703A48A661F337C84E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 545768bec921e682cacea32e5de99016a1e3e8ae72f65ddd7038cfe9883578ac
MD5 f3c9c25452668e038886daecf6bf1d91
SHA1 d891233fd2efbe92c36b638a0bcb724af4d212de
SHA512 775256fe08b7b10ab4a762e8f23855490418a838878e7cc55d90f3c98707a89c1462798f4bfe3617488873cf28991f1e5ab4d17ca36da099a910d19ddc3b67e1
SSDEEP 24576:V0Le5ji0hmxnrMXA3n7psiIqHx2kbqDrXKhQpqNDb1+:VPji0AxSA3n97IqRbh2q9b1
TLSH
T1EC959E16F5788371D073C0B9C5D2A68EE97230865B308AC74286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f1076b65b353cef3001f1a35d0b8ca00b46702104b6bc5d4f2b35ca5b7f8e7c5
MD5 3ebcebd2986106c9bd8efa995c755a0e
SHA1 274fe82cac751fef1916b70696535a924cad332c
SHA512 cef9d172b2390d5bebc14718decf81e13400fa12e6310da83dba89988067e2b339f59dd96745722cfecfb802994cd773e3990104689dc1ab923e403b384bbca8
SSDEEP 24576:Ia7/ezSC6vUyDZaqgrvWx6q8wyuRA3n7psiIqHx2kbqDrXKhQpqNDb1+:P/ezSC6vURPvMHjyeA3n97IqRbh2q9b1
TLSH
T16F756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 907b6b5a05126dd6735748a067e86fa56285ef93f12bcbafdcdb7ce42b001c06
MD5 ab45d2f95f9fa8c8bfbf1725801234cc
SHA1 0dbd1fe2208d353ae7962885744d1e6f9e62f6ca
SHA512 5187cc2157d792093d7c59239da0bd49c60457321023a4848fc5064c8fc4c6e8cb41a44b2e616a3c571822bb5d8da3188b39a7c8433ac3d032268559c0565ad6
SSDEEP 24576:lVbqPb88hv/lV7gA3n7psiIqHx2kbqDrXKhQpqNDb1+:lVO88hXlV0A3n97IqRbh2q9b1
TLSH
T15E559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 6234117b3621f0401b8c2547f172d1c07bf4e35a5edf91a65ad734a51f4c12cf
MD5 b96d979c6748bc040664f1deca76e342
SHA1 cfb43ef9cb82bc2341f3243e0ed17947631dce88
SHA512 eefc8072632a0403cb4d4b7fe3968e75f82c7c63161e1fddd9ecff92e1f1bb9a40ebe97a395ab2bc568d87a87153b3688efebf0ed6bd934c08ee83c2767a0e59
SSDEEP 12288:zGy7wkGWCyiAjr7psiIqH+Mh4kbqD5FSTSlKhOPICqND4g/3l+:zGrA3n7psiIqHx2kbqDrXKhQpqNDb1+
TLSH
T1B4652380A08F36E1D7E799B2F0F59944D465AC75EEB0272352663B961CBCAC08D371D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 cd5eb81099d73902c25c4c8b937fc7dca0dd06100198825fe83981e060b77735
MD5 84090fb62728369781a9f67c615844d7
SHA1 9d2b5000317eab41171805cfa1cffec04d1126f9
SHA512 be2540dcba550c252a2a65a73729ecb4e20185dbb3138e95315a87bd977fc41e991ca03dd51f6d902578d44d19a06526a6f2e0f2f347c539a37006b234bf033a
SSDEEP 24576:SJIUoA3n7psiIqHx2kbqDrXKhQpqNDb1+:SJIUoA3n97IqRbh2q9b1
TLSH
T1B375CF7BED28FCE2C27A9DB96691C600D77278708F61A3C7D165830E9E235D04E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6c49d8f643fcece0d4e7614a84054f4219ac9982be2768b6e774de3cded19e92
MD5 6d9ec05c5d4804d7cb0471c7c9082afd
SHA1 b977a07658986e40e2b37c46687a7d193b4b93d9
SHA512 09f2d35b7b8124bdeb4905158ad8755647a654a3523f3661af150610627c89a0d98b9a5e4640e5eb24378b9e7d884ab938c9acf3736d82fe7a55ce07e39d9177
SSDEEP 49152:iQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3TH7:iQvGAdlCEL8c/pRNw5Cen97IqRbh2q9
TLSH
T190267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 51e2cf5465f7730ca1cb8f42333fcf548b31040f68fe61821493ef3fd5d1afb4
MD5 f7d433f6553be38c8faad514208331db
SHA1 c5ba75dc48a95a63dd0c08aa9343fc2c71167a51
SHA512 2d14a1da4c0b466c6b098f01cc9aa9da491bfe018566243e58de6db4358abebb877e301f5adacd87214b2d02fbd982bb495701ec0c5efa546e40e9a0deb8818d
SSDEEP 24576:owewsAjCA3n7psiIqHx2kbqDrXKhQpqNDb1+:xljCA3n97IqRbh2q9b1
TLSH
T18D85E031FA75E032C3BB0DB22B76C706547DB9208F611AC3E3A84E9E59742C21776A57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 36bfc21029deeddade999a9c9a29abe5c74ccaa7fee613448296af05345159d9
MD5 f807f460715800730564876360d6d116
SHA1 dbf277f878099b9cfa4df0b15a5e05c4b7e0281e
SHA512 913a0c3b9f3037bac5cbbfa3da6fc2a3088c3c6ea4dd18c7e126063d0959f89bd43840063f72c064b440213909c5b4199586895a06f08b90d3d7d8ff23cd5bd5
SSDEEP 196608:XUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJH190Qbht9:XUEtQevvqc2W1cpV29I3219F
TLSH
T1AE474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 325113d8d9536450e73d2e483965efa5ca58818e217d6c44a3ba6bf16f35e1b0
MD5 4297533ed66e2e19efdcb69c78b39764
SHA1 6aca380447119e36f3b6d5accc158c7fc2eb5c62
SHA512 86b1c188a8c3d2b6b90d2ae92c9167b6a1db0b0db0bdf80e433df846b332999935fb3e32f6c7ba7df6182eff5d4cd55ce65dc9ac357a8e03da6f08a4c201541e
SSDEEP 49152:gCbRquA/m2yL5zLfFiV+XenmE3/ziA3n97IqRbh2q9b1:poq2VjnmKn97IqRbh2q9
TLSH
T1D0D58D0976B8C2E4D1F6C77896A2C647F37178154B30A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d0743796594f08381dbb9681181f922e4b28e64804b2b080db9fba703a2c2143
MD5 663b9bb6f1c38944d41dad4edb261315
