ec1376b4ad66b8bf0a9b015d1eb20a5dc3c7a777e48bf22064f8430f8e7d9c0b

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 04:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Size 2.0MB
Sample260910-fbffkszzcz
SHA256 ec1376b4ad66b8bf0a9b015d1eb20a5dc3c7a777e48bf22064f8430f8e7d9c0b
MD5 7b3ecdccc65738283093cd3ba53c1c0e
SHA1 f2a8bf4033c7d3cc3951a54b096c680dd552fba0
SHA512 bbd610dd9bfc1d76ffc23e60fab543f2a8c766c8807e7417f19665820a62487f813c6bb976a86066ec9243a7bed0e1990060e000b5dfcf1910f6d3e3ce34de5b
SSDEEP 49152:MJ0kHCMIX0z96GhH9hi3ZFfDuYkjