c61e5d6e5a9c7884f970c750f8d01d2e5d3219adbdb5a1b3459095a029d0836b

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 00:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
Size 1.8MB
Sample260826-atts2a1bnf
SHA256 c61e5d6e5a9c7884f970c750f8d01d2e5d3219adbdb5a1b3459095a029d0836b
MD5 fbdf94eb93852b8d4983461960a6fc57
SHA1 66c82d4e6648872effe5f21c4f293eb804e6ecf3
SHA512 52afea2da6334b596a7278bc521b721f8c96693f8de779d200619fb0eef9cfb3789305e65e63f6cb56126e54135a09860fb6c186f44c21bae402d2be8ebf4f90
SSDEEP 49152:4R/ZkBt54kVFM9b3T027O45S40wLRuN2XhaqNSGFbNt:C/ZWQk402i4t62Xh1NSGd
TLSH
T19295A02175428231D461C2B44D29EBEDC37CA8B22B7265CF6FD46F6DAB205C26E35B13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2504	elevation_service.exe
4144	elevation_service.exe
1936	maintenanceservice.exe
4640	OSE.EXE
2556	PerceptionSimulationService.exe
3096	perfhost.exe
2568	ReFsDedupSvc.exe
3472	SensorDataService.exe
572	ssh-agent.exe
1068	AgentService.exe
1904	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\73125d97e05f6396.bin	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\java.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003ec7be6bf234dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d841ad6bf234dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fb62fa29f234dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a1e7fd2af234dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cbcbba6bf234dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000027fff62af234dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2672	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
2672	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
2672	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
2672	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
2672	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
2672	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
2672	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
2672	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
2672	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
2672	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
2672	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
2672	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
2672	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
2672	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
2672	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
2672	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
2672	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
2672	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
2672	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
2672	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
2672	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
2672	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
2672	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
2672	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
2672	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
2672	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
2672	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
2672	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
2504	elevation_service.exe
2504	elevation_service.exe
2504	elevation_service.exe
2504	elevation_service.exe
2504	elevation_service.exe
2504	elevation_service.exe
2504	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2672	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
Token: SeBackupPrivilege	2568	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2568	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2568	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2568	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2568	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2568	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2568	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2568	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2568	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2568	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1068	AgentService.exe
Token: 33	1904	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1904	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1904	SearchIndexer.exe
Token: SeDebugPrivilege	2672	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
Token: SeDebugPrivilege	2672	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
Token: SeDebugPrivilege	2672	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
Token: SeDebugPrivilege	2672	2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
Token: SeDebugPrivilege	2504	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 5868	1904	SearchIndexer.exe	100
PID 1904 wrote to memory of 5744	1904	SearchIndexer.exe	101
PID 1904 wrote to memory of 1224	1904	SearchIndexer.exe	102
PID 1904 wrote to memory of 2808	1904	SearchIndexer.exe	103
PID 1904 wrote to memory of 4520	1904	SearchIndexer.exe	105
PID 1904 wrote to memory of 3260	1904	SearchIndexer.exe	106
PID 1904 wrote to memory of 5000	1904	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_fbdf94eb93852b8d4983461960a6fc57_amadey_darkgate_elex_luca-stealer_magniber_njrat_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2672

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2504

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4144

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1936

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4640

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2556

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3096

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2568

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3472

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:572

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1068

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5868
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5744
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1224
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3032 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2808
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4520
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3260
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3032 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b26631ec35b754df4d54ae3858d1fb4826637560ca19e87440463168c8b08bd1
MD5 ef21bb09af5cb7e93349455b45f09ab0
SHA1 43eef650e9d56c56b6b4ba0647d59e17c0aa6bbc
SHA512 1211a972f4d92afb2ec6284f30d5b38fca93b6b895072acf62bc92453f814c9db2c6495596e18fb33cc31a220f716bd6e747f3a6269a1a55ff57aa09f2a4ccb1
SSDEEP 49152:zb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnk2XhaqNSGFbNt:R3q6tjBR2Xh1NSGd
TLSH
T1ABD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 985e8935946362463722bd7f53b8f3ba1db9dc6017599439f709f77ee658910d
MD5 77081f74a7b8e5fcff627f8e4535eafb
SHA1 7f67e55e237c72db2ac6cef1f60064c23f963c01
SHA512 c3a5e84fb936261ce6daa7d58a292f17378b17ac41d162e48c981c9f5cc64dfc6b2ec90ed0e8751e90ce802bf5ddcf2af5316e37a814fc8ff66de32426f3c183
SSDEEP 24576:RXYfDtczAu8g0kdxdvGxdANf6wJHFbv1ESRk:0tci2XhaqNSGFbNt
TLSH
T1F305F12867E109F9ED678239C9A28506EB33BC1647A0E7CB03A085651F733D85E3FB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 5a5912ad64f9947820268ed62240e95d1a1a7088443ee091946b7405d27db74e
MD5 81f59fb853b0768ebafa37d4cfaaa157
SHA1 c9e819999cbd55a9bf77273049767ca837ad622b
SHA512 976eb2ad4b573d51b91845af42861b3de788abeb2bf7014d7bc392df4cf960e8714330ed122355649db346ff80e480b8c43ef1121813561d3266a19d42894da3
SSDEEP 24576:s0Le5ji0hmxnrMH8g0kdxdvGxdANf6wJHFbv1ESRk:sPji0AxH2XhaqNSGFbNt
TLSH
T12B359E56F6748335D073C0B9C5D2A68EED7230465B308ACB4286C77C6E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 eaa346c22338b437899a50c370bd8cefc76427861091a0c913d18af01eaae4ec
MD5 8c4ffd48e0f59619747b661e4835147d
SHA1 c106479228868da24a4a53f7b43d7fdaa0cd9716
SHA512 1fb9208250e818d86039ee21249c26a4683db07592e0fa63657e18164fa4b82be2ea71a2e5843c01187ea337706be1753a39ef07949d2980575f60f3f0e12062
SSDEEP 24576:0a7/ezSC6vUyDZaqgrvWx6q8wyux8g0kdxdvGxdANf6wJHFbv1ESRk:j/ezSC6vURPvMHjyD2XhaqNSGFbNt
TLSH
T181755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6ef52f699e4d902cecbf54dd87ec69651b3cf61bd3f5ec2112108620acf6c410
MD5 a4fa8d29035c3c03d958fd8cc97d927e
SHA1 802c48aceac25f629246e122fe82c13119667e2b
SHA512 d55f73f04d316c2dd3ad6743cc181c479f75cd5259313c5d1a2f092ab96ef9221136a6e8b943bed068f4af2ed497dca210b2f488aee4b42a9ad2534017bece55
SSDEEP 24576:9VbqPb88hv/lV7C8g0kdxdvGxdANf6wJHFbv1ESRk:9VO88hXlV12XhaqNSGFbNt
TLSH
T14C559E66F5748331D073C0BAC5D3AA9AEE3234425B318ACB0246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 bbef27fc5312cc1d48d2ab8e8d615a49f4793fe0744a191db14192c703bdc313
MD5 2ed7fbe5437ff19ba5cb00550bccb709
SHA1 0bdf7d41ea2cd79bba50f2678e992fd1470d1dae
SHA512 9eb17a0f54151d1078f4469821095719fc7e8cb0a135f58f2e1fc2fb68aa09905a6697906f879b306b41d86b8b95096a4cb640cd9ca736e2bb8473b52a4ef76e
SSDEEP 12288:oGbkZJ88o0kDxxdDCk0PxWebANsE6wqwpHFbv1ESKIK9qKUar:oGb8g0kdxdvGxdANf6wJHFbv1ESRk
TLSH
T19DC423888BA25099F777073156CE4E0EFE3BAD23F8B14E864D1295640AF83A5D53720F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 6097ff1677ea1945df46b85f25bccb444057f076ddf0adf37cf4fc4de9ec7bcc
MD5 05002f68bdca05870d3c057826ff8c6a
SHA1 4e3198199cf0ef0832a9f7f9f115b5388a14d4ff
SHA512 c42089cc6880f488790ef13567a98a48d00d2c0f6fa8cd5340616932d7852c9ab8e601be3342839f937b433dc62d333d4379a165c3a990f086e1557349a18e1a
SSDEEP 12288:NeBNUbTVO86UKkZJ88o0kDxxdDCk0PxWebANsE6wqwpHFbv1ESKIK9qKUar:NJIUK8g0kdxdvGxdANf6wJHFbv1ESRk
TLSH
T17805CF7BEE28FCD2C27A8D7856918700E77278314F6293CBD165820EDE236E15E7AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d8c23255596b8fc0d5779b616335c702c85839790a0ff993160339d5c6666126
MD5 a83acd95b135845e4cc1c523998569b6
SHA1 cbdc4fc0279a1e52bf7bcb837b6cf4373c43c552
SHA512 32f3560b39ab1e6b36440ca4b9e15c48b086fe85ffb1e3014362e3c94c117916e6d16e418505c357a0db6621f3e85f4a4cea5a46d96c5ddedbbed31b27293755
SSDEEP 49152:JQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THk:JQvGAdlCEL8c/pRNw5CC2Xh1NSGd
TLSH
T1D0266C656BF880F5E0A7E134897AC6B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 e52c58daa20319a33c4a7ff4c5f0b989849255e281f147901a3f962a94b236fd
MD5 be4d870672e1187f5bbd2bc9c1d9a86c
SHA1 af6ba49e6f39d775788bb34ef606375ed8c4d402
SHA512 b19ece04a6d191627e5fb5510ad08cefe9ce209dcd5ff453b095acb08d2f3c27a2344feb6c08c8dffd564d3dfc3fd964253620d0403bb2019451671ae7a7b874
SSDEEP 24576:LwewsAjE8g0kdxdvGxdANf6wJHFbv1ESRk:kljX2XhaqNSGFbNt
TLSH
T1AD15E031FF75E036D37B0DB21B26C706583DB9204F611AC3E3A88A9D59742D22776A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 70090087d95001c477beed422bde47b9b366bec073b216a40b967b89a6b715bc
MD5 b3b6402c91e7428c292ed86225a13df9
SHA1 9a3fdf51416a408e34639758df0ff3b52de8976a
SHA512 8853ad102fe73f8bbec323d1ebc8749b1f4c7636d0777568a47910483f25fcd5224242fe43ba70953c5e727d220d9055ebd3694ec9e73ff3676c314f9399a123
SSDEEP 196608:gUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHMp:gUEtQevvqc2W1cpV29I32Mp
TLSH
T1C9474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 504cf824dd14b7039f11c65dc016062b882538788e5a80c97f23bd11a6ffcd7d
MD5 4ea4f96a5be756ba6eafda504bad4e04
SHA1 c9f0583e4c4e7ddbf0aa01c75f74c32852a2a180
SHA512 54dea983baca2b3a42fcb0080977388c89f5a10e43aaf42d72287d719ea71587fa63e0283b3f4d0a3013ba748592869508fc5921ca1371336ecffd2aa2fd807a
SSDEEP 49152:YCbRquA/m2yL5zLfFiV+XenmE3/z32XhaqNSGFbNt:Roq2Vjnmu2Xh1NSGd
TLSH
T1F9D57D0976B881E4D1F6C77886A2C647F37178154B3197EF4266461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f30f10fcf22a8045f9f7d54b36b52501524ad3dd6045148116d383b9e8d76d29
MD5 5627dd84f779ac32259ff521405ef738
SHA1 6f88ca39d3df43bdfbe4b11dc308f3750bca1006
SHA512 61f547c2d95b2af3260423a21466691bc9353ff6f958928e057d463bce06afbf95ea0fb6778caf876792fadcea408e0ca40283fd5d1eba5ab48a2dcbd1bd524f
SSDEEP 24576:ZAhGLmIFoiwtA5l7S5398g0kdxdvGxdANf6wJHFbv1ESRk:ZAM1Foiq5+2XhaqNSGFbNt
TLSH
T192359D80EBF955D4F5B3AB7899B68571EA76BCA65E31C20F2160C11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 2ffd8ecf835fbe3534b71033e458c2f66a3fc1a6da991f44b4773402e587b216
MD5 21d8a7d9df2f914468d14e49f7f1d93d
SHA1 f273ecf7ab7109475e0f5f9280f16017a8969c1f
SHA512 38fcfd825b8b364e63728188ecca858c5fe01e211085ff9b6f7f713a47ed8de52a6ce86bb760f4ad1e49fc9fa4be3c621370ba06f2a8bbf58051fb24e333190b
SSDEEP 24576:fwuXOWg8g0kdxdvGxdANf6wJHFbv1ESRk:fwQOq2XhaqNSGFbNt
TLSH
T1B105F14977A51CF9E967823886878536FBB3BC123A21CB0F0760C65B5F77361AD2A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 188be1fec698d95675480ddacbacbf9cd9478092039c5a319f07fe8707ce45b3
MD5 cb0173b31fce161c9980cf78a803220e
SHA1 ee629c3f8b4d9dc4d16f4ebc45661b9265963813
SHA512 5bde39b0e7e2a363ddf595395d9799c112182b6c293b2dd1a6446131f0ad2c1c286c9f79f2e5984b6cd7fc00d9d72c12adc872cb7e87314c957cac1ddd55d222
SSDEEP 12288:cbZ1Iy0kZJ88o0kDxxdDCk0PxWebANsE6wqwpHFbv1ESKIK9qKUar:EZuP8g0kdxdvGxdANf6wJHFbv1ESRk
TLSH
T10CE4128927E170F9E2A74338C9E54A09EB737823777243CF062142651FB6BD65D3A326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6795a55f2ae153cb59cd63d240e6c7418b24265070f774e4e4610ed170b36682
MD5 b0ac3adfefb4f1b2d55f3082e0c1adab
SHA1 002e1664244ead56595c7d8e38804715ce170565
SHA512 56a37e08b108610af56388d7d7d7e63bb73b8cb0c1ff46a778cec102e9ebbd4e21107011ff2ba35b3de2c4bcedcc653df246fcd1fbc3a2e4c4d89858b199c9a3
SSDEEP 98304:hQRQyi36YOcPuLvw2gAf+PN3l2Xh1NSGd:4QyiKakX+PNip
TLSH
T102667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 da48dbc92cfda27e154406f66e0e66a89420dbb4828f1f918a8fcc5979af2dd8
MD5 dde0dfc4e567abef8679305bebc42111
SHA1 0ab3789c45728042aef312ab23cdd2ae637bd3f8
SHA512 77bcf7c1266c470f9abc44fee1cb886e352b2f5d7ffb09a08d850c606e34c6852bfb06e4badf1fb809f8a903d816103de29158b6ee2511967b911543ae69c667
SSDEEP 98304:xQRQyi36YOcPuLvw2gAf+PN3l2Xh1NSGd:oQyiKakX+PNip
TLSH
T1C3667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7a15638d4667142a57ec2593411ecac25520c8f6f6d66959699be8bb78a3c463
MD5 294c4a9734330063a1f2835f217140d2
SHA1 daf9a5bdb79d36e53482cab07d40609a49ab52a9
SHA512 470c2de0f8c6c37cd6cb3de69ec9e852e7ea2c45a78ddaf194ea275aa559059b793b58d6a93b419bb8875a4f147ca3ef6544cd7ac799ec3ade177ac637001c38
SSDEEP 49152:i68Qg55nhxeWu7PNU3/H2XhaqNSGFbNt:gthGRc/H2Xh1NSGd
TLSH
T193B54933B2F200A9C44DE1769F4A872196D27C75CFE1E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 bfc5b063288628fe0abbeedc0478a692346385fa94956aea52edcffbec1f015c
MD5 6bcd55bbdaba7cc9cfff159fc36cf5cf
SHA1 3a5331d8056c2a49b2b111135c035a3d1cb0affd
SHA512 20cc1f6654a463d9c44ebe3f154c6bea3137a613e71a8713ff52ae8136367638e052a38c5751126760578c7e19a191ae89f5bc3015da60ab923c9f8303bc2720
SSDEEP 98304:fy5112gYy5azzVvD69nLKnhZQ2Xh1NSGd:SLIH+WhBp
TLSH
T147167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4c8fad48a485490b4dcd5b2dd3d8080ae55bd377e1f2b52fc9b9c83ce8dc267e
MD5 d34381e9b70673ef6dc971ad4f023bb7
SHA1 6def269c40e978d6b2b52f1a6b784ad7d4bd8c35
SHA512 f4b517d2bac4b73174eb3bfb61b02e6fadb57505fbb5c8551fa6df83242670c596664c56fbea31edc69fac9b2d8091ff2c19fd47a3b298d931bff52b513d798c
SSDEEP 49152:aB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gld2XhaqNSGFbNt:Iu6JmQxd2dd2Xh1NSGd
TLSH
T11DD59D13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6fbb41a91627000ee680ebd981837a1eb76b16818c671e8c18f0eff0548bab7f
MD5 a6b9f4590ff073384e22662483f22a10
SHA1 d9875e678dcfa4299a43f87e4b4bd5b9c4917506
SHA512 f5bcd1838ed3d24d90e3157dab9f193047fce782c59a8e249006509b07e1ff17863b8fe9ec824c21eec5e1c30d434e89d629d5c8d28c5566c59b95e00ed53f1e
SSDEEP 49152:u1hpsNoJpF1A6yU44CwH7R4xZ2XhaqNSGFbNt:umifPVRu2Xh1NSGd
TLSH
T12EB5BE13F2D901E8D06EC17887569632EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2c395955200769de614a192ed432fd1907779ca1625b3708ef4d20f8aca15376
MD5 adb6e0b7203af647f5fc900df7b87627
SHA1 9cc9b883a15a2720404a1c6944d382cb2434e30b
SHA512 9329e776976f689ae1daed5bcd710b5c4829722da60a9868eb574c82fa07e5efc2cf296686d4d1d34b20cf5781429e8b1bdcacfe84235081c7fba7154322d55c
SSDEEP 49152:HSuZQIY0Be2KIRVtOnks6NMHq02XhaqNSGFbNt:d5dKOi6102Xh1NSGd
TLSH
T18EC5BE03F2E941E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 68a41f81370eb60a311eca631d228a08c3741d4cb58da35dc09775317f96b71a
MD5 99e215d9e701c09799f00b967c89c027
SHA1 4088d700772ec24baca220ae1cb3afc14468a467
SHA512 77e0035beb46769c02f70ce5cbd64fafd6b8e3956fbb9a5d2b4a43b2cffbd41f509ad84fe5657c5732e38ef8a4bb31adb979575fd9478cea6e092b48e9803cee
SSDEEP 49152:OhtSn8EApI0figGgiDn0AP5wt2XhaqNSGFbNt:PX2i/phK2Xh1NSGd
TLSH
T1FE95BE13F2D901E8D05ED174C7468632EA62BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 35c8a7cebdb703ff46f323c90d33c2f4f39305095ba11f4cb780ebc58775bbce
MD5 1fad12b0569401ced5364e4121c4bab1
SHA1 29f09658d65eb42078231c688689e1cca1654ecf
SHA512 caaadbaf644df5c2f298e4886a8da4d2b3353166412e72f8d3cbe55437977c94be51440dcb8d2b413128e6648ebdc6e531f75bee9c6e8f39e14c67c0cd0337fb
SSDEEP 12288:uDkZJ88o0kDxxdDCk0PxWebANsE6wqwpHFbv1ESKIK9qKUar:uD8g0kdxdvGxdANf6wJHFbv1ESRk
TLSH
T128C4238C9BB35599F226473186CE4B0EFE2FAD27F8B206C65E1281204BF87A5553714E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 78a24baf62fa60822183f6bad8a65a9d81972ec6ea138713dc1bf317c1d2e00e
MD5 7125d2ec744c945e7cd8e36d7f71ef7f
SHA1 092ed6bc7cf040167b82dbc4462c57108b8e6504
SHA512 199f70ca877ba95daf0fc1331e4114d53ceb582f70686830dbd137d29bd535a04cdc83472f6e48636ce1ffb11e877ba1dcbeb8656685d87b0e4ac92015295402
SSDEEP 12288:94kZJ88o0kDxxdDCk0PxWebANsE6wqwpHFbv1ESKIK9qKUar:948g0kdxdvGxdANf6wJHFbv1ESRk
TLSH
T1DDC4238C9FB3559AF2264331868E4B4DEE2FAD27F8B206C65E1281104BF87F9553714E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 1040a2de605908fd7bf547e5b70f648919dffade203aa366ffbc3184770ca49a
MD5 ba0abe1f8cc3aa0f2f012957fd4d0b65
SHA1 cfbe9dcc2eb18a69c63d735e8e17c0c05b0fb75c