SHA1 bec17dcc1de291f225d222292fab04496da714a0
SHA512 21b46fc64a87217b82333b9d3d205885bac85e517dab5b38c8bc7724c26c0d5e5a9a4e1bf96e7d2e4c1775560ac2d735c5f92567f89f5dde779449a839ddd016
SSDEEP 24576:wAhGLmIFoiwtA5l7S53dA3n7psiIqHx2kbqDrXKhQpqNDb1+:wAM1Foiq5tA3n97IqRbh2q9b1
TLSH
T12B359D81E7F955D4F5B3AAB8A9B69570EA76BCA65E30C20F2150D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 58a7d49f3610874cef35c8d841c22e24a672f20b3e41e50080a4e04f8819e213
MD5 0fd98d1d82ff0b0e062c7446920202b9
SHA1 ff5567def382861048c22e825d03756b7e3abf67
SHA512 1a3232f8b81448348c777df3db9d7d495460d84026107bd2ecb3fa92efe599092cbb7adf1f43e22c7f9b1f62fd24032c4a21e007367a32a4f2c2cfcc45b1ba8f
SSDEEP 24576:LwuXOW+A3n7psiIqHx2kbqDrXKhQpqNDb1+:LwQOZA3n97IqRbh2q9b1
TLSH
T15C75F14572A91CF9E9A78639C597C136F7F2B8122A309B1B0360C75B6F37350AD2E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 ce8a8a160a49271a3b4fb9b68ec483f06ed5960fe188c480082b0373e5044cda
MD5 924558e16b15f4e564f07ca3445163b7
SHA1 a7ac4661af4fb97e4d7d69a48027231b3fe51f61
SHA512 b7ce4f80d528e6c6b394d237d5b241d197229ff792ee44b686ba74eff367b4913a9801967cdea7a3076b888f335610f7fd23d79a0115b172000adf8298ebc892
SSDEEP 24576:QZufA3n7psiIqHx2kbqDrXKhQpqNDb1+:RA3n97IqRbh2q9b1
TLSH
T15765128532D931F5D2A39679E8F18A05D3B27476AB7103CF126507AA1F77AC10E3A363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c8190a26dd591664adadcb68d3b9035a891c2d19f6912706f70b375d307947d1
MD5 34fc4c772a7f04bd5fde24613489891f
SHA1 acac80fa4d89d887926da7399a83edc684d3a8cf
SHA512 4c45243baec229eb65eba21c53202f5f32d77d32e416f79af2d767747a2beec8c438e0678305a898e3c87ba6b88ed28707fc450eda31e1a1fb351cc6a9da82ee
SSDEEP 98304:XQRQyi36YOcPuLvw2gAf+PN33n97IqRbh2q9:GQyiKakX+PNH90Qbht9
TLSH
T173667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e6c1ce33a149420c38ddf7824af1f94069849f8bf2981e630c1a377255cde686
MD5 06a3d475a7fa1dc29a9329e3e396d65f
SHA1 ccb2f555f17ec421f1aa4e6970d6b62c84401e58
SHA512 9541baf2312b5f5c03fa6f57e05510e5ba32ddc2a14384349777063970adabb8b56d1f6467abec6d25dfeba9ebe19d685bae6f38b58af52614c7c43fc5221a86
SSDEEP 98304:KQRQyi36YOcPuLvw2gAf+PN33n97IqRbh2q9:hQyiKakX+PNH90Qbht9
TLSH
T1EA667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 250a95ff0522e532ef9877a5ae1b21cc0d5c1f6cdba7beeeeab6dbc96322cd96
MD5 9ed25c3447605de29aeee28f9b7ab874
SHA1 e83da01eec3916812a884a3f580c3a7304281ba5
SHA512 dc066e9e2138dbf405a5976b3b76954da60dbea6bd762c7130d2be27fdec9b7f842fc1839f582df1a013ac3b93f54174fc40a393be185b9b34cf87ad7491e5e9
SSDEEP 49152:+68Qg55nhxeWu7PNU3/SA3n97IqRbh2q9b1:MthGRc/9n97IqRbh2q9
TLSH
T1AAB54933B2F600A9C44DE1769F4A872196D27C75CFE0E3DB851572061FB2AD06B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 517b06c19160b969deb706c743ca0b1dd96ea3b2daea5fd00e4d854eeaba5311
MD5 edddfd57538df4a15495cce6a93309ee
SHA1 6b9a12146774dcfa6912338cab429338ad2e4b1c
SHA512 01bcc66c0c028b5a4b47955ad40c648e4f3b0306983dc707cca5fb0d402dc12164709dd14ab5390520a1d93f01d23287db07bdbf6ca4e2c3020dd12427d0a747
SSDEEP 98304:7y5112gYy5azzVvD69nLKnhZwn97IqRbh2q9:WLIH+WhU90Qbht9
TLSH
T10F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ff1f36ca6cbd5254486140829b4fa543560eed613b6d581070116bcd5a3e9b7a
MD5 4ce78031f1bb86a330954bc89fb9a22e
SHA1 d64dc0ae01b6bdb811870a92969852b5c9e65ec3
SHA512 002554fe75af99602b8d9a90861e21d46a30e6c95deb791f5f17e9c95d9760b31741c93bb9254482e93a036fafe634b7ba206190f86e686982d7260ba9ccc7c2
SSDEEP 49152:oB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glMA3n97IqRbh2q9b1:iu6JmQxd2dfn97IqRbh2q9
TLSH
T126D59D13F1DA01E8D06ED478974A9233EA62BC490B34B6EF0A9073562E77EE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4ebb075b976cd440493b5f120971b0abb245cbb34588917a8bc768a82f96d1fd
MD5 2070038fc03dc3e3d34cf8cd492a2a16
SHA1 926c860097eeff37845e2fc683383a95a789ef54
SHA512 fbad95cc665878a8d2f94875b53f02d01895400c0355389d1fe75d836251a9f1f65bfbc687e27379ccca9a4d86dfc85fb8b4430d13ae39c620e5f15064d573c4
SSDEEP 49152:e1hpsNoJpF1A6yU44CwH7R4xIA3n97IqRbh2q9b1:emifPVRKn97IqRbh2q9
TLSH
T153B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5b32dcc3851ff37c0340ba46e707050c884472fcd3e47aa5b9e9c989adad9dc3
MD5 fc0f1cb106174c4a437cc57087f09dbe
SHA1 44e927ce45d3cf48d01fce74c4abef1af9e8287c
SHA512 4d9d2107bb36a3f208be37500a73bda34bbcd6c7e6e6f46c2cae626e55197bef60371feec3fae7efddfc73dc5fa222f72e257c8b2c590a9b70528627071fae74
SSDEEP 49152:BSuZQIY0Be2KIRVtOnks6NMHqfA3n97IqRbh2q9b1:P5dKOi61Un97IqRbh2q9
TLSH
T186C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 58cc53ca402a4ce01a98f74f4e6e27f297a1bd9f824bffb397f96ee645e8a02c
MD5 119e0ebc17e6370bb2622b8afcb8b77f
SHA1 cdc6bb7dba5539618214462a4aab9babebdc4dff
SHA512 bca3fa6be13ec5ff1cf9cd40d8fd194acb5da24da8d5f2dbf41e2eb9dd088b83164f5b5b93ef565d83ab2a258e03d1d7eb771f7aecd5b366ef2783156f219e96
SSDEEP 49152:9htSn8EApI0figGgiDn0AP5w8A3n97IqRbh2q9b1:sX2i/ph2n97IqRbh2q9
TLSH
T1A295BE13F2D901E8D05ED178C7568632E962BC160B34BAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 a279ea27aaedb157e124a63cc58efc8596108624ed8da3a9c4e5fc8df40905c6
MD5 26de60da9c6ef4e1c6ce4b58ee9b256c
SHA1 4407d78b2bdd401c254fe45f2f215413aebb5549
SHA512 041efe61652de2043d7aea037efd73dfb0ba3296dda4644c4736689616b16c9e37ccbd0962647977a6cfad5d875a5687df716b1a696ed5371f822631c19bcebb
SSDEEP 12288:N67wkGWCyiAjr7psiIqH+Mh4kbqD5FSTSlKhOPICqND4g/3l+:NTA3n7psiIqHx2kbqDrXKhQpqNDb1+
TLSH
T159652380B08F36E6D69799B2F0E58544D469687AFEB02363636B17521DFDAC00E3B1D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 cfadd870e84553dc729224548b9386bcf5aa7ab556a3992fa4308b719e960261
MD5 2f8a0f17611c343b3d9b776e306b0a40
SHA1 ac71b9a8b82377b4985ab77bcf712dd93e577549
SHA512 50206c42636735f57be771fee5a5a382502ca850622ac8d692a6b92a0da5a0a934477178477ac50b6f74bba0fe6b4edf6066d57251224aeee5f633da26b73396
SSDEEP 12288:1z7wkGWCyiAjr7psiIqH+Mh4kbqD5FSTSlKhOPICqND4g/3l+:12A3n7psiIqHx2kbqDrXKhQpqNDb1+
TLSH
T106652380B08F36E6D69799B2F0E58544D469A87AFEB01363636B17521DFCAC00E3B1D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 d2a3f0685a8cec0f2b00cd8daee7b71cfa280d9ec3bfb425a0fdf7d9cdea6e24
MD5 dce9286c2e976705b3a4b377a8f746b0
SHA1 431a49b8e897044030d2b011dfcd2db4cad103a9
SHA512 643ccf0f6c9c66e1578f69533a3f512ebb52a9b5ae52f25d50828f7c681b8ea401902ffb258cf29d12c39a9da026686cafe9063ae024c5749f62d2ad40671e9a
SSDEEP 12288:ct7wkGWCyiAjr7psiIqH+Mh4kbqD5FSTSlKhOPICqND4g/3l+:cwA3n7psiIqHx2kbqDrXKhQpqNDb1+
TLSH
T1FD652380B08F36E6D69799B2F0E68544D469687AFEB01363636B17561DFCAC00E3B1D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 320e0739f254cf8b3c90abe2dbcab043de3c4dc5c7e0e9a563beb248320c5773
MD5 836d6f9987de7e448060f1d90a3eff2f
SHA1 9eb86bb2571c65044f79ee656bcc37229b339215
SHA512 601366930a9e23c40dd87aecf4dba4b0b987dccd8ddd84d53bd19dd93bad9eb2d837fce63744e4b6c4f740fcb7e86e2c178dac541c8fe2f0cedf30c27a6a2e8a
SSDEEP 12288:qV87wkGWCyiAjr7psiIqH+Mh4kbqD5FSTSlKhOPICqND4g/3l+:GA3n7psiIqHx2kbqDrXKhQpqNDb1+
TLSH
T1C9652381708F22E1D5A3EAB6F4F28540D1B6BCB9FB7027A753160A561DB5BC00D3A6D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 815ace811789a1d9aae55e2ab317cfbb4ad99b8dd00495af70b4f23a8fa1c584
MD5 a185d083cb3c1ce6e91164e0fce62bac
SHA1 e36c67d57ec832d0ed19396bdde681eaf89df999
SHA512 bbc61dacaf631893eebeb3b8469abb982ae827a12b1e2569ba010d39f8d47565cdf58c8799db5bd4e2cd78157d5a4175952dbb43b47afb39501348ae379270cb
SSDEEP 12288:jU7wkGWCyiAjr7psiIqH+Mh4kbqD5FSTSlKhOPICqND4g/3l+:j1A3n7psiIqHx2kbqDrXKhQpqNDb1+
TLSH
T162652380B08F36E5D69799B2F0E68584D469687AFEB01363636B17521DFDAC00E3B1D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 668d59473d1dc59777c1723c405f4a4554b5088b64e3f8a33435ccde765c2952
MD5 952371018a6ea08311ab62c79f4e5dcd
SHA1 953d7756d62757f8f790070d6f6b98973cdf557a
SHA512 390d46ac452610da03fa73abe4e4af916218be93340afbbb109910b95834d18e8b5f325fd8bce986023f0c69258fbe0bfc8a24145994f7c2f1fcfbd9714afcbb
SSDEEP 12288:Qf7wkGWCyiAjr7psiIqH+Mh4kbqD5FSTSlKhOPICqND4g/3l+:QKA3n7psiIqHx2kbqDrXKhQpqNDb1+
TLSH
T13B652380B08F36E6D69799B2F0E58544D469787AFEB02363636B17521DFDAC00E3A1D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 905ae957b8bee29ddfa53364700276ef909ef52d5bcfdb554909a308cc0b3aff
MD5 cd8520330f9732c3d447da425fadc0e3
SHA1 081ab4bcdfa8f8930116d4e4fd83e70594a3b61e
SHA512 552f574b275718a2d2871b2780ab69b6c19d3c315812fa4defbacc0923800814f7e81e5ee4575e7d9b87fe01ba0b7f3d7cc216e6306bad463082bcc0f61f6f02
SSDEEP 12288:sL7wkGWCyiAjr7psiIqH+Mh4kbqD5FSTSlKhOPICqND4g/3l+:sOA3n7psiIqHx2kbqDrXKhQpqNDb1+
TLSH
T142652380B08F36E6D69799B2F0E58544C469787AFEB42363636B17522DFCAC00D3A1D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 e0f6225e0f36ca5cdbcc60dd03cb7d5ef647be526e85bd192a85c26a4a8007c6
MD5 658439a61978537fc0c309487c1e59d4
SHA1 1633c1f2a57631aad3a5defaa0ead0870f74b6c7
SHA512 86a141a88a1af618f16040bea16e4c1ef8b97a5eb06bda5855ed29882a6307a9641715808389e630a5c1fcb0348bed704aed33121fab0343485620417019a505
