34f740e83d9813bf3d91ee5dea759babe110cc809e767e0d86f0109013d23eac

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 14:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Size 2.1MB
Sample260825-rf46aatckf
SHA256 34f740e83d9813bf3d91ee5dea759babe110cc809e767e0d86f0109013d23eac
MD5 47e074789c1b257431b06f7482a59162
SHA1 35473d94c0515f85ded3dd9942a59e6b640fa723
SHA512 15579d822a5b76e38a7c9ba2523c0dbcc737a70f7c8ae96548283e71fb5cea1a996730ef8975a3fda6db82b9800c6cddbb3c5d654477c9352240e29ec3232e8a
SSDEEP 49152:u8SpvEhgOFKFQgBbbeMHfdVesRWjNSibOyyk5Ax4x8EVep:R74QAfdVesRMAix8EVy
TLSH
T116A55C1177E95A25F1FB2B31AEB841A54A7B7C616F35C6CF13801A5E3930AC09936B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
28	2568	Process not Found

Executes dropped EXE 13 IoCs

pid	Process
5884	elevation_service.exe
2820	elevation_service.exe
1728	maintenanceservice.exe
4932	OSE.EXE
668	PerceptionSimulationService.exe
1384	perfhost.exe
2596	ReFsDedupSvc.exe
4736	SensorDataService.exe
3104	ssh-agent.exe
2156	AgentService.exe
1276	SearchIndexer.exe
1868	Reader_sl.exe
1572	RdrServicesUpdater2_x86.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe

Drops file in System32 directory 58 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\89040b85e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrServicesUpdater2_x86.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ea8ac4569b34dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002cc03e989b34dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dea81c569b34dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Reader_sl.exe

Suspicious behavior: EnumeratesProcesses 57 IoCs

pid	Process
5800	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
5800	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
5800	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
5800	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
5800	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
5800	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
5800	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
5800	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
5800	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
5800	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
5800	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
5800	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
5800	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
5800	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
5800	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
5800	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
5800	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
5800	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
5800	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
5800	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
5800	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
5800	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
5800	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
5800	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
5800	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
5800	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
5800	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
5800	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
1572	RdrServicesUpdater2_x86.exe
1572	RdrServicesUpdater2_x86.exe
1572	RdrServicesUpdater2_x86.exe
1572	RdrServicesUpdater2_x86.exe
1572	RdrServicesUpdater2_x86.exe
1572	RdrServicesUpdater2_x86.exe
1572	RdrServicesUpdater2_x86.exe
1572	RdrServicesUpdater2_x86.exe
1572	RdrServicesUpdater2_x86.exe
1572	RdrServicesUpdater2_x86.exe
1572	RdrServicesUpdater2_x86.exe
1572	RdrServicesUpdater2_x86.exe
1572	RdrServicesUpdater2_x86.exe
1572	RdrServicesUpdater2_x86.exe
1572	RdrServicesUpdater2_x86.exe
1572	RdrServicesUpdater2_x86.exe
5884	elevation_service.exe
5884	elevation_service.exe
5884	elevation_service.exe
5884	elevation_service.exe
5884	elevation_service.exe
5884	elevation_service.exe
5884	elevation_service.exe
2820	elevation_service.exe
2820	elevation_service.exe
2820	elevation_service.exe
2820	elevation_service.exe
2820	elevation_service.exe
2820	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5800	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeAssignPrimaryTokenPrivilege	2156	AgentService.exe
Token: SeBackupPrivilege	2596	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2596	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2596	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2596	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2596	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2596	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2596	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2596	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2596	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2596	ReFsDedupSvc.exe
Token: 33	1276	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1276	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1276	SearchIndexer.exe
Token: SeDebugPrivilege	5800	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	5800	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	5800	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	5800	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	5884	elevation_service.exe
Token: SeDebugPrivilege	2820	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5800	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
5800	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 5176	1276	SearchIndexer.exe	102
PID 1276 wrote to memory of 4588	1276	SearchIndexer.exe	103
PID 1276 wrote to memory of 4260	1276	SearchIndexer.exe	104
PID 1276 wrote to memory of 1672	1276	SearchIndexer.exe	105
PID 5800 wrote to memory of 1868	5800	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe	108
PID 5800 wrote to memory of 1572	5800	2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe	110
PID 1276 wrote to memory of 1356	1276	SearchIndexer.exe	111
PID 1276 wrote to memory of 2252	1276	SearchIndexer.exe	112
PID 1276 wrote to memory of 1600	1276	SearchIndexer.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_47e074789c1b257431b06f7482a59162_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5800
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:1868
- C:\Program Files (x86)\Common Files\Adobe\ARM\Execute\17951\RdrServicesUpdater2_x86.exe
  "C:\Program Files (x86)\Common Files\Adobe\ARM\Execute\17951\RdrServicesUpdater2_x86.exe" R32
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1572

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5884

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2820

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1728

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4932

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:668

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1384

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2596

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4736

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3104

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2156

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5176
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4588
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 2972 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4260
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3048 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1672
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1356
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 2972 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2252
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3048 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
Size 1.4MB
SHA256 f8dcca329f114789c9c907fa8b9e782bb41b8f27b095623e3b305f2cb5eb94cc
MD5 cf07a7d6f02909497268764292b1276b
SHA1 500ce79f8af37814b6a3e77c80a237e783fcef06
SHA512 7e9875de7151a2da225ad29c3c97f1682c725cb7a31a15051badf3e5cc2f6b5992106e60d3c6ecda0df4ea5c1d8d5d9a1481b34327d072ada2f3cd59a9a47f39
SSDEEP 12288:xF6v+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:n6vyxknw4FYnshx8OfVe247
TLSH
T18F65232A7BCBDBA2E8540073097563B561AAE570EF355293C768721FD8F48D0943E22F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
Size 1.7MB
SHA256 6aa0e0014a9d40e21296da5f422cfcf0c8c9c648c8e3d247ff9417557c02f929
MD5 c3506c30bd72c405d8250710f9cd0e14
SHA1 4a21ddeb7d6efcb468dd46ae05e00fce49348231
SHA512 0db5eeb7fd4e4935f7b5d8b3d62e9e850623a76c1bbad7bdbe56910ca1422f4e342d8407e3d1abf3ed0e920361e5099ff4a8ba7f9c4162c5436eb0a455d5e154
SSDEEP 49152:aSgouvAeFfenxyQTXS7uQ0NIwx4x8EVep:aS1uxaxnS7u/ix8EVy
TLSH
T12E855A1267F94129F1F37B71EEB993645A77BCB1AE39C10E5284125E09B0A90DE31B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
Size 1.7MB
SHA256 a6d81076c9d198ab55090d89525d1822befc6d2000ef2747d406731ea2721aae
MD5 b93ba41af08492f99a6f3eadb469d4b2
SHA1 788fcebbd08daad8a08adceadeb476391fa1a13e
SHA512 371e63ba477f3ccbadd19d753e23202117510dbe0a2927f25e868571e64d36c2c9e329494c38e513f565c70fd7be892d241c47d5965b8aab57cbda7a0a625375
SSDEEP 12288:E6dVWnxlM1n7nFKbltn+Ch/m6Xz+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0I:npTAbD+Omezyxknw4FYnshx8OfVe247
TLSH
T1F885E01037D0C035F1B329778ABFA724556DB9B15F6881CFE388262E5DB09E0AA3571B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdrServicesUpdater2_x86.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\Execute\17951\RdrServicesUpdater2_x86.exe
Size 846KB
SHA256 6a142c879a0676aef5c825d6fd6336800846167fab422d0f912096d286aa0070
MD5 a447c3cf3b7547e5a1e12dbb92d8c052
SHA1 d2b246eda6302534b21b2003719d9f911d0c77d3
SHA512 ce7446e337cc13a560a12b0b789813bfb5a96a6a9d25a8b3e2fc1ed884f0c4950f01937714614666befb9b92123d359b9597116e9ed9e8efd46b77a640d002ea
SSDEEP 24576:uSU4vrTQA/gK/c8DV5Wa1ZmPEKBLeiGA5nEJ:uP4j5gKU83W3FLeilVEJ
TLSH
T10C059E22EAD18073D563143102A66F368EBEB9310971D98FA3D41A4E5E705E1BB3F397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a91e1df0b534fb1d40e1e9e1ef9058bf4dcf9f3f0a4dbda9db549a9f50104518
MD5 d57d7def6e12e1af8fbd141ee05f9218
SHA1 1344a228a12e342f6863d86f3ce048570c19586e
SHA512 b12f6227a92d407b1a5f79d40cf4296016730894fd93e3971f288bb3c453003af740f5d81b1f1e0a361ee2001cd36bf684b8cf03ece6946373e66d5ea1784b0f
SSDEEP 49152:kb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnAx4x8EVep:e3q6HjBrix8EVy
TLSH
T12CD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 aa6173ebc5cc8171a952aab3310d08f2bf8113329533b0bedc6e2223b9fd1cd0
MD5 05da10fa5a1392146bba4052e5030ed6
SHA1 9cb0e37f9e1aa30cb16f6c230603da83d903c25e
SHA512 f5dad9573f44ae11c7e52eb9c52f607149f9592a1ce26597dd1456bef3710da008915de5426f65794d88d925feaba308572a419e265b594af197e4062de024d0
SSDEEP 12288:L1XLsswWkxy2lRq2czAU+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:xXYfDtczAUyxknw4FYnshx8OfVe247
TLSH
T16175F12877D508F9EC6B8139CDB28512E633B8954770E38B03E4A5295F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 3e2ca621451e5b1e4b38316e7d6ca6024494a9bc3290af064aeed52c60f49c9e
MD5 49fc614855a576f8d5572e2d3f7a5095
SHA1 4839f70761f635d5074f3c3fad24a04ebe993c34
SHA512 625685cf1d384d42508d63a7360983473ba4e0b20f96cdffcf895373f6430a61233d1340b9634449f62904686a7f2b3d9db44738952e3d176b87158eb7c5a1fa
SSDEEP 24576:M0Le5ji0hmx1rMNyxknw4FYnshx8OfVe247:MPji0A71x4x8EVep
TLSH
T1A695AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2883bccb3be7b1d2e94ed869778eb5cf89b5946585337e47343d3daa46930868
MD5 9b936e24dbc59bde26bd9ca53a1f57b5
SHA1 a62b43406801985b6652b909c0f62e3d051f0f81
SHA512 877df606acb39876a87b4aa2808c48e947dafe5032776b432fdc62df444f085ab2440d3c655f004eaaf9f4758bcf83f122580b466116ec709811dbd3129cd54d
SSDEEP 24576:+a7/ezSC6vUyD/aqgrvWE6q8wyu/yxknw4FYnshx8OfVe247:5/ezSC6vUzPvxHjypx4x8EVep
TLSH
T1F2756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3d7ef1032897b2d835e3e6979d0e1b57d9310abb3c0faf373bd18e72ef1b569e
MD5 407a7bbba96bbfc3889ebe040045b166
SHA1 bd5dab9d7c314dba489857ff443c077f6cbc71d7
SHA512 8360a7d5b9c0d21d79a8ed364699b3adb2728436864a84f7bad1c1398c6196c93128fb739515587699d2fb362fa1c41dbeda063eb35730889d6256877a26946d
SSDEEP 24576:VVbqPb88hv/l+6Yyxknw4FYnshx8OfVe247:VVO88hXl+cx4x8EVep
TLSH
T16E559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 7076aa768de55a8d5622a02f16eead5be1f2e9ca23dd255c08032707c8c0a283
MD5 2b5e271cf0e8dbc12c36ee8c954ec3ec
SHA1 13ad22c93439573a3b5699e2576d9170b01f6772
SHA512 2712daa625e85e70ea8f00885334f2ab4f0318ac908f47f154b99f65b2d75dd6dcf1d6b41676b45c10886a5b2cfe20d45e09295e80607c0eb2f1bb3fa9b1b7e1
SSDEEP 12288:lNB+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:lNByxknw4FYnshx8OfVe247
TLSH
T13565237CA7DDA4E1FA5E14331B7572623616B9A4DA74C11BCB78B14EE0F0CA0E06E123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 93f40374f0602d8363514f6d1dbb83bc6870ba5831cc92005cdb272cb76ab568
MD5 f4ee03353084a971e18ae25fa6a9849e
SHA1 b023b9d7ae4224b93fd4f5298fa8a74e0850d740
SHA512 0064ca0009f2a9b2db7354871d4d68bbef3965666ff1af4ae6c8cf3d09e10463ad700ab152c8f9a2300f7ff5b19dcbdee141ec31ab243e76fbfda5725b8e745a
SSDEEP 12288:JeBNUbTVO86Uw+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:JJIUwyxknw4FYnshx8OfVe247
TLSH
T1B475CF7BEE28FCD2C27E5DB95B918200A77274704B6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 324c49a2074b68d07c6dc8c9d55fa3491cbaa9f85a99a7c1d0c9f19190991b4d
MD5 a83c545919753f9ed861800e8a550665
SHA1 d73abfa5d8ed8e15e933e9363734968562af3f27
SHA512 04c00b52aeb75465051923fdfe01ab8cb8ad23c6ec36f3dff1d6255d628ec84ccb719c428e3f4ebe473e4ae0cc06ff37c39e7c6e2cef2ce761385449e58bffbd
SSDEEP 49152:bQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH7:bQvGAdlCEL8c/yRNw5C6ix8EVy
TLSH
T137267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 08efb7203286fe22372dc612aa1807b72c2470c4b443df30ec4923aee5bbee55
MD5 1c3611a0963fedb3ac1a0d152e526734
SHA1 4befe1d616e91d7bea2e2919193d82efc819b4e7
SHA512 6dc2d028bc543882b8685da15c09fc27617c0f2001ea6a8749df6a40187b751dd76950cce604b584219e4482d0b7c275d0f4b1786977d04afd75ac0cd609cade
SSDEEP 12288:KAwSfxL/2Dc3LDLLmt0LDQewsAjq+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:f6ewsAjqyxknw4FYnshx8OfVe247
TLSH
T1BB85E030FE74E032C67F0DB21B36D716142DB9604B611AC3E3F89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a3bd83219e2cdb845e93135400601c3ec61fb8fbf3066555114187b9c915a69b
MD5 4645eb2aac9a4bfc514131da7c7c0d0b
SHA1 3f51e2cf847866c4982f6330317dff6aa9244d9b
SHA512 b1bc553e2fbef37883b9349400b65156ce734ccf846a8fc3bceb160cd3b266a5eb68dbbf8810f125e42d443dfca5be5eb19eb02340898d3e320db2996f40f4cd
SSDEEP 196608:HUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHw:HUEtQevvqc2W1cpV2EI32
TLSH
T187474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9a78618b35d040e7ba648ede0346c6c8d0d996a51d636126431a4c5dbe3f1d89
MD5 aafcb7fba044a696076eab6b7698e0b5
SHA1 52116a69b1ec7cf727cfb911016446e719053824
SHA512 5a4605bd0c4759b51929c8aa710fb10303d965feb56614865d83540bedb827aaed00cf0bcd2d0aeadece282c4f990fb65a6414a8c1a62aa1c233070798eb136c
SSDEEP 49152:tCbRquA/m2yL5zQfFiV+XenmE3/zlx4x8EVep:KoqtVjnmuix8EVy
TLSH
T1C8D58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 92f6372c94ffc0cf390c629604c413c51dac082e1ae0a1187261283e81c96a6b
MD5 0bd93746f9cf1c345b21b03a3d9776da
SHA1 deea2f3186666b6728298214be8bbcc93f9a476e
SHA512 d8f7f083459dff3861c097764b8420789b0286fa7c8a4a05384c703360ee6eaf0830ea7335da90c9f3479a36f7ef6aa8922b1c3bd1f48be23b73531bea04b3ce
SSDEEP 24576:PAhGLJIFoiwtA5l7S53ryxknw4FYnshx8OfVe247:PAMyFoiq5+x4x8EVep
TLSH
T19F35AD80E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 3ffebd6ebe26cef7d9030b6eaf6cddcd10ec214b5a779ce6d13a4ef77fc03346
MD5 6edcaefe60a503f148c8ea1543438e5f
SHA1 c8a4d8808d73dafd0b4c12293c78bdf9aa39e575
SHA512 b2458422151820a07adbafad3e8b434d964451480825911de42ffa89a7d754769ac09ea8e018db00849078e7799df764bd39aa8b43640ccb4a5459ecda86cf06
SSDEEP 12288:ymw5HEjsChN4BFgl0WDm+Cf+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:rwuVOWWyxknw4FYnshx8OfVe247
TLSH
T17275F14977E91CF9E9A741398657D132F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 a3f4f97f72113650a9b5ee4fe0be3dc7b0ed53698bfa9a35285ba9ffb69050da
MD5 6bef9a981acc354df7499bc8e562efab
SHA1 a2d62806d918e1791966b51dc39c929d3c6114cc
SHA512 af634fd5093cb43ae8cca84affeee17836fe597e63584c4df0a401a4ef5271fb1b41cacfe2cc41b0c14047ede39085d5ab5abe7826c2f95deed9cf84a4cc449a
SSDEEP 12288:8FZ1Iy6+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:eZuFyxknw4FYnshx8OfVe247
TLSH
T1F46512AC33E860F1E1AB113A89F15205E76274A2677183CF4768625EAF72DD09D3D723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6b5a9e43a0e2332186917c1ac10a32a0a8e656ce7ca0f4774488990d47911c90
MD5 7d72fc87ac602f16160d06e8d2877736
SHA1 112f86b5fd0112169727657b23903de9828ea0aa
SHA512 2ad682a021a4135e14d02f4267ba4714f3d3890e695d8fd1353bf50ca5a105ebcabcdae2e95f009f2132c2b31836d065144d743a7fb811f987bc2fb374efd496
SSDEEP 49152:jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Un:yQRQyi36YOcPQLvw2gAf+PN3nix8EVy
TLSH
T1C4667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6416de78a8465a904ff54eda20c317a24ecf135bf5a64c2edef3a622854c37ee
MD5 d7623348ac33017547a3947668446bb1
SHA1 bdee51dd12e2cc2a60704c1642c35ff14a64b945
SHA512 74ca4019f8615b3e2fdb15023af5c41c5d4fab06f8eee17c20a6077a159bb3fb35753ef5889a8b510c639c7df1c1f40c497ff6663f53ae6d8231cb2e029662aa
SSDEEP 49152:rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Un:6QRQyi36YOcPQLvw2gAf+PN3nix8EVy
TLSH
T1F6667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6f29cfb8d15ab9844be93af3d3c1513cdb3eb26ee8c52844b46e28af29b2dcd8
MD5 c14843e38c12d99fd56e99bc2e74c35e
SHA1 df5c9543c3fbb8bee1b0d4e34d993cd38855aaff
SHA512 b06c2755c8590248ab33a6082cef35accc39b46a152f8d1d2fb4b6c6b33abe5037fefc3c1056c976cfea216a147a115d7f3b26984786558e7350fd0fcdd04e22
SSDEEP 24576:ZwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL01yxknw4FYnshx8Z:F68Qg55nhheWu7PNU3/1x4x8EVep
TLSH
T151B55A33B2F600A9C44DE1769F46873196D27C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 32b67709392ef40c431769d460c6fb4283d2bfd09760e019b8bccd5ae71a535c
MD5 a26cab243ef0ca8d0922ec26e17585dd
SHA1 1986889724ea17bfb38ffafb2151e7e2ca277033
SHA512 7e4d13b016b020a13357d43061c82c5958bdf523e609fc64e68a4a3320d97d085bed7920be9e61037e1efdd276501097a030eb155e56935d87a3a2fc44deb648
SSDEEP 49152:k3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk999:xy5112gYy5azzVvL69nLKnhZEix8EVy
TLSH
T138167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 8ea851f024c5b7930d3be5048426766eda804649b6336918ae368657ee6a0691
MD5 fa9f17f156a31f08bff39615d1d6d438
SHA1 0d8c9b8a41ffa4e42905eb4c77403c440f29e124
SHA512 d9ba3a66fef2484ddcc67a29f0856486d6ea129b158f11330d100856756d6dd891b7d09a2f872b889f1a0453c21185705b6bb35d89a5669cdeaf238cf261c0ab
SSDEEP 49152:aB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glfx4x8EVep:Iu6JmVxd2dfix8EVy
TLSH
T150D59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 db8df2bbac75e8014dd84fede8d4fa540c5b3a2e1f77730cbaf7becd641b0512
MD5 954623776cf2387c526d69341cc5f348
SHA1 a48a06c7dd4306baee761fa3069bf1b576e36225
SHA512 1e9e4de9666347c1702c389519b7c236ea1e3a3226c37a7041459eaa8e1fbd0ca9cc083faf2b8b8b2d98f95b3bf883089471fe8816ea01a65d0d47ec3b908e7f
SSDEEP 49152:P1hpsNoJpF1A6UU44CwH7R4xTx4x8EVep:PmifPbRuix8EVy
TLSH
T1BCB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 df08ed2da8d5840960736638f9005c9aa50a2912aee7a628edff08f2b8615f82
MD5 e26f92ecbc991a8fb5d4a36b8f83089d
SHA1 be2c82d6cbf7ff90d94cf0316074a9603456a018
SHA512 22dfe19b583cb9e00c55729901fcdaa4a2df094366e30ca973a57d870ea861c846e8ac10f94834456a6f5920e7866855e9cf9486b8e8b270fab22f6350888c2e
SSDEEP 49152:ZSuZQIY0Be2KRRVtOnks6NMHqQx4x8EVep:35dKTi61Qix8EVy
TLSH
T14BC5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 bcd732bb7da844fe13c54db92dc6f11b9f0641267d708b0d1914e923fb1ae608
MD5 319a9bee55eed2501f572e75e7d53035
SHA1 6a10ad146e4c1dd127610ec32f4d869875310852
SHA512 440c99c6516ee25669b1b801d9137a206385b256a92eed98a331b467c09ab8689771ffa73d78ec0b65ff54c5ddc7ce79609aba4fee7a03e5a49a158ebd067111
SSDEEP 49152:GhtSn8EApI0figngiDn0AP5wvx4x8EVep:HX2iyphiix8EVy
TLSH
T1CE95BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 b2ab25d1c7b35cf013c6d3cd5326df2add0a058e4306867d96e16d71f10ff653
MD5 9f59a43dc6fc52f7e843b54fd69af9e8
SHA1 38cb64e1bf357103020785acbcb08db9d29289a7
SHA512 b2a9eb3d0b7a95794110a8e87fdfaa8d0925f66f4d9163dee4a338f581c6ed9f5a795e8740ea72556b8863c3fb5e69f15d8e7d071c81e16e2cb2f671a5b5e648
SSDEEP 12288:AZ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:AZyxknw4FYnshx8OfVe247
TLSH
T1EE65237CBBDEA5E2E50D11734B7172626609B5A5EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 d082d04d9fd79f11ac4f27b14101348b90c1b14751ace246486c321c892d257f
MD5 8bb7e9c71face63047973cda4f775000
SHA1 6789d471e98edc64b522f14a3e5b496d318a1fd2
SHA512 1a0b90fa9cceb917d2a2ea0715ab3d3fb52a8f4a9ea20ac4d9b2e56a9fcb2980ced1b869165be2b973542a98dab07ccc03038e299aeceb188113a0a5c1b705ca
SSDEEP 12288:D++hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:D+yxknw4FYnshx8OfVe247
TLSH
T1EC65237CBBDE95E2E50D11734B7172626609B5A6EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 0f9cf050c6192caf09d3d29d78a15be50e646bf4691f9babdc7d25d3d8ec7e88
MD5 6102fc31c7f1780df3c2973d3fb3c596
SHA1 5f274d4ba72cbd0c29585e0c8760b560048555e7
SHA512 5aa58bf72b4559cce628995753503ff6d32fe63bf0928105a32fee6c74729420c8a7f4ac7441890f924670ff72976aef1e96b47a5adfe4efd95a73dbc6619b34
SSDEEP 12288:PI+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:PIyxknw4FYnshx8OfVe247
TLSH
T12365237CBBDE95E2E54D10734B7163626609B1A5EB71811BCBBDB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 6a4514c19bff3c4400975e81d8ac5a7ac1ededea9cc79b7959a07e0d48b1f8d3
MD5 d283dbfedc8d3fa4bb12ae23faa4b710
SHA1 cb6c63c59ec51890a7386810dc9cd352aff93241
SHA512 3404bb62a175316ec51ccd313423d9a64a2fbd8ab68dac7aa9fffc4a9c15683c976d8ae8d9a5827264af90881a2c4c28a92aafa49e7eba6a227e0673b8c15301
SSDEEP 12288:WVL+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Syxknw4FYnshx8OfVe247
TLSH
T1A765237C77EE50D1E85A51738A726222B365B8E5E731835FCB24700EE9B0890E43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 9c62ea1937eb4f5c6a7543433d69d949f1b5cf3f4e23c308d302522db2a1a2b5
MD5 4fb23f47932d0ad7d2bb90f71c2e96f8
SHA1 f882a0ed644e7a570245f0da700bea1319b04a39
SHA512 602c180be906bcf820bd66d54a574019541dd4d4249eaa70f8b53fce00c89bd3e35de6b5bfb7e6b3ade3777f675176efb33dbfb1d60e5d6134af553d94edfa45
SSDEEP 12288:3z+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:3zyxknw4FYnshx8OfVe247
TLSH
T1DC65237CBBDE95D2E50D11734B7263626609B5A5EB71811BCBBDB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 62879913c0717388a7ff897a0772308e605d53f4709acfb00b6099a5c718f334
MD5 a2ddbac922878cabdff5891fddaecef9
SHA1 7a1f70a77be848346eda7180eb108e73c34d5785
SHA512 41fa6d7bcb3dba3734393ef7d9e12ed909ac9442964c8ee6fa185643d2a5e2d4f2247277a42d80299c92d4eb0c81cd4306974effe0c4bbd7c3dbf83354660b2d
SSDEEP 12288:Ci+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Ciyxknw4FYnshx8OfVe247
TLSH
T1AB6523BCBBDE95E2E50D11734B7172626609B5A5EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 6d3e7d5f590f41d4a077c4c13545d136b6bb42a59812cb6426d82874d64d4262
MD5 40440056e29ddc65053db3ad85a10efc
SHA1 61e99bf924a31fefb8fcf7bd5de20bf266ce1b96
SHA512 f7997d94e3407b93eba74c89145179fe4f1304004ffa3118b1561388ddde55c3fc3d62a332adee01812df07f4e2ca26b8b2e504c959bec492da868ac0784a49c
SSDEEP 12288:fG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:fGyxknw4FYnshx8OfVe247
TLSH
T1DD65237CBBDE95E2E50D10734B7172626609B5E5EA75811BCB7DB00EF1F0CA0A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 264d317359f7c06606638bdfe084290d71df59cc724eba617f069d90e4db7ee1
MD5 4ee496b48b707f7a5f2f29698488bc63
SHA1 29d0b8fa4948b802e2ea810ae13f63544c3140a4
SHA512 e07f675983d136619ca42bdfcab344165429a977b9d160adaa1a073d4dcafa7b4ea20bbfba555f174cbd91232fb82b1a2cb25b799f0e12a62ae754e6f7c7e291
SSDEEP 12288:ZiZwbZzzFEoS2cPvye+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:cZMdzFVSOeyxknw4FYnshx8OfVe247
TLSH
T18B7501A8B39018F4EC67413FC9259916D6B27C594B70C21F43B8362B5F736A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 f6941c739ca33130b70ba23edd0466f2c9fa635db794e188ac4b39db41c63ab5
MD5 4e54cb5a2835bbd01c35becf97511e6e
SHA1 62c57f551d78dbcae2cf590da476d58cb5ccb850
SHA512 d51fc79c38f1b086356b5c21f66b533fea9d2fd764da27199cf675fcf8c566946d883521476314b0a83bbf501ee9f97196545a07ef6412674da860876faac516
SSDEEP 12288:DV+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:DVyxknw4FYnshx8OfVe247
TLSH
T10E6523BCBBDE94D2E50D11734B7163626609B5E9EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 df07655a88b24697099b9dc19efbde35861b33b0efceec6e358f389d7b0ff615
MD5 fe4e04780d1630f07f27fa8a95876c69
SHA1 b5f0d0069e4e10d3dfa7fe5b468b59a7038ffa50
SHA512 ae1b58dd8201fbb311fb47e1291d0bc8b189d0298f8402eba26ea26ead118a9205b3679523332a7c8b704a19d16366f464dfcd0444417bcbd45539c35b1627c9
SSDEEP 12288:bR+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:bRyxknw4FYnshx8OfVe247
TLSH
T1B665237CBBDE95E2E50D11734B7173626609B6A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 47b9209a3ae842d3e6e8d6f2d0aec88c2549fd38c2d54d0b2523a4ac7495b2a0
MD5 7d8f2a96553f14f499f3ac2f07a18073
SHA1 08d80d8a4c3406409fe6899927a840221fb98275
SHA512 705e583a874cd814f780228302cf7c63279218d87c05294387be7e7ecf8452c176225de7d5871dd7131fa25a485e9cd017937a81461d89f2156db1bc3d9a1e8b
SSDEEP 12288:LyPz5L86+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:mzy6yxknw4FYnshx8OfVe247
TLSH
T18F75125B73E530F5D12A423689621612F372B8724B3086AF87A4527A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 bfbc46c43df63eebf9cf3a354c8c770bcc319c713c4af3bb98a6f3fcc1b54d9e
MD5 845c1604da0f496d64c3c678751b946f
SHA1 e77accaa1a0c2926cb1a0882d3dccd4ec402a5d3
SHA512 d8735f55f61e5ca4400c8f80a9b6a8a97c1e7d0d305aeba86787208773d93e1a08276fbc24e8cabac5e8566a2cb1f04262c0e6a0d90d41bbd6a42ef8b8ac0d27
SSDEEP 12288:VV+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:VVyxknw4FYnshx8OfVe247
TLSH
T1146523BCBBDEA4D2E50D11734B7163626609B5E5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 2d4d1dffd4dedf172a25a86a905f31a8788962bb4e9d29f382379e447206a110
MD5 32af0d18337e592a1ca78061f304b60a
SHA1 207c181c46597143d0d71499365c86daa3a4e91b
SHA512 6a2204997d59329dda1dbbafc808c3a42b3cf6cdd76a2a81861a81cbc3b5a6aa0b8b0120f0a9616cb91305a5e633df35121ba88dc8a076092d7fdcd9714faafa
SSDEEP 12288:zV+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:zVyxknw4FYnshx8OfVe247
TLSH
T1496523BCBBDEA4D2E50D11734B7163666609B5E5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 d3d77c5c42949f85d2201c762643387f6a58a32d31aaa9fb727bed6c6824159f
MD5 0e679872bae5d57b58da07a36cce7242
SHA1 728aa98d9920ad7fd044efa20fa1ea482da98fc1
SHA512 7b55e6eef2d63241f78b3d476d4588821860b436bec0e052a531ea0613a904cc60be207e608f505e76a422e3bd4eabb79826606746b8a1c79783480016ae4520
SSDEEP 12288:cyPz5L86+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Fzy6yxknw4FYnshx8OfVe247
TLSH
T18875125B73E530F5E13A4236C9621612F372B872473086AF87A4527A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 222b97db4678c5e0756ccaf941c3df33c93045c5a1831bed6cc0888fb02ba87c
MD5 10ccfc3984ec08c23e95e1bf1270fb0c
SHA1 a91a56d7b8e2534e415d4c5f50c6cc08edee812c
SHA512 508397b5e71000f27b8585c3c855c9079e40b5ddc9da9db2d25e548082654e224f8252913faf5250a2ca2457b393606f3c8db6f45569f71cb9055bd2da3919e6
SSDEEP 24576:GTGaLl3z0zD4yxknw4FYnshx8OfVe247:GTFLljqx4x8EVep
TLSH
T1917502A8B39018F4EC67413BCD659916D2B27C6A4770C21F43B8362B9F736A05C3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 2cff97da61a82fbeb670e989fc239c496b62b6f5758621cd32686728dca5c6d0
MD5 a7acbd3668506013251969321a3c1c46
SHA1 14d244a95498df3ac8b3fff568448b76ee7ed16f
SHA512 51e22d79f3183b7a303541c514a2e65ccbd68836622892da1ed1114c7dd7567fc054503125e11f73aa19c089daef5f8c4c32cec51319e77586c4057b3c26ca50
SSDEEP 24576:d3Xd9CHKy7GZsyxknw4FYnshx8OfVe247:9Xd9CHKyatx4x8EVep
TLSH
T16195CF90F3E410E4F0B79A35CD765512DA767C9A5B31CA8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 672d1aa93b025689d24df086be04f1a37c151aec6286a173c42e2a505613093c
MD5 243b9be2697d08df26e956c3ab4dc3c7
SHA1 28e669cfc3eddbbde72b48e9d680f4c3d157a48c
SHA512 acfa8528933e1d5e20c924467dea77366ca21603538f07a4e538d4554502857fe4e0123ec7fdb359d4ae03b7c9454b13ce776ead44debdbf7e1460f271a87bbb
SSDEEP 12288:fo+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:foyxknw4FYnshx8OfVe247
TLSH
T1406523BCBBDEA5D2E50D11734B7163626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 e82f120023655c91136dc45dbdb9708671ed291cd340a3b763c933eb5d790853
MD5 f013f20fb1510a50c5a58e537337415f
SHA1 7f4251c438aa5fa99283013ff624c9a3e47b9d46
SHA512 991629c8fc1ccd199f30dce53f1fccbfe1f1452f6b9b66e32dc574f708b860c67893649d232c225319900bb61a4e580d9c472d393e1e290fb0496196ed845f13
SSDEEP 12288:ua+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:uayxknw4FYnshx8OfVe247
TLSH
T19F65237CBBDE95E2F50D11734B7163626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 7fe943750e6fe1b709d99fd8558bb57597640db089e1b86507038e867aa43771
MD5 58656b66437b42833a032d032ebea2d4
SHA1 6e5bedcfd06ae73282f31340665d68dde10d0d32
SHA512 c239e5758ca34895c8cc2c296a73e4b12749737b5b28fff24dd49b4731b6f9bfd4cf5eb22175afb9efb4570b7ca4151a3782b740cedc56309d66e75dab4987fb
SSDEEP 12288:Qn+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Qnyxknw4FYnshx8OfVe247
TLSH
T1B16523BCBBDE94D2E54D10734B7163626609B5E5EAB1811BCB7DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 c5c03017c7240929a79e017b9ca14ce933c836d794e4f8787aa890993f66ba59
MD5 46e63b16925df3d033652f19d1d6ba04
SHA1 75a2cc6613bf2f5da49873a28c155100794a4de1
SHA512 f36b75594aeb5fc5105baaf1a063bc2e3578602acdabee9540a40132703f13e20b391a292a7c3c3cce7711de63223dc7b9a579036ab2e05b6b94c14d19ca44cb
SSDEEP 24576:8fwvJk9RX6wkyAIhyxknw4FYnshx8OfVe247:lMnYIkx4x8EVep
TLSH
T15895CF29EBDC44E1E1B7913D89B3460AF6B178695B31C2CF029A536D0E33ED49D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 871b577469e4f75c4590a21bd75c04044661ce43a24b4d449ee0b2c1f95c2913
MD5 48246d2c2567d7d7fbf0bd07e893f76b
SHA1 f8f89f04e0ef0b56b2ec64bb9a02c9abda4bcddd
SHA512 acad850b089f0484b264bac01f1fdc05027b1ed6d43afa3e647ce49429607829b6310430a1978bd84a85c99c97fa1accef6281ff3759f94733690e3f71083a4f
SSDEEP 49152:cYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Px4x8EVep:CySzPHix8EVy
TLSH
T1A9066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 1dd05b2bf9d1261d215f3abdb81379c695c114c8314d2e2afd439bcdefac86f2
MD5 cb321de6b2210ba1964ad49895f374bd
SHA1 cb744b1c1e305c8cd9c66ed8fe5870f33491c9e9
SHA512 3fb4c30dfa946689b211a7193bd1b5c1dfad7ab26075c6a3fe92005705eee25c17ce09db869a3f8f85e4b1bfe07afde0b873d60f1365ce5d4dd246e9fe89443f
SSDEEP 24576:O47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYuyxknw4FYnshx8OfVe247:O47JUQj1irIhCnDHUPfF/fx4x8EVep
TLSH
T10065AE1DA3EC01E5E1BA927885154A1AEA71742E1F31CACF1270837D6F63ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 6c469dd7b0d92921affa3c94096eec0aabee794cdbb79fd2e1ba67500a492712
MD5 208f6a6bd0b33e9ef3554433888fcbe6
SHA1 e780f968e221397546145f272ef3014f47061631
SHA512 2ba2ec719bbc5c9d14c13715036529c3f6d7332595ee2e9750ad941c9c8468577bf95ae2a446b306dd485bd93e0c42724933bd2adea740ced1cda3520c54cc54
SSDEEP 12288:c+sfF+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:0Fyxknw4FYnshx8OfVe247
TLSH
T19375F028E29842E4D06E2136CB625641B3237C6597F1D3CB97E0F53E1FB19909DEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 5c97fce6ac99056e0a1192bde0f823bd040b13fa1336a4358bd4f75728255d3c
MD5 aa117abf95c2392ff8f697f5ede93098
SHA1 05528a378ef5161a1c605b71ed64a284b13ef515
SHA512 5efafc294ed59a7ecdfd03042e9b2c418c0b8ae8c1d718925a4323d0c536840b4e32ce3865d303667f9ea27c59a251993b2ab07fca59a0d98d9f71b9ced88093
SSDEEP 12288:89OdoU3fgk5dVNgchi4xbmx131OuBVu3oPmButBGEP0:89OSUPrNgchw31PBVu3kmButBGj
TLSH
T13B451640762AD78FC6A940326E36D6CCA7707D11EE056F0773C9873F9476668B6F2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 942c845dab5d952ce5ee3fe7441e60d353316c591570c704e1a1ff869e70382f
MD5 e704de318a07e005e35ddc0be330d6af
SHA1 66a07361941c22027a3dccc3d3500f02dbc304cc
SHA512 daf4aef088481cbaf6d08f91521f08602911e016dd4856c3c46ba2a9cb4fc2c2cf702034a7e50f74200152b0b6fdc9227e0e730c9fc4047fa7e277da75757d7b
SSDEEP 12288:WLJSpvpx6ejDdhceBjiGn/raQBJ5RQJb6ImR67y5TAnMdL:WLIpxY+BmYGQBJvC+zR6GSMdL
TLSH
T132554C01A5A7E35FC8FD50375632C68DAB74AC12FB452B0173848A3C886767EB5F2792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Rdr32[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\HEUA9JR4\Rdr32[1].htm
Size 13B
SHA256 b633a587c652d02386c4f16f8c6f6aab7352d97f16367c3c40576214372dd628
MD5 c83301425b2ad1d496473a5ff3d9ecca
SHA1 941efb7368e46b27b937d34b07fc4d41da01b002
SHA512 83bafe4c888008afdd1b72c028c7f50dee651ca9e7d8e1b332e0bf3aa1315884155a1458a304f6e5c5627e714bf5a855a8b8d7db3f4eb2bb2789fe2f8f6a1d83
MD5 SHA1 SHA512