SHA512 80c73700d68f0a4ebf20eba9447cfcf0feabaf7480da82e6c8a488b5dc70c1335a81e3f58d4c96978f8aa21e14da92923389c80e8b3b5e04bcdccd9476c408fd
SSDEEP 12288:lSkZJ88o0kDxxdDCk0PxWebANsE6wqwpHFbv1ESKIK9qKUar:lS8g0kdxdvGxdANf6wJHFbv1ESRk
TLSH
T19DC4238C9FB3559AF2264731868E4B4DEE2FAD17F8B206C65E1380204BF87E9553714E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 dd9c925048d9aa2c4d150296242bce6c325e78a99f2eb0e7ae7669e3fbb24c5e
MD5 8fa2f48f39fe5bd28e5378ede6a18c19
SHA1 b6114e62f63bf34c15d97e7892e799cf33897d5c
SHA512 16089d4dc5a37a3cccb189aed4208a4ecb7c9b03b6a501a5af5022328587c74acb93b4ffcf5c88a1c99389bf8250e50ac719777bca5b0d74e4f98759ef9635bf
SSDEEP 12288:RVdkZJ88o0kDxxdDCk0PxWebANsE6wqwpHFbv1ESKIK9qKUar:R8g0kdxdvGxdANf6wJHFbv1ESRk
TLSH
T1C0D423895BA251D9E5628330C69A4A0AEF7BBC27F97247CF4E1245140FF03E5A93770A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 cf2d692eccd655f0e22b840e95f4c0454f45ab5ae5244698f3ef6f7e84014a4f
MD5 af5e33c167d47598d729a65cc3f3be67
SHA1 dcffdc2443b9832ed8a690d3541111e5d05fa222
SHA512 888b9266f30f69923c93edbbacc4fd0f1bd012ca97adec3a81a9e3a300a9377255e3d213230e1045cc1fe01c880003e67072388af43e8435406eee6409cfb684
SSDEEP 12288:h1kZJ88o0kDxxdDCk0PxWebANsE6wqwpHFbv1ESKIK9qKUar:h18g0kdxdvGxdANf6wJHFbv1ESRk
TLSH
T143C4238C9BB35599F2264331868F4B4DFE2FAD27F8B206C65E1381204BF87A9553714E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 5e3bb2663a385c49bec4aea7b8d547d1e75efc2065675ca6fae921bf31c25139
MD5 39ce58896964e11b4561c00e8777d7ea
SHA1 80a1e7e7ca6cb99678db79a0e71b0608f63672e4
SHA512 a007f2e8bf63c13a37a3d8205ea62f3dab156907d0c3e2b8a109d809486b77a13c29ffa6823ed746cea49a47808ae1d8cbe83a97f6bc05d575486378a1c6f225
SSDEEP 12288:9skZJ88o0kDxxdDCk0PxWebANsE6wqwpHFbv1ESKIK9qKUar:9s8g0kdxdvGxdANf6wJHFbv1ESRk
TLSH
T153C4238C9BB3559AF2264331868E4B4DEE2FAD27F8B206C65E1281204BF87B5553714E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 3755bce78a98d87cfa516bb77d2db1eb8b9c1dd1aa04cc88fa3cad73eb01caf4
MD5 1f9164d78abdbe033c525cd92e79e351
SHA1 bfd8a1b8641bcdf10a6dde9e6faa1b9fe53e4947
SHA512 82424af7828dca15a87b72d5fbcefd5c2f22cbb51a7ba577d1b73b8f9310afeed0e6e4bbb040ec058891700ad916b66c37d7dc32f9a7aaa82d1eb736c9bd8fae
SSDEEP 12288:wwkZJ88o0kDxxdDCk0PxWebANsE6wqwpHFbv1ESKIK9qKUar:ww8g0kdxdvGxdANf6wJHFbv1ESRk
TLSH
T13DC4238C9FB3559AF2264331868E4B0DEE2FAD27F8B206C65E1381205BF87B5553714E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 df93b0f42dd20a4b134d8962275abfb7577f64aac79db8a4d651ff23182e54f6
MD5 26127796e3cfe9bb46a772d112b99e5b
SHA1 b413bef698c3ba04b197c1153dafe2aee8045d00
SHA512 b9cb252c466b82acc6ea43f6c913b73a599c8e1e8dcd20c9ba4487a9b84ff0ec035707a0d4ce15f3fc26d176993bed3268db89a7f5d2aa8ddb3e33b2faa70624
SSDEEP 24576:HZMJzFVSOY8g0kdxdvGxdANf6wJHFbv1ESRk:HZMJzff2XhaqNSGFbNt
TLSH
T12F050298B3A018F8EC67823EC9558906D6B37C1A5B70C64F07B436265F733A11D3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 5c3a5f9168f31718636303a2071f77ff1614cdeb433e183351f5d01a0132f7c6
MD5 74a44cc4931fdd2cb11916dbbbe22614
SHA1 ae8923c4dc82f860f74cba682c48b818e2938809
SHA512 d2cb6fe95a7ccf34af30012e1591c58a2dd5f0f5417db3977bcd2772fe3cf5745868425c790ea7e4ef67982e98679f566d9d187af1e88e29848e5d1ea06fa21e
SSDEEP 12288:U/kZJ88o0kDxxdDCk0PxWebANsE6wqwpHFbv1ESKIK9qKUar:U/8g0kdxdvGxdANf6wJHFbv1ESRk
TLSH
T1BCC4238C9BB35599F2264331868E4B0DEE2FAD27F8B206C75E1381244BF87E9553714E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 e13b2465ca9c7f73dbacbd2ba5085019ed699c3a8c997b8adc3b4b1ffed2237f
MD5 d07fb1ac016028cd3a9fdaf84c53b865
SHA1 8cb59278db75b609400e0983d245e9ea9c874092
SHA512 db7f68c63058f67747fbfa9cbdba3a2266c50c1758c8374df1bb5bb7fb409aa3568cc381ac83520cd34c527d3e77aca6eaf804dce17c60d5a784950192052b8b
SSDEEP 12288:6LkZJ88o0kDxxdDCk0PxWebANsE6wqwpHFbv1ESKIK9qKUar:6L8g0kdxdvGxdANf6wJHFbv1ESRk
TLSH
T1ABC4238C5BB35599F226433186CE4B0DEE2FAD27F8B206C75E1381204BF87A5553714E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 d8fdcb0c69208d69f7b7554ff99171544aae27bc761b6c661db15d7f58b858ed
MD5 fb023bf7992d771e25d4b1d044276247
SHA1 0c3958e3e0fd39efb5c445f8e2aaf49f52c87afa
SHA512 0f7028152a99d8b88e354f8f24309c0c5227122425f8f8cbbe297a0bd3e8ac99db88cdca1d030b6091a2a9981ea9802e9b7e10334c2d0e58467d63badcd0d3f6