SSDEEP 24576:uZMJzFVSOWA3n7psiIqHx2kbqDrXKhQpqNDb1+:uZMJzf6A3n97IqRbh2q9b1
TLSH
T18E850194B29518F4ECA7813EC8658906D2B27C6A5B70C71F13B836671F773900D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 e5afeef1283b0ff6db3f93edf220a5ebdbbd8d03a63d16478c3aa4ea9ccbd4f2
MD5 dbf65a6db975029ef29b27e0134a8841
SHA1 b6ce3b94cc677fe7991de8f63bcc8a5cf5540cdd
SHA512 93bb2aa38fd3b1c869ed5055da06b00d46ee28512a5bc9dc621bb600c046d0280f1b6aa53d4114bc24aaa46b3e594f5ad274d9ad7c4ae72112e8feb079633b05
SSDEEP 12288:MO7wkGWCyiAjr7psiIqH+Mh4kbqD5FSTSlKhOPICqND4g/3l+:MPA3n7psiIqHx2kbqDrXKhQpqNDb1+
TLSH
T106652380B08F36E5D69799B6F0E58544C469A87AFEB02363636B17561DFCAC00E3B1D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 ce28e0590eff8c9c10d6b4169be4e79be46f6e9bbf82ed288a438b89a4826e56
MD5 07bbd97a62030ca77073d3af3cf3dee3
SHA1 a82d82d1cb191f08d1641bd169352b135b3054f3
SHA512 4fe57f3dfae00d5896a89386a6d770f0982bf1d92cca9272d60a5714eb490e7bb9ee410ec5f6cf85da96c91f6cf3380c33f7cf409ef192dd7693d08a20a97094
SSDEEP 12288:rC7wkGWCyiAjr7psiIqH+Mh4kbqD5FSTSlKhOPICqND4g/3l+:rbA3n7psiIqHx2kbqDrXKhQpqNDb1+
TLSH
T198652380708F36E5D69799B6F0E58544C469A87AFEB02363636F17562DFCAC00E3A1D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 5dc7006a8f310513f4b546c086ff5e16596437d2bcc7581e640d4a060b91eab2
MD5 79729afbb17f057758a409ed354b7c80
SHA1 8c44ae3b5ecf40083b97d0a37bb46129e94e41ac
SHA512 bb056ecb0cff3c79ad9f5614a89b37a71456f6821323e944b75567e8297d9b2e97aab79daf04d8321aec0a4f0836ba430b424a81437fd4b3be87c057be35f81c
SSDEEP 24576:jzyyA3n7psiIqHx2kbqDrXKhQpqNDb1+:j5A3n97IqRbh2q9b1
TLSH
T14B750247729630F9D1779279D8A20A01F376B8369B304BAF136407762E776C04E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 c7d905730183b5a2c928d3547b4cac594ec9306428b000c61b4fa50b585906f3
MD5 a09413db0e893a7cb3f43d0763d73beb
SHA1 f825b103b9e0ae7dfab87520b453d58a25e35602
SHA512 1410a666beb3daa7b20af800ada9a599571aa4666dd5854fecd765ab368f2375cabe296c8175db64768c6ddfa8aa2146db3b06b560ee984d3a686347714b5646
SSDEEP 12288:dO7wkGWCyiAjr7psiIqH+Mh4kbqD5FSTSlKhOPICqND4g/3l+:dPA3n7psiIqHx2kbqDrXKhQpqNDb1+
TLSH
T131652380B08F36E5D69799B6F0E58584C469687AFEB02363636B17561DFCAC00E3B1D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 252475139a08566d67a365a52f417cd9e872c1b6a7443b1c00559bef726b60bf
MD5 bcbf8a3a5fa5c40d5b65cf89b3cb9708
SHA1 e6f152995f37c0427c307681d9ea8c6e65b4f812
SHA512 a4b0d8c2cd9c45ff8e0c9dfd22db52d129727c60753ee5ab30ca4b7b2fbfb36be78a9803d53026c1f24254b6f7a2bff209393c7ca91a26fdb593e927234d0b68
SSDEEP 12288:gO7wkGWCyiAjr7psiIqH+Mh4kbqD5FSTSlKhOPICqND4g/3l+:gPA3n7psiIqHx2kbqDrXKhQpqNDb1+
TLSH
T19E652380B08F36E5D69799B6F0E58544C469A87AFEB02363636B17561DFCAC00E3B1D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 19713ee42a6185b37ed929c9d4961fe16c184832b6a04eef9c0b06962a7c8ee9
MD5 5be8e4c310429bc08ec582c71dd20b91
SHA1 f829f8718dafb6e836a62da2828dbfaa0882ac19
SHA512 199d0e0f1cdcb127af0bcdbc11f0c5661f71df294cd4e8bb3a5f6232ac149af34c472820751481b0b5267f35b088aad7bf4870df7154ede852ef1464ccfe974f
SSDEEP 24576:+zyyA3n7psiIqHx2kbqDrXKhQpqNDb1+:+5A3n97IqRbh2q9b1
TLSH
T1DA750247729630F9D1779279D8A24A01F376B8369B304BAF136407762E776C04E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 ba2ef648eeef70b046abdb43001e240d607c82dee9bb7aca399d9a9be77082fa
MD5 1f0de090855e20801564de4f4b2c394e
SHA1 19578273474bcaf477e49921e8bfa07ad0dec79d
SHA512 13a03cd8bf5e75b79a2edc006d5baa806cc9649e7b6abf3953d9a8d487167057c832f3e13668100fa38a10fbcf755f2cf5aa93c5e4f3920e34efc0268bd72274
SSDEEP 24576:ETuaLl3z0zDAA3n7psiIqHx2kbqDrXKhQpqNDb1+:ETdLljRA3n97IqRbh2q9b1
TLSH
T1C9850194B29518F8ECA7817EC8658906D2B27C6A5B70C71F03B836671F773900D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 e71102cda2ddad4a7dced6b44c8b5d69d619743c7030df5cd610395cce7fb776
MD5 0cc72650b101a50286510f332de42052
SHA1 8bb56eb64cfd0093482763845643512f01d7f7bd
SHA512 cb7235011181b9d0f699b53301ca3a902a8aa0a86c18c1f064b58c018ddc33e5bd4350d99108bc64d4634f75f8e0da9e5d83cffe2fc4a066d2d4b1058ec43efc
SSDEEP 24576:z3xd9CHKy7GZkA3n7psiIqHx2kbqDrXKhQpqNDb1+:Txd9CHKya6A3n97IqRbh2q9b1
TLSH
T16F95CF90F3E810E4F1B79A35D9764501DAB67C6A5B31DA8F03A4261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 a9041f2b03d5c93c6fa128261615407c11578f431b310d6123ba6a78ce53e03a
MD5 5bffc68b3d76e6d0af001fc223ceb6a9
SHA1 a1450971808466fc6f15c32d2fe39cabf3e65d72