Submit Download

ReportUpdaterPolicy17895.txt

Path C:\Users\Admin\AppData\Local\Temp\ReportUpdaterPolicy17895.txt
Size 4B
SHA256 69bf0bc46f51b33377c4f3d92caf876714f6bbbe99e7544487327920873f9820
MD5 455831477b82574f6bf871193f2f761d
SHA1 f44217a81173869e08671753c52553646ff5d95b
SHA512 cbc0ee58e447428bdcf72fc8b03c8cfb086edbb14205b918e75ebeff1d85ff1dd254e9dcb387afbd3fa766c803937c306e0a2a79870c0d87abcb7ab93661cf85
MD5 SHA1 SHA512

Submit Download

Tmp32AF.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp32AF.tmp
Size 5KB
SHA256 a86ac1b119a6653e0c3fc24c2c40e44a7bfdc435fd81c4442af9d5526ef64e85
MD5 5bc2d1f7a5fd950dd51547ead6afdabd
SHA1 90f4e48ac87f4eb9dd10f1a80d46a7063f06a7d2
SHA512 45f18bf24c7f1102c17dd30aa205498f27336259ac3869c1d6129609a40385e68d9a2f353e3b13f18f40e7d1d32c4fb31d10f7b2fa204e24e4411183bb749f55
SSDEEP 96:7sX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yQRlOelNMQtU:gULc8pq8RuwdmL4pUQrNyYlOefM/
TLSH
T13DC12AA388D46C05AD17BC04B4C49A23FEB2B2855EC1D1D36258C1A58B913973ADE6ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpD70D.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpD70D.tmp
Size 5KB
SHA256 aaaced351a90b2029c44c6ebb68084a331f296a0ace8115d9889f549d596564b
MD5 42ff6aa7e64b25f09ffb2a89ce7f36ba
SHA1 0dbf44a94dbd6801b3afba7a6c602f39c7d44732
SHA512 47337d9919bc26dedfea1af060dd1fa2ef4a3dcf35c0a84ac7bfe0333b4885a368fc46fec5bc317fe257abdbcab9cdff67104382b60e9a1aa5f755aba604adde
SSDEEP 96:6jX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yKSeTEnXtGbE:0ULc8pq8RuwdmL4pUQrNyKQnCE
TLSH
T102C13CA388946C05AC27FC00B4C89933EDB676A61EC1D0D3625CC1A58B913873EDE5FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpF11F.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpF11F.tmp
Size 5KB
SHA256 27ead591d4c7f8fadd0d9e5d32eb6c9bf8830f83fddf83ddd47e6b3b413f5b75
MD5 5a68f4aec3689d0dc750adcae8e60520
SHA1 ebd8482e30140da9e44bebde6e4da997a7391e22
SHA512 311cfca7e98c8db69d2d599c5845d26a4686d03d1ab1d79237952c008269928ce8434a877e3fe411e967995536e2171844df0db14add053037de278571269a04
SSDEEP 96:zX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4ycOr0BO:zULc8pq8RuwdmL4pUQrNycOrkO
TLSH
T127C12AA38DD06C05AC5BFD11B4D89A33ADB276952D81C1C3325CC2658F913973AEE2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpF9AB.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpF9AB.tmp
Size 5KB
SHA256 e6bcbcb70401d63ff0746fcbcc63230269058736f7644151393edfdcec8b8765
MD5 1b7ade3253fc67477dea69ef2147603d
SHA1 b71e8e749a3461c9b37ff2c3d099b1911d9cc6a0
SHA512 0edd5eb1635b1599e50b368cb254c94bf1588acf1d063e89f45fcfd6fa625e33d2c7764d9d00afd53dec2dfb342e9cfe199d256edcff8430ae183d357d4382da
SSDEEP 96:7NLX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yGtDwwBq:RULc8pq8RuwdmL4pUQrNyGewBq
TLSH
T16CC12AB388D06C41AD5BBD11B4C89933ADB272992DC1D0D33258C6A58B913873BDE2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

89040b85e62f061e.bin

Path C:\Users\Admin\AppData\Roaming\89040b85e62f061e.bin
Size 12KB
SHA256 97875083ca4982a5690020fd9533276b4b2d76ea36b32fe6ca5200fa5253b35b
MD5 d994d10e648f6511117bf60c44bc0acb
SHA1 d6397978e7e783688388953392d18a94624aac0e
SHA512 d9695df7b6c125b85270e7e18839c2d1b76ab9dd9a8bdea1d3f4b77908ec416f70dfcedbb71745f7172fdca5a081d534e52923d42a1a6eef48596f3615d09e6d
SSDEEP 384:3L6+CIjkjpLldwMzR//1CWxNpU4cBTMLlG1tgqpXlLHL6u:uKjoLldwg/j9U4chMLl2phHv
TLSH
T1E642BFDF05745EAB5A833C414E077CA2729FC022573F1B75B1A8A1E42D6F791B0E9288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 320117e4874e393965b1d87483b73740e80f845df8860417ca829ccfd0a553ec
MD5 8cd6edb998a84c96a201f9e0f43c3800
SHA1 cfea04da0414300fe3fa573153fa5374297ebfea
SHA512 45950dca2e7c0fcd6b588a561eacfe0a07aef2704dcbd171699be58238667652d6d6a5c9b0100dbdbb3628cc3bfc20561981bd559e538aefd73bd649737a2799
SSDEEP 12288:147t+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Ktyxknw4FYnshx8OfVe247
TLSH
T19C65237CA7DEA892F86D11730676A231360AB5B49B70C1DBD728B14EE0B0CD0D97E617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 5eb6c2405cee46ec19736eb72ea053fd550f0f6047738f7d29c23e00ac833380
MD5 aea43bfb727fc01b801fb8dc19e51574
SHA1 a7fb273b3e7c36eccfc178958469733b12731e21
SHA512 9192f77fd940ed1108617a63c3e4fcfb4e0247df3f2a16cf0dd6ad4c5625d46d8d7312d68f2db45d010e3e308256157b0e9c3479765d9064d2cb855c43c700e8
SSDEEP 24576:igb6bmBIi49WNNFpg1rSvFv7bY/yxknw4FYnshx8OfVe247:igb4mBIBhGFhx4x8EVep
TLSH
T1A265AE1E22EC02F5E0F9D2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 1cd2707f787eedca60499cf1ceae18d88eb70026bb1c8b4b83d752fbaf950ecb
MD5 f24e8762a431bec0a21f6bef8f8efa3e
SHA1 f8bd496d5ae62bb740a3b6f501d3ad8ddd19c024
SHA512 fe3c6c2c21f8f07ace65acf71f8e47e6a3120d3406cb9320d062a7793e0a7474bb07263ac35ba48c828a6b98dea42b4960303de366df56de0534f7869d647473
SSDEEP 24576:SG88u8FpJqH1azria7/meyxknw4FYnshx8OfVe247:J7ZFPqVla7/Sx4x8EVep
TLSH
T13995F16977E101F1D47BD1388A924663F6B2B4250374EBDF07AC8A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 4493ad1b68114afc78edc7ba72dfacfeeb301743cdfd1b2299a93497a6f6d031
MD5 008aae281872c2daf920bd8a01e5f2d1
SHA1 ee961a9352026926cf31bc50eb0c2e635a09435e
SHA512 dc5eaee0b5171685c3d3e3104cdc1ecae7e4f29dd69a8f94e712b98dbcfc39a94437c9dc3d486855354b3606f5f2b0e99bee82b85791a9d2420e0eb73ef251bb
SSDEEP 49152:jBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjdx4x8EVep:MG05lO43bsix8EVy
TLSH
T11ED5CF6E62EC11F9D1BBD17CDAC6460BEBB23425033556CB02A486A91F23FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5f418e5088a96c81c3f6e182a9d4bf78fba98b3b0cffa0e162728d15d9e6d231
MD5 7e556dfeafe40636938b858d3e420d25
SHA1 d56769406ba69de6ff08e6a3ab633cba1269d3d4
SHA512 0a2a94cbf76b416a59a3aa4544a24c3eb3317b18d0463a348e1c3676339c78bbcdf9c6a75710521eb31df7de67881bb9a837b083afd0c4b0e93ed82a00b9efda
SSDEEP 24576:Nfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn0yxknw4FYnshx8OfVe247:9a5POZ3+Jt2pasx2+m1x4x8EVep
TLSH
T10D65AF5DA6FC01D5E5B9D17DC583861AF5B1342153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 306103031ec3b1e52ad3c7de1635328660fa6744e1e9a5dca22961671efa89d6
MD5 dd45a4cbce0c69bc700c05f56a4d6054
SHA1 4836ffb6df45aaad4510ee90d1f24a4c9e56ed85
SHA512 2110953234bd591c095ca745c4d44ce16e39614b4abee86c072553742d783132bc7ef95b39891115be8d0e5e91a0d0ba35f30e222ce9c2fc6e1b0dddde71192a
SSDEEP 24576:FNcwHdjbyQ4nLC18lb/EOjowL7Fk2yxknw4FYnshx8OfVe247:FNc/zEOVHFyx4x8EVep
TLSH
T12D857B2A23E901E4E5BBE1BE89779546FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 472B
SHA256 9d7407b8bcd4af6820eae7da00db7598246d0f58dc502ef3c89aacbd9cc8a104
MD5 150650f8b4ce06bf6720a55c29275c38
SHA1 c69a908cd7138d119f38c8db07031364b1d21388
SHA512 fcfb7f30078c6e1c43cf272b96b5fbd599fb6ea694cbb79a7a3e40de0eea9e031a4b67d1c2f348d3ab19760b48b67758fd7b4ddd921aab9f3e8d3a064c662bd4
TLSH
T198F0651725F54655E0F75F11DBF990B35B367C456D18846CA0C8031F0CD1A51D872BB3
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 596B
SHA256 550a13ba1f49e521874c12f8908b48d130519016d3abd734b9ba3e3695f2a8bd
MD5 dc1ecc554b3f04dc9600236cdecc8a5b
SHA1 5ae617e99bdded544273928e3e02147405e6a032
SHA512 5c18ad0696a910c5806e952965b6ea6a7943443714eab387cfe0437c5546b6b43c87d70495e5a21ecd284faaf545ab0b6c7fbfc5f89b27ab4779e3cef124f11b
TLSH
T168F03A5726F54668E0F35F15EEF994B31B367C026E19D4AC90C8031E0CE1A61E9727B3
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 726B
SHA256 c89ff4970db3664d4435522769ed127af57f09ba648689de94c00a60572db3c9
MD5 66912ae2193d013c3bf5b8b031c7a36c
SHA1 e5288840baebf03420e92c9deb1a60121f24467d
SHA512 c519bdc0aaf38be5206f763c6ec85e3b1d245ef900c36f2fdfc8865783430e62e09c53fb344e4559e939e4ac40a2fe4e81b79e396264be2dedf9a237cdfb1462
TLSH
T12B01D6962AE91235F0F35F45DFF994731A327C131E18C89C50C8410E49E1EA1E871B7B
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 910B
SHA256 29aad3c953b84d978bd9c489ec6365d819b090264d3f63d55b4dce568fffdade
MD5 a450581a2a8b8beb8dd3de0a9d645c63
SHA1 1bba5a58b4ba51023c189f482055bd4408b20709
SHA512 603c344f420bfcd2931ec5dce59a6bea8e078d8056ebb86f61a6a79c0e4f3b3410000d67e20fa5dcd840d2b9cfc304028d69682b1e118d1c9d7ad9ce27d65a4d
TLSH
T14211C4862AE91275F0B35F45EFB994721E363C532E18C89C40C8510E0DE1EA1E972B7B
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Windows\Temp\ArmUI.ini
Size 234KB
SHA256 790b06745f32e0f56a7af24c871ffce225ba05ebf0d8f8a71a00c727c97dcf09
MD5 cd12a965da4fb66e7f8a07e3f421196c
SHA1 f6377f231362acbd1063aff829ced283a2660b89
SHA512 3fa242c3f573c706e0f36b477ce03f47d9ba0712ef72b94eae4f426dfe21ebbaf1dbebb0981335970b5186d416b4d25e175773796486f39e17de1df0a68a9b0d
SSDEEP 3072:03IJ8zcVOWmxltum8PMkufNWwhEIrKNCpNugYWKOlCIr0YxbFKRWSp4Vf37FbAjO:BxJvW
TLSH
T124342A5667FD1209F6F37F41EEB852944B7B7DA2BE3AC14D1680014E08B5A90DA72B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5b07c6f137840f892c051fcaacdce241e994c2f1110c62f9d057ec830c7b007b
MD5 456dbc87c1b8341aae639993e9b6b8cb
SHA1 e330c5aa413e9d1fc2bfac0a45157eb0fec73422
SHA512 527908ce7b0adefca27988ba16531e425d758bea87f18828e4a12b41db2bf81df86e89b67b48b8bd72798de7e7875caab27e23245578832f5ece43471d5f0e76
SSDEEP 24576:Q8kNvNnaFeYhJNtmZBmAyxknw4FYnshx8OfVe247:Q8MwBtOmDx4x8EVep
TLSH
T13155AF6EB6F846E4D1FEC6B58D238512E6727461073293CB8390C13E4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 215dff7646ba23cdd917f0120743bf4d4cbceda7b9f799ddd12b5b7007dc0850
MD5 ae24416e7479b1679d1ae625b8d4166b
SHA1 90a0c52f3b8bf8d5435317b9eacf4521df58c8a4
SHA512 00f57ba2c423d5f347dd043fa0ed6172c09c920b676ce6f60a319c125e41f1f2d22a2b0f4776984e8d9f16cf9c4a0e41950a505b59870471b5df5bbd5b585b1d
SSDEEP 12288:IHvUrBFrEjwaQy+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:IPUr+NQyyxknw4FYnshx8OfVe247
TLSH
T18A75F12E22ED18E5E67AA17D89924319F771B4621712D2CF02E0817E5E73DE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 921ad54fa9bf1f16f7bfb2a4962b37e9254fc7bc7a33c32ed48d19c938b19c61
MD5 bb56b0f0cedc09bb54e88fcb9e567435
SHA1 e6e980a63bc5c81ad511165e6cea200e7f2c891d
SHA512 ff123cf4713bfa2907e75b5341d98cd729665fcd7fb006404d5903eeef2a50fa8234eae7bc5c7f44bb31e686d13d44f92037760f20929c81093f5d9262713be8
SSDEEP 24576:AD3FHshBIYQgA5yxknw4FYnshx8OfVe247:ADVHeBIAA8x4x8EVep
TLSH
T11885E17DE79C04E4E57AC1BC8A638606E77138A9033256CB02D491BA5F67EE46D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/668-156-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/668-378-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/668-150-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/668-148-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/1276-226-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1276-400-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1276-227-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1276-233-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1384-166-0x00000000009A0000-0x0000000000A06000-memory.dmp