SSDEEP 12288:wyPz5L80kZJ88o0kDxxdDCk0PxWebANsE6wqwpHFbv1ESKIK9qKUar:Bzy08g0kdxdvGxdANf6wJHFbv1ESRk
TLSH
T139F4024767A230F9E1368334C9960A06FB76B8325B708A9F176042761F777E19E3B721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 d58a4ce4e56c9b19de7fcce3947170ee51000647ff4366da762a314ae9e58bfb
MD5 b500211540677451b08fe2a122e2febd
SHA1 965089204e65ffeefca93a12fe264b27047b15a0
SHA512 e04561bbdbcdf3cd41d721c81fb2f5e543683099f8b670977d3196ca8a2b5a70a5fae6ab113f83de40bc7486f33cf2c9b4a61e48154f637c5da77bbe27c985b6
SSDEEP 12288:8/kZJ88o0kDxxdDCk0PxWebANsE6wqwpHFbv1ESKIK9qKUar:8/8g0kdxdvGxdANf6wJHFbv1ESRk
TLSH
T127C4238C9BB35599F2264331868E4B4DEE2FAD27F8B206C75E1381204BF87E9553714E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 cc12fe834ef90a8399a3a8db6782308c2cd1e387b42a7e4a97c31c876be779a4
MD5 677d10233b7ffb07055a98226a8a7e29
SHA1 bd04ec84a41f3fdba4637850283dec30f93a04e9
SHA512 8c091e0f480cde666e45aee1c6c38f76b54136d212ea0bb4c8ff1301ef503c24e9ec8c4722b443131e645f9b1ca4cc600fe6126b498a4856b094f94783932c44
SSDEEP 12288:z/kZJ88o0kDxxdDCk0PxWebANsE6wqwpHFbv1ESKIK9qKUar:z/8g0kdxdvGxdANf6wJHFbv1ESRk
TLSH
T14DC4238C9FB35599F2264331868E4B0DEE2FAD27F8B206C75E1381244BF87A9553714E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 b46e5fc482ba2521c7662eaf2b4fa8424dd10b4554c5ae59bd7ae465e1b3fb63
MD5 d14b998523adaefcc89418cd501e30f1
SHA1 b4bdcfe858a71a86594f64b8aca98c293ff4c5b4
SHA512 06b167c4570b043a023a550606a7d6326fd773b8fffcce661d3055040fe3967c72b6c3559a399fa67e14229f10c1115e392475fe901847710f8199fe5c06a0e0
SSDEEP 12288:PyPz5L80kZJ88o0kDxxdDCk0PxWebANsE6wqwpHFbv1ESKIK9qKUar:izy08g0kdxdvGxdANf6wJHFbv1ESRk
TLSH
T124F4024767A230F9E1368334C9960A06FB76B8325B708A9F176042761F777E19E3B721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 c983bb1a182f054c6a10258b0d60de7cc38ea2e6d9367658221ec64c6468ca3e
MD5 9726ed1cf3324da801dfb53469a7cd7e
SHA1 96635d5ba098611b6e6bea0bfa2f1d05e6b10395
SHA512 36fec0e1666efda2e152a55b1b79251812df2917f714da3c1e33802a915af489a5a8ddd085dfc593066c8b4a445c1d9a8b76fdd200618e55896e48f52e5f8343
SSDEEP 24576:HTuaLl3z0zDi8g0kdxdvGxdANf6wJHFbv1ESRk:HTdLljy2XhaqNSGFbNt
TLSH
T138050294B3A018F8EC67823ACD568906D6B37C1A5B70C64F07B436665F733A11C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 da4f468613b127d6ee5fe0724f7e70e2896986af9677ca67837c720ba2aea462
MD5 ef3a46406a798f380fae2a0c168979fa
SHA1 58e0da389de19603dbe4b27ef533beaf42bda1ba
SHA512 3ad2fd47139e258502cebdb818f83d10ef38e112ad992d3e93bb4e55da2ebb3946fd740cc6c7fb48e151763aff68986cdf8b7f47e60ba799b648a469a4781341
SSDEEP 24576:I3xd9CHKy7GZ28g0kdxdvGxdANf6wJHFbv1ESRk:Sxd9CHKyaf2XhaqNSGFbNt
TLSH
T12F25CF90F3E414E8F1B78A3589764502DAB67C5A5B71CE8F03A4661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 811914530e11406f479513ef07b25e1fee8816f310d9242c01918a218028da1a
MD5 a3b644362a369a1dd4be90b56f47d1e3
SHA1 4b9763e8db1674cb4e9e0037392551a11672da99
SHA512 3c9c0fe41cb86fecee85fc3a69fb79122c14f363823e83be5dfd5fa29abd8dc74b22a143d534a465e42d5e825a3f65c8ea82992cb2d668b848d47938f628ad40
SSDEEP 12288:LykZJ88o0kDxxdDCk0PxWebANsE6wqwpHFbv1ESKIK9qKUar:Ly8g0kdxdvGxdANf6wJHFbv1ESRk
TLSH
T1C4C4238C9FB35599F2264731868E4B4EEE2FAD27F8B206C65E1380204BF87A5553714E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 74cb035d395c78dd5cc28e0ea1ebf305d53b56ab123da2b10f75e996d9b1ed79
MD5 a64a41e92da86a98c9f7a91db0c10d12
SHA1 c08141e2acbb86e8dccf75a7e8a6fc7c9e7201dc
SHA512 2d1b7eb7ee24e8dd3d1f38d1333473a3db58032d8896ea17e262c2f15f2084c20945ff01fd4c01bde8337d1c19ff3f24a636ed530f58f829343527276bba2806
SSDEEP 12288:uUkZJ88o0kDxxdDCk0PxWebANsE6wqwpHFbv1ESKIK9qKUar:uU8g0kdxdvGxdANf6wJHFbv1ESRk
TLSH
T1B2C4238C5BB3559AF226473196CE4B0DFE2FAD27F8B206C65E1380204BF87A5553714E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 3d01f66a9e961d3ea56943edd22c487d424ecc890a6daa624d06edf95443fca9
MD5 8eccf9dc2afb7c9fb8ebf670b96d365e
SHA1 2b92c69f4734afb8d9870cb9912d5ef0d55f6129
SHA512 0e549bf39d10a384cb9d3788199af4372c4449f1d0256d28eda748184962baef856ef87d44f3caba4783df9a8503c0a470ad1a1ea6e713c4985c99ce10b1fe96
SSDEEP 12288:mJkZJ88o0kDxxdDCk0PxWebANsE6wqwpHFbv1ESKIK9qKUar:mJ8g0kdxdvGxdANf6wJHFbv1ESRk