SHA512 e9944a546fc1da52a493f0b12b0c9d04cdd31172022c940f100c227ee4761a445bd8e3762624a2ea3c73af8d915fe8bd8ef4afa7bf61e28fc78387551966bd69
SSDEEP 12288:DN7wkGWCyiAjr7psiIqH+Mh4kbqD5FSTSlKhOPICqND4g/3l+:DQA3n7psiIqHx2kbqDrXKhQpqNDb1+
TLSH
T149652380B08F36E5D69799B2F0E68584D469687AFEB01363636B17521DFDAC00E3B1D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 504039697f5171b232e1da24ed0a71e99c4aeca90dfcd6d21c84d369e1c942f2
MD5 30463caa4a5674136de2301d67fc9f94
SHA1 03ebee7477ef3e41546aab6c3216ae2891afd2f8
SHA512 c19e0deb0e1e4caf690b1a58320b74a26837ab0727e89e71556be990dda3ff12950566fce695e217fc6afde1707dd320f5297fda821264e7feb456a9d353a627
SSDEEP 12288:oH7wkGWCyiAjr7psiIqH+Mh4kbqD5FSTSlKhOPICqND4g/3l+:oSA3n7psiIqHx2kbqDrXKhQpqNDb1+
TLSH
T1D6652380708F36E6D69799F6F0E68544D469787AFEB02363636B16521DFCAC00E3A1D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 20a3a947fb1e3e55946545e48bcdb6481b6dc5417b43460e7076c33cd7013b35
MD5 70afbcf9b53dc0c496c41ec3dba8593b
SHA1 8d314ce08df6d7762e345129375dd3ed8f5cb9f2
SHA512 97f9f94fe0e379f5c5f3585be70348119303b837dd46bce1252bab70b9a9ac95aeb1c8100a511e76c436ffb8bf0a2f117bc1d1da232ab506b652e624e4d6ecf3
SSDEEP 12288:Ww7wkGWCyiAjr7psiIqH+Mh4kbqD5FSTSlKhOPICqND4g/3l+:WpA3n7psiIqHx2kbqDrXKhQpqNDb1+
TLSH
T154652380708F36E5D69799B6F0E58544C4A9787AFEB02363636B17561DFCAC00E3A0D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 b2cce0ffa6bdfd192c8015a7e88636803ce564339ad3d887aabd79bf5178097b
MD5 833f7841474a01604a52d6f6ddc0b601
SHA1 bf711a2fb823d3f6e9070616fd3c57ca1ea60ad0
SHA512 bc86d3d196223041f45ff33382218dbfd0f19d94238e082ad758dde19f53c13b0a1f49f67b6301d3a44ba6c5a3014f8d5e39cc572dc0714da6109ba2ef8c0c62
SSDEEP 24576:EfwvOk9RX6wkyAILA3n7psiIqHx2kbqDrXKhQpqNDb1+:qMnYILA3n97IqRbh2q9b1
TLSH
T1E095D029EADC04E5E1B7913C99F3460AF2B178695B31C2CF025A536E0E37ED45D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 c5686065d7fc42af5fe8bc64d53c7371834fb205521cffb350c18b9d80c7ff62
MD5 01f5267027504a139b3824f6cde11931
SHA1 ca794cea2b7aa028721f547c5ff1fca334afd732
SHA512 cababd72cf4539d2561bbf66139a7d7f015a3fcb9a3e255fa0d207d497f2c8ebf0be8fc20c024c7843408e03a1944532e6fdcd1652cf0c827cf389b1e481083d
SSDEEP 49152:YYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0cA3n97IqRbh2+:EySzPXn97IqRbh2q9
TLSH
T15E066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 5c880d74eda0f0ae08b9f00599df8ba078bf2f8e717604b3706a45ae3eecbb02
MD5 832584552d7950af988b71debb0a83be
SHA1 9eabe0ac07706c41e6dc7ffae466c0c96b4ff2e1
SHA512 607ebd298176ada2d6686c434213ae3e475d83bd683e420232bb90770421d5681a2fe01d118466a9504c7b92958c6a1d1feb25e0bbc11c5948ac727fff1f0d91
SSDEEP 24576:U47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYGA3n7psiIqHx2kbqDrXKhQpqNDb1+:U47JUQjairIhCnDHUPfF/MA3n97IqRbj
TLSH
T19865AE1DA3EC01E5E1BA927885558A1AEA71742E6F31CACF2270437D6F23ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 ffedc8e30e051382e421910940ab585676a961fef16f7ad6854ad8a4e6af15fd
MD5 c40ceefc37fd6d35f2acaf91875d3fce
SHA1 22e20453b8c61f63b103b5c58ebdb315bfdec2b0
SHA512 2a868ef89c51f8d60f4609b4b5e2d6fc1f90114bc82a583f7242842e83d706f6f1d05ec7b26c0f1c732951a78646772c4fa44319d2deff7c5e141761f5e27ba8
SSDEEP 12288:3ksf+7wkGWCyiAjr7psiIqH+Mh4kbqD5FSTSlKhOPICqND4g/3l+:DfA3n7psiIqHx2kbqDrXKhQpqNDb1+
TLSH
T13175F149E18912E8C0AEA176D7968A40F3337C6597F193C753D0F63E1F7A6804DEA683
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 896KB
SHA256 2838b19b45383696d52751d7ddb8f9aa3d457473f2ff661ea3cbe39d679587ce
MD5 5a083bac865373c8e79a9211a8a5f6fd
SHA1 2a411fa11079e01a190552094569ac258dd186b8
SHA512 1f2b58e1cf7add781f4b935b2ecf1e4b97a1f5a63b804ddca30b073bf348c097f304ebd1b460a9497362bd7b6011c0e8978b5c3bd128d5fe377f6b55884517f2
SSDEEP 6144:6sBC2na28ms09D31UAEH82CotMxHLpoU3ftkeLbnhHvB+/9XIhOVJQi5KDRTduv2:/hP+nU3frHBv88qnKD+vJmXUHBKDH
TLSH
T1EC151710766BD75FC6A940321E33C2CCAB707D42EE099B0372C9472FD576669BAF2192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 378KB
SHA256 a3547d13b6c59b3a3bc72a1bc03c1230f7333c262bea17d36d62f83c7805f1af
MD5 4c8751f55c055d48edba24d1a015723c
SHA1 29d54dd5e0ba3164ec24fde28a58ae4418ad7c0e
SHA512 8fe7a9ee666c5017a4c7ec75d6385c7c3412c23d527293db89183608ff241b7e24b8f0d0c89f4437bf0d2c25007bd8cb61f236f58228ba7422343998873a23e2
SSDEEP 1536:1fdlxddlWQISWTjBQ2dE8i57dlVdlIlUOo1c7Uz1X0ro:9dlXdlwPiQE8kdlVdlAWMYOro
TLSH
T16C84D7017759E32EC0BA40734871D69F9B79BC239F5253033BC81D94D8B226E72B7A96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Rdr3214106.txt