Download

memory/1384-393-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/1384-161-0x00000000009A0000-0x0000000000A06000-memory.dmp

Download

memory/1384-160-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/1728-122-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/1728-123-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1728-135-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/1728-129-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1728-133-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1868-538-0x0000000000400000-0x0000000000568000-memory.dmp

Download

memory/1868-549-0x0000000000840000-0x00000000008A6000-memory.dmp

Download

memory/1868-544-0x0000000000840000-0x00000000008A6000-memory.dmp

Download

memory/1868-702-0x0000000000400000-0x0000000000568000-memory.dmp

Download

memory/1868-600-0x0000000000400000-0x0000000000568000-memory.dmp

Download

memory/2156-209-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2156-210-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2156-218-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2156-220-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2156-216-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2596-171-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2596-597-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2596-172-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2596-178-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2596-599-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2596-394-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2820-119-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2820-110-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2820-111-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2820-225-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3104-399-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/3104-198-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3104-196-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/3104-204-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4736-396-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4736-183-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4736-398-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4736-190-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4736-395-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4932-137-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/4932-363-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/4932-144-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/4932-138-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/5800-170-0x0000000000400000-0x0000000000616000-memory.dmp

Download

memory/5800-651-0x0000000000400000-0x0000000000616000-memory.dmp

Download

memory/5800-0-0x0000000000400000-0x0000000000616000-memory.dmp

Download

memory/5800-1-0x00000000025F0000-0x0000000002656000-memory.dmp

Download

memory/5800-7-0x00000000025F0000-0x0000000002656000-memory.dmp

Download

memory/5800-6-0x00000000025F0000-0x0000000002656000-memory.dmp

Download

memory/5884-195-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5884-97-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5884-98-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5884-105-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5884-104-0x00000000007B0000-0x0000000000810000-memory.dmp

Download