TLSH
T179C4238C9FB35599F2264331868E4B0DEE2FAD27F8B206C75E1381244BF87A9553714E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 d6421007bc85c34d858591c97718dd2c6ca3e677543f4fd8677e9326fccd1ef1
MD5 751e2bcb055f511aa8f4912173b446a4
SHA1 a095805b93fee60bbb7b6b7cb427cc30dab4685d
SHA512 2bfb84d6f5f5d2cd878a1aebca02b316a32ec63b200725ba3b8cc2204ee24089b22d436541a020a8d990e98dd7d0a6e446ae5b3493b8362c5a3cd62ceaf462f2
SSDEEP 12288:f/kZJ88o0kDxxdDCk0PxWebANsE6wqwpHFbv1ESKIK9qKUar:f/8g0kdxdvGxdANf6wJHFbv1ESRk
TLSH
T177C4238C9FB35599F2264331868E4B0DEE2FAD27F8B206C75E1381244BF87A9553714E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 2b95dd038ab4200e389717bffe32f09964076a5faf77f72bf21329a73eca4c30
MD5 c43e48da9e00125d50118643173da5ea
SHA1 e1319571a1e8b6937b6ffdded60218e28d9b6985
SHA512 b5a1e4fa62629e9291db045e3cae42fb4f00334cc356a4008446df0fc863e3be2f40ca7962a9c0a071da77f4c8ccdb0dc94f2bb18a0da5dd69bc1584faa48ccb
SSDEEP 12288:5ykZJ88o0kDxxdDCk0PxWebANsE6wqwpHFbv1ESKIK9qKUar:5y8g0kdxdvGxdANf6wJHFbv1ESRk
TLSH
T1D7C4238C9BB35599F2264731868E4B4DEE2FAD27F8B206C65E1380204BF87A9553714E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 9da6507feedbb20013d7cf96566ac8155f88a5fab3fcac8c78752874066fb672
MD5 fa7f2f048740000503c5b26d4346312a
SHA1 824bf0a42fb44be305d970e76e476048192d05c4
SHA512 ea2fb93545acf65eb1081a0ca7c181a4ebf6373068343f284299544ac01724ea8922f0011f5c12e74d4aa7c2d8db2efe8a438aac50e260b5823e070f6cb78603
SSDEEP 12288:HXkZJ88o0kDxxdDCk0PxWebANsE6wqwpHFbv1ESKIK9qKUar:HX8g0kdxdvGxdANf6wJHFbv1ESRk
TLSH
T154C4238C5FB35599F226473186CE4B0EEE2FAD27F8B206C65E1381144BF87AA553710E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 bf026ea5b5970e2bda77e551b1ca8cc61e519e26e3b3e8d90bd74f6718b999bb
MD5 ef5b62d388f8d6a0db66187b98ef9efe
SHA1 581bb4c0fd75a6bfe1d1d64c3d054ec53471a476
SHA512 f84b89fc3511ce7c69714f9ce08e499dc6d2cf753829c65c3a1d43e1f13c538f35f2173ec79dd508232b0a9e1f664f32097cb0af1085fb17ccb23db5d9802be2
SSDEEP 12288:X1kZJ88o0kDxxdDCk0PxWebANsE6wqwpHFbv1ESKIK9qKUar:X18g0kdxdvGxdANf6wJHFbv1ESRk
TLSH
T128C4238C9BB35599F2264331868E4B4DEE2FAD27F8B206C65E1381204BF87A9553714E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 6cb7ccc886223d5ca5dce8d72eb30738dea53ab70b4d592fad32d33ea3522420
MD5 1122e92c5958368afd3fd6b56948dcc1
SHA1 e8be814ccf1d26f06d3284496c2830720518d4cb
SHA512 e0cf465d9c10f7d3b250582527b21db68c1aeaea4b1a62cd4f6a6c1676b94f62f0c8f324ddb2261391c48a452dcb6a8cf473bf2549e2903acd8fe01753b70f1b
SSDEEP 24576:UfwvOk9RX6wkyAI78g0kdxdvGxdANf6wJHFbv1ESRk:aMnYIw2XhaqNSGFbNt
TLSH
T1B535D029EBD844E5E1B7923C89B7460AF6B278291B31C6CF025A536D0E37FD45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b64e0d21670dd28cdec184eb8d7355e19357e7eb82ec86793c8b25bee1606fb2
MD5 9b56a4294a11926a97f80543eb587993
SHA1 babe514b5f65a64b4ed53d1cec4f45f947a8e742
SHA512 00fbb69769ec7f84d55d362bf0d218658421b55001605f2bdd0e2c99def905fdaccebac3f64ed5ac51571ffcc8cc934c0d402d086602c1322e05d39e8d73653c
SSDEEP 49152:IYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0N2XhaqNSGFbNt:0ySzPF2Xh1NSGd
TLSH
T144066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 0ff2c13d5596d9da05a499e156e114cdb75b82e3f7106eb9c9f016948c3c7dbf
MD5 bc2cc413f52e034f8c4b64ffaa20fa99
SHA1 762f542ea510475ca876cbe966f25fac575863b0
SHA512 6c22db1f0b623d8cdf47a57e2393e6d660c04eb61dd7819f1034aedb1b81787a59bdcd5f98f11cbc93d1044f2cd517e03ff83de5e3a486711b2878577d44e906
SSDEEP 24576:a47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYI8g0kdxdvGxdANf6wJHFbv1ESRk:a47JUQjairIhCnDHUPfF/d2XhaqNSGFj
TLSH
T1C165AE1DA3EC01E5E1BA827885154A1AEA71782E6F31CACF1270837D6F63ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 6678020d80c737b2bda0e5046426704ec34d5f3da751bdb9e477ab6ba0c22ef6
MD5 dfc2e90813f99bfe14bce0274b979e5e
SHA1 c3360a8136ac5a216ba0d32562bb2a8165429791
SHA512 32c0d45b8de1e047fbb2e2fe826ccbb999316e9abab1e219402ec0ee6405b72bf47e4fa11d111b59bae0071ccff0c98b63b412ea6c141f3263a451709d1b598f
SSDEEP 12288:IksfPkZJ88o0kDxxdDCk0PxWebANsE6wqwpHFbv1ESKIK9qKUar:yP8g0kdxdvGxdANf6wJHFbv1ESRk
TLSH
T126E4F049D2A402E8D06E5235C78A4A05FB377C26A7F193CB56D0F53E0FB96909DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ftstate.ini