Path C:\Users\Admin\AppData\Local\Temp\Rdr3214106.txt
Size 13B
SHA256 b633a587c652d02386c4f16f8c6f6aab7352d97f16367c3c40576214372dd628
MD5 c83301425b2ad1d496473a5ff3d9ecca
SHA1 941efb7368e46b27b937d34b07fc4d41da01b002
SHA512 83bafe4c888008afdd1b72c028c7f50dee651ca9e7d8e1b332e0bf3aa1315884155a1458a304f6e5c5627e714bf5a855a8b8d7db3f4eb2bb2789fe2f8f6a1d83
MD5 SHA1 SHA512

Submit Download

ReportUpdaterPolicy14103.txt

Path C:\Users\Admin\AppData\Local\Temp\ReportUpdaterPolicy14103.txt
Size 4B
SHA256 69bf0bc46f51b33377c4f3d92caf876714f6bbbe99e7544487327920873f9820
MD5 455831477b82574f6bf871193f2f761d
SHA1 f44217a81173869e08671753c52553646ff5d95b
SHA512 cbc0ee58e447428bdcf72fc8b03c8cfb086edbb14205b918e75ebeff1d85ff1dd254e9dcb387afbd3fa766c803937c306e0a2a79870c0d87abcb7ab93661cf85
MD5 SHA1 SHA512

Submit Download

Tmp2987.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp2987.tmp
Size 5KB
SHA256 aaaced351a90b2029c44c6ebb68084a331f296a0ace8115d9889f549d596564b
MD5 42ff6aa7e64b25f09ffb2a89ce7f36ba
SHA1 0dbf44a94dbd6801b3afba7a6c602f39c7d44732
SHA512 47337d9919bc26dedfea1af060dd1fa2ef4a3dcf35c0a84ac7bfe0333b4885a368fc46fec5bc317fe257abdbcab9cdff67104382b60e9a1aa5f755aba604adde
SSDEEP 96:6jX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yKSeTEnXtGbE:0ULc8pq8RuwdmL4pUQrNyKQnCE
TLSH
T102C13CA388946C05AC27FC00B4C89933EDB676A61EC1D0D3625CC1A58B913873EDE5FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp529D.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp529D.tmp
Size 5KB
SHA256 27ead591d4c7f8fadd0d9e5d32eb6c9bf8830f83fddf83ddd47e6b3b413f5b75
MD5 5a68f4aec3689d0dc750adcae8e60520
SHA1 ebd8482e30140da9e44bebde6e4da997a7391e22
SHA512 311cfca7e98c8db69d2d599c5845d26a4686d03d1ab1d79237952c008269928ce8434a877e3fe411e967995536e2171844df0db14add053037de278571269a04
SSDEEP 96:zX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4ycOr0BO:zULc8pq8RuwdmL4pUQrNycOrkO
TLSH
T127C12AA38DD06C05AC5BFD11B4D89A33ADB276952D81C1C3325CC2658F913973AEE2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp5D1D.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp5D1D.tmp
Size 5KB
SHA256 e6bcbcb70401d63ff0746fcbcc63230269058736f7644151393edfdcec8b8765
MD5 1b7ade3253fc67477dea69ef2147603d
SHA1 b71e8e749a3461c9b37ff2c3d099b1911d9cc6a0
SHA512 0edd5eb1635b1599e50b368cb254c94bf1588acf1d063e89f45fcfd6fa625e33d2c7764d9d00afd53dec2dfb342e9cfe199d256edcff8430ae183d357d4382da
SSDEEP 96:7NLX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yGtDwwBq:RULc8pq8RuwdmL4pUQrNyGewBq
TLSH
T16CC12AB388D06C41AD5BBD11B4C89933ADB272992DC1D0D33258C6A58B913873BDE2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp9A09.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp9A09.tmp
Size 5KB
SHA256 a86ac1b119a6653e0c3fc24c2c40e44a7bfdc435fd81c4442af9d5526ef64e85
MD5 5bc2d1f7a5fd950dd51547ead6afdabd
SHA1 90f4e48ac87f4eb9dd10f1a80d46a7063f06a7d2
SHA512 45f18bf24c7f1102c17dd30aa205498f27336259ac3869c1d6129609a40385e68d9a2f353e3b13f18f40e7d1d32c4fb31d10f7b2fa204e24e4411183bb749f55
SSDEEP 96:7sX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yQRlOelNMQtU:gULc8pq8RuwdmL4pUQrNyYlOefM/
TLSH
T13DC12AA388D46C05AD17BC04B4C49A23FEB2B2855EC1D1D36258C1A58B913973ADE6ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b6d3eb84e05f6396.bin