Path C:\ProgramData\McAfee Security Scan\ftstate.ini
Size 681B
SHA256 88a3c39ae59a17e59cf90a6a996d8264c895972f672e9ea223a0bf4ec4122842
MD5 c240ff07bd110d532bee63c438e005ff
SHA1 2becc1323cbb5fdf60bab53b8b343d4343bc0672
SHA512 4231aee9b2dc1b6ec4eb046ec4fa19921364347c27d77c18dd2e92ba022542f5991cba9fc3623871a92bec89666ca4b406ed8878fc7f69346091086305c899a7
TLSH
T1A1017C52D5988EB79D1AD1D61270114AC7F5EBC00B82074155F36C4E7AF4C5FFC486DA
MD5 SHA1 SHA512 TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 12f0f5c2eb7147aa55fcbf5fa7014b9e9ed8222d394199b520c279f291df20ed
MD5 781cbc1882d86aa693bc42845cda08cf
SHA1 697aba8f2008b187158fe306fe4719d1ae030548
SHA512 db8f9dc21bbdad32a81beed087b0916013f490f42a08d4af6700a3760cbf55b20d01fc878b527009c46e0e01d88006dcceaa61de2a04ab6602d133dbc960abd2
SSDEEP 12288:DHe2+0U3fNan9xw8+OhrAXC8d3C6Gi52J2+WJUkO2eX8:DH3/UPNg3ScrgCvi528+54P
TLSH
T1DC352940766AD75FC6AD40322E32D1CCA7707D45EE05AF0372C8873F8576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 1c0793695412459a355182fc4dbe56fab2e991d22ae2dd3d2852f6438b089943
MD5 9aba75072ee6d2829ea6d4f80035db82
SHA1 3f044edbe4e516ceabc26a951761edc65ba3a0bf
SHA512 eaf960fe9c76f018d77fa60dfa0c1bd2219f6e5458c0d07d1561d0a9e52153079d5fb42d559839dd077f8e29b9342653448a076f96e2fa1a2252947dfd8069b5
SSDEEP 6144:99DyJZpJQEb0K9CCVIwYyOc5RSAqo026tMx226tMxZzLmtDZCcqCB88gblgq:9UdjgqegRgq
TLSH
T14755D8815537E2DFD0FA6031072A5B4CA7A4EC06B7096F2673C8453ADC26B66A1BD3C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 b60179be196ba6de8b1928c1b9f8f94244e9c22470de224fb3164fc86d738480
MD5 a9987691d053c50e0ecb9e1bfec4e5af
SHA1 c5c37b78c97e1d2d8b5ad3b56604a506bb8b21f8
SHA512 925699f7ea635d41d73b6b4a7702850b2b2c300d2fc03c3832ac2357948769162131427a25f367be6bcf04be6149873495fbf6588af93e76004efce87d77aa82
SSDEEP 12288:lF7nkZJ88o0kDxxdDCk0PxWebANsE6wqwpHFbv1ESKIK9qKUar:Tn8g0kdxdvGxdANf6wJHFbv1ESRk
TLSH
T1B2D423898BA2595AF5764330458F8A0DBE2FBD27FF6145C7AD0282640AF47E59D3320F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f5a88f3e76255db7a6ddc316d12b496f1c92f8b5e63ec451c54bd7fede34d6ce
MD5 545ffedee901433083a22174090833bc
SHA1 bf5417a6dd9f2fd7c9c3814d74dbd310df62bdf0
SHA512 e46f5bac0b9901e1d4e42c7f76eda3c11f287f596aaff486728139d2641110d977a2cd1209e9f2edff2892a67afa7bb25268afae914bf83fae8147a4ada49f9b
SSDEEP 24576:Rgb6bmBIi49WNNFpg1rSvFv7bYx8g0kdxdvGxdANf6wJHFbv1ESRk:Rgb4mBIBhGF72XhaqNSGFbNt
TLSH
T199659E1E22E802F5E0FAD2B8DDAA4417D6B378161731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 9d592319a0a34d20eaf4af116ee76cef0bb736b375a5a02243ebc00e1e0d181d
MD5 b4ddcb13b749eb00db75d5a100865f4e
SHA1 e6168f373030ee853e2c60f8cb656a733d6e6530
SHA512 033f2fbd82bace95b68a015a066cf1c47989da35f0789472ea3a091b2bf101f4630e030c9f1233c190bbd174abd25072af96e1d1244706a289c855a0a9e6a6df
SSDEEP 24576:BG88u8FpJqH1nzria7/mY8g0kdxdvGxdANf6wJHFbv1ESRk:E7ZFPqV6a7/62XhaqNSGFbNt
TLSH
T17435F16567E101F0D477D1388A864667FAB2B8251360EFDF0BA88A511F23BE54B3FB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 04eeae63ddbcd61b983c5bbf641d3dcedf716439bc8923ed6ee9618654867c4d
MD5 2ab7c225bc8c5a61b1b4bdf89705d821
SHA1 d3b91f5bca4114678d60c2c472133da92b13dc8d
SHA512 bcf4ac328ee5ba750d1442c315305038dba8b665e8d13801b3bc918d03b53a8d430c7dead9ae1d20e3ce23c7d02abad8039961558119d7920c8de1d63563642b
SSDEEP 49152:UBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjP2XhaqNSGFbNt:3G05lO43bY2Xh1NSGd
TLSH
T107D5BF6E62EC11F9D1BBC17CDAC64A0BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0741461427414f238f0965bf0c42244b8e21f471a7fd48c7fdb512665623951e
MD5 afccf5fedbf1dcc7b5f91f48eab93a59
SHA1 385a7cf82243f7d7af953be5b0cd10eeccbc9531
SHA512 1965fc9cb1ca354c6f58994dbb4dbf97a9777cbca9ffca9b8a30073d9df2af663b3794f6af3fac808a1dd7b320e1b7222b824991f7609250c352c37734b4ceba
SSDEEP 24576:gfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnO8g0kdxdvGxdANf6wJHFbv1ESRk:Ya5POZ3hJt2pasx2+mH2XhaqNSGFbNt
TLSH
T17765AF5EA7F801D5D579D17DC583461AF5B2342253329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 26e015e388c75944a5fcb90f771ed79d03497e1050834f6d171e79f3136ea1cf
MD5 2dfa83cffd4bb0795eb52c8cd3da47b9
SHA1 f5f0478473c2076dc131ab6cc4ead9ecad758d23
SHA512 a14c332daf30db77143fc41a11ca73a0dbee292515679c522020e0eef946044a6bd89ffce36fe456564b666b34d6e90fba5cd4724da90851273d5eb97c5f2e18
SSDEEP 24576:PNcwHdjbyQ4nLC18lb/EOjowL7FkA8g0kdxdvGxdANf6wJHFbv1ESRk:PNc/zEOVHFa2XhaqNSGFbNt
TLSH
T1A9858B5623E901E4F1BBE1BE896B9546FA71786553308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e03644f62009b6ec76c518c655abcaaebdee3fef70f95ca1eededc5d8226ba95
MD5 03d74b74b99579c392bd3be763781ce4
SHA1 c8dbf844ec1494c32d578c2bd145de75b38869f0
SHA512 1ad7dd2f31cbe7313b3aa1e2dab132c15332f044ee005b10d7c4bdbf4ac1d09c61b405443f0bacc41b9a8b43b141c87d854e6968c74c595513bd0758128995d2
SSDEEP 24576:33kNvNnaFeYhJNtmZBm68g0kdxdvGxdANf6wJHFbv1ESRk:33MwBtOmJ2XhaqNSGFbNt
TLSH
T19355AF6EBAF846E4D1FEC674CD238512EA727861173253CB5290C13E0E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 fa28aa34b3baeb62bbf57a9fcbebd8c48014eedd81865f527d7f34a928820f84
MD5 22990e32b92300521b952b9047d929ef
SHA1 d1631555ad29b7ea5529c17de307a3ea3cb25490
SHA512 f4ee6cb533c3d71a0d326c407a9023ce48b8052a1ef2524e9f2ffff9bf5b7450493d60664acc207450ec6993e9d7255b533ddddce721505464f59b9c54c675a9
SSDEEP 24576:qPUr+NQc8g0kdxdvGxdANf6wJHFbv1ESRk:qJQf2XhaqNSGFbNt
TLSH
T16305F11F26E918E5F676913C8586470DF772B822171292CF02A1817E4F67EE8BD3EB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 8e5078d0be92fc00c0db49cd00c88c0fa93e007919437d5e2115c2c04639f6b9
MD5 a7b672585bb71fc08f6a37c0c6336a1d
SHA1 a2be53b2596407a948c31d0900848aea9e3f462d
SHA512 39e193454c58571597560796b27e2a4d233c99cc43e0c50430b04f5717c7c570b18edba836fe73d4ffdb60593a34424143f085b9766e81832869528c9478146e
SSDEEP 24576:rD3FHshBIYQgAj8g0kdxdvGxdANf6wJHFbv1ESRk:rDVHeBIAAo2XhaqNSGFbNt
TLSH
T19225E17DEB9904E4E57BC27CDA538A06E7723869033256CB069081B51F6BFE46D3AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/572-300-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/572-292-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/572-490-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/572-294-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/1068-306-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1068-314-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1068-317-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1068-312-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1068-305-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1904-322-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1904-328-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1904-494-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1904-321-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1936-230-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1936-227-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1936-218-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1936-217-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1936-224-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2504-200-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/2504-266-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2504-192-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/2504-199-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/2504-198-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2556-472-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2556-243-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2556-251-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2556-245-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2568-267-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2568-506-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2568-274-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2568-488-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2568-268-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2568-508-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2672-0-0x0000000000400000-0x00000000005E8000-memory.dmp

Download

memory/2672-1-0x0000000002370000-0x00000000023D7000-memory.dmp

Download

memory/2672-7-0x0000000002370000-0x00000000023D7000-memory.dmp

Download

memory/2672-6-0x0000000002370000-0x00000000023D7000-memory.dmp

Download

memory/2672-255-0x0000000000400000-0x00000000005E8000-memory.dmp

Download

memory/2808-505-0x000001BC1BEF0000-0x000001BC1C17B000-memory.dmp

Download

memory/3096-262-0x00000000008E0000-0x0000000000947000-memory.dmp

Download

memory/3096-487-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3096-256-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3096-257-0x00000000008E0000-0x0000000000947000-memory.dmp

Download

memory/3472-493-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3472-489-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3472-491-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/3472-279-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3472-286-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/3472-280-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/4144-206-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4144-213-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4144-212-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4144-205-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4144-291-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4640-232-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4640-233-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4640-239-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4640-456-0x0000000140000000-0x00000001400CF000-memory.dmp

Download