Path C:\Users\Admin\AppData\Roaming\b6d3eb84e05f6396.bin
Size 12KB
SHA256 6ad99f198731d0300f37bd8294be374fdeab56113e3815d50393015c6d426507
MD5 33e05a00e267e571c7a154993add68ad
SHA1 2144526881e7c33f010efe9c5a655457a1d0fbbc
SHA512 a0e891972d81974c2c56f7c8ee4e17db52e217eaf53646338cc9405f6a61adc76bdfc186cbe540459f435750e5a1f6ea011cf93dd744e8cf31dce4825dd5ef85
SSDEEP 192:YkTr0GcmIGILcCvXU6S8Aotr8hdFVOXW9SovV89t5PGruy+EBRVV1eBST:hH0GOVM6SPo6lVkW9Sovs9MneBST
TLSH
T10342C00EA7009195905EBFCF0506B42B819F3F642F527CB9D7263B5E11E6C121C95DB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 7c746348004f0393c7ec9e99c0df44211abf35a4d074f6f497e34eae07089c77
MD5 babca9746f694772f76ff2ff7a8b2f53
SHA1 b1b99f204690ba26c675db9c15d44a63c83ef42e
SHA512 d8374e1bddba14c6e95c9ab74fedbcd22e62bf2866b45b8255dba7d1f5532767d0474f0b349121beedab9a9da787eef8cb13f509536799b72afc734f6390c205
SSDEEP 12288:1F7W7wkGWCyiAjr7psiIqH+Mh4kbqD5FSTSlKhOPICqND4g/3l+:j3A3n7psiIqHx2kbqDrXKhQpqNDb1+
TLSH
T188652340A08F3AD5E5B7A9B1F0EAC504916EB875EF7013E3721A17961DB8EC04E366D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e01823066e16eb8292d6d7540524e008ce336e10bc71a767a6a889a9c74bfd24
MD5 30f23ebd4fa596d79acb36cc7e31a3f5
SHA1 e51f2884028801f46a107eef3b43685b4e08d5a5
SHA512 eada0810f50f671d7157c7c2e9f920efe7c7471e508cbad7aec65ff55788bdc23efd9ae43c78b4948f584806e3690f363c219ec763ef08858e6d4a3411a27604
SSDEEP 24576:Zgb6bmBIi49WNNFpg1rSvFv7bYRA3n7psiIqHx2kbqDrXKhQpqNDb1+:Zgb4mBIBhGFGA3n97IqRbh2q9b1
TLSH
T19A65AE1E22EC02F5E0F6D2B8DDAA4407D6B278165731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 55494346a4d30be0656f4acccd6db332d148c8c1cd29d376b30c8866543aeb40
MD5 3c42e5f4da2bf8a3d37ca0282b207bd3
SHA1 1e650461a0a2b8afa389e78fe6a74dff125a0a7c
SHA512 4bd1bf6d40e9d8bec6a93b33796e726a57264a0c0b2f8249d51e7cc5d9f50239150190228f3a5e53707d75f0b33d5e4297c1662f0a3d3f5b7dbfbb525f56885c
SSDEEP 24576:iG88u8FpJqH1nzria7/mWA3n7psiIqHx2kbqDrXKhQpqNDb1+:57ZFPqV6a7/JA3n97IqRbh2q9b1
TLSH
T15C95F16576E502F1D47BD138C9864663F6B2B8251374EBDF07A88B521F23AD40B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 28968e24ea3bc42757e5309b3d8d2e3ebb9667861d045b401fd1c91c7e9bab84
MD5 91858753231fbaca91046af483e4e436
SHA1 568c442583b218cde029cd45c26ad6c54459bf97
SHA512 6a974cefc201c2ff171e0582215098e224ca16ec9ff1d38ae1d569f775ea2b7308a4dc2fb6c39d35db00ae22018f7e36161779e3acb5c29eb8c7819f2ae51929
SSDEEP 24576:fPUr+NQ6A3n7psiIqHx2kbqDrXKhQpqNDb1+:fJQ6A3n97IqRbh2q9b1
TLSH
T15975F12E21ED18E5E676E17DD5828709E372B4621711A3CF02E1817E0E77ED8AD3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 df42a520398a18b85a5b4bd03172edae96996f5d88b29157ea587d8038e9df79
MD5 dd7783000c2f098ab112629f530996a2
SHA1 05d4a441e482b5dae23e592fd4690a47021e388c
SHA512 19e4801185231e272c26676e38e127424ecc174370fdc875ec1cdd2449e800452291bcb852030dcd251300b7b25b4bbf4c4a027a7cbbb6e8c8cd0a9d4b3bc881
SSDEEP 49152:VBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjKA3n97IqRbh2q9b1:eG05lO43bon97IqRbh2q9
TLSH
T1B9D5C06E62EC11F9D1BBD17CD9C64A0BEBB23425033456CB02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6f82fcf6b915cde0461741add0a7a7564f0d60395c70a4c699f9db93ddc0afda
MD5 fa691244da9f0eea8d2042b67b23d2fc
SHA1 9b2284c02999fc37a19a39114df9f085e41bf7bf
SHA512 b7148af0fd95eb05d0f18754f3c25779d410d11f5e14b64ca160782fbf9be9197de1cd084b966232f162ea7e5197f58797582fb703d4f1d9181e398df21c67f6
SSDEEP 24576:Hfa5POZ3dpuWVM50JicR2hG0lasx2+47eidncA3n7psiIqHx2kbqDrXKhQpqNDbc:/a5POZ3hJt2pasx2+mSA3n97IqRbh2q7
TLSH
T10465BF5EA6FC01D5D5B9D17DC583860AF5B1342653319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 6b5760af185e2c835933f0e8b0e08b136482b68f1d9e3f673802a490e90b0b8b
MD5 53c9a2347f148ef9a00d4def801581b6
SHA1 dfaabfa4a14f8722df8650c0617e02639a01974e
SHA512 a1ec87ddc908091d925207d0e6897c005543b5e4a37d1440cabb93876edf7c2854520d316026e0cfb473b603fc98a4efbc3b96d1349471f0238f0b45028b7d32
SSDEEP 24576:0NcwHdjbyQ4nLC18lb/EOjowL7FkeA3n7psiIqHx2kbqDrXKhQpqNDb1+:0Nc/zEOVHFpA3n97IqRbh2q9b1
TLSH
T133858C1622E901E4F1BBE1BE89779546FAB1786557308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 472B
SHA256 9d7407b8bcd4af6820eae7da00db7598246d0f58dc502ef3c89aacbd9cc8a104
MD5 150650f8b4ce06bf6720a55c29275c38
SHA1 c69a908cd7138d119f38c8db07031364b1d21388
SHA512 fcfb7f30078c6e1c43cf272b96b5fbd599fb6ea694cbb79a7a3e40de0eea9e031a4b67d1c2f348d3ab19760b48b67758fd7b4ddd921aab9f3e8d3a064c662bd4
TLSH
T198F0651725F54655E0F75F11DBF990B35B367C456D18846CA0C8031F0CD1A51D872BB3
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 596B
SHA256 550a13ba1f49e521874c12f8908b48d130519016d3abd734b9ba3e3695f2a8bd
MD5 dc1ecc554b3f04dc9600236cdecc8a5b
SHA1 5ae617e99bdded544273928e3e02147405e6a032
SHA512 5c18ad0696a910c5806e952965b6ea6a7943443714eab387cfe0437c5546b6b43c87d70495e5a21ecd284faaf545ab0b6c7fbfc5f89b27ab4779e3cef124f11b
TLSH
T168F03A5726F54668E0F35F15EEF994B31B367C026E19D4AC90C8031E0CE1A61E9727B3
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 726B
SHA256 c89ff4970db3664d4435522769ed127af57f09ba648689de94c00a60572db3c9
MD5 66912ae2193d013c3bf5b8b031c7a36c
SHA1 e5288840baebf03420e92c9deb1a60121f24467d
SHA512 c519bdc0aaf38be5206f763c6ec85e3b1d245ef900c36f2fdfc8865783430e62e09c53fb344e4559e939e4ac40a2fe4e81b79e396264be2dedf9a237cdfb1462
TLSH
T12B01D6962AE91235F0F35F45DFF994731A327C131E18C89C50C8410E49E1EA1E871B7B
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 910B
SHA256 29aad3c953b84d978bd9c489ec6365d819b090264d3f63d55b4dce568fffdade
MD5 a450581a2a8b8beb8dd3de0a9d645c63
SHA1 1bba5a58b4ba51023c189f482055bd4408b20709
SHA512 603c344f420bfcd2931ec5dce59a6bea8e078d8056ebb86f61a6a79c0e4f3b3410000d67e20fa5dcd840d2b9cfc304028d69682b1e118d1c9d7ad9ce27d65a4d
TLSH
T14211C4862AE91275F0B35F45EFB994721E363C532E18C89C40C8510E0DE1EA1E972B7B
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Windows\Temp\ArmUI.ini
Size 234KB
SHA256 790b06745f32e0f56a7af24c871ffce225ba05ebf0d8f8a71a00c727c97dcf09
MD5 cd12a965da4fb66e7f8a07e3f421196c
SHA1 f6377f231362acbd1063aff829ced283a2660b89
SHA512 3fa242c3f573c706e0f36b477ce03f47d9ba0712ef72b94eae4f426dfe21ebbaf1dbebb0981335970b5186d416b4d25e175773796486f39e17de1df0a68a9b0d
SSDEEP 3072:03IJ8zcVOWmxltum8PMkufNWwhEIrKNCpNugYWKOlCIr0YxbFKRWSp4Vf37FbAjO:BxJvW
TLSH
T124342A5667FD1209F6F37F41EEB852944B7B7DA2BE3AC14D1680014E08B5A90DA72B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 abdf4f3d7fd766a70d0336a025eea96283143c1f467bae42c3b9523c68e68ef4
MD5 5511eb821bdd797cb1a0ed491270c225
SHA1 40ddaaf565163b580e42b0268646bb8e9c73aa6b
SHA512 a76fe53d2963d650d6e19e922334f85b19ac0c8266e21bbeb94c1a883d23841840527ab34fd1d5c8b39351dcee840b98f43eb47302a67000a1f95a126a4b4716
SSDEEP 24576:u3kNvNnaFeYhJNtmZBmYA3n7psiIqHx2kbqDrXKhQpqNDb1+:u3MwBtOmYA3n97IqRbh2q9b1
TLSH
T1D555AE6EB6F806E4D1FAC6B5DD238512EA727461173253CB5290C13F0E679D88E3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 7be4f64d7ccb9fcf0134a3bdb38de787ebcb2530b04c21ac14f1c220c38eb3a3
MD5 0dbb2fc042c54333ba7849601116a03c
SHA1 b06cd97602ede36591dbc2b837838d92e973b677
SHA512 224ffb987e04657a2d7804603dbd1fdcf4b0b55e955281bd6194004ac3a0562dc716e3fa77e304d5e2c03743b62d3d5da2e1f1831751d92e5bf4ba917608d55f
SSDEEP 24576:+D3FHshBIYQgAzA3n7psiIqHx2kbqDrXKhQpqNDb1+:+DVHeBIAAzA3n97IqRbh2q9b1
TLSH
T11185E17DE69D04E4D57BD1BCD6A38A06E67138B9033166CB02D481BA1F6BED42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1072-106-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/1072-97-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1072-195-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1072-98-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/1472-205-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/1472-199-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/1472-196-0x0000000140000000-0x00000001402D9000-memory.dmp

Download

memory/1472-384-0x0000000140000000-0x00000001402D9000-memory.dmp

Download

memory/2356-219-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2356-224-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2356-217-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2356-211-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2356-210-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2928-178-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2928-363-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2928-171-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2928-577-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2928-575-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2928-172-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3400-111-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3400-119-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3400-110-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3400-209-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3436-6-0x0000000000D60000-0x0000000000DC7000-memory.dmp

Download

memory/3436-659-0x0000000000400000-0x0000000000615000-memory.dmp

Download

memory/3436-170-0x0000000000400000-0x0000000000615000-memory.dmp

Download

memory/3436-7-0x0000000000D60000-0x0000000000DC7000-memory.dmp

Download

memory/3436-0-0x0000000000400000-0x0000000000615000-memory.dmp

Download

memory/3436-1-0x0000000000D60000-0x0000000000DC7000-memory.dmp

Download

memory/3444-132-0x0000000001870000-0x00000000018D0000-memory.dmp

Download

memory/3444-123-0x0000000001870000-0x00000000018D0000-memory.dmp

Download

memory/3444-122-0x0000000140000000-0x0000000140270000-memory.dmp

Download

memory/3444-137-0x0000000140000000-0x0000000140270000-memory.dmp

Download

memory/3444-129-0x0000000001870000-0x00000000018D0000-memory.dmp

Download

memory/3984-561-0x00000000024B0000-0x0000000002517000-memory.dmp

Download

memory/3984-609-0x0000000000400000-0x0000000000637000-memory.dmp

Download

memory/3984-716-0x0000000000400000-0x0000000000637000-memory.dmp

Download

memory/3984-554-0x0000000000400000-0x0000000000637000-memory.dmp

Download

memory/3984-566-0x00000000024B0000-0x0000000002517000-memory.dmp

Download

memory/4212-399-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4212-227-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4212-233-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4212-226-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4520-269-0x0000000140000000-0x000000014026A000-memory.dmp

Download

memory/4520-136-0x0000000140000000-0x000000014026A000-memory.dmp

Download

memory/4520-144-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4520-138-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4600-183-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4600-184-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4600-190-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4600-375-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4600-381-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4600-383-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4664-333-0x0000000000400000-0x0000000000632000-memory.dmp

Download

memory/4664-160-0x0000000000400000-0x0000000000632000-memory.dmp

Download

memory/4664-161-0x0000000000A20000-0x0000000000A87000-memory.dmp

Download

memory/4664-166-0x0000000000A20000-0x0000000000A87000-memory.dmp

Download

memory/4692-453-0x00000182971C0000-0x000001829723C000-memory.dmp

Download

memory/5272-148-0x0000000140000000-0x0000000140266000-memory.dmp

Download

memory/5272-303-0x0000000140000000-0x0000000140266000-memory.dmp

Download

memory/5272-156-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/5272-150-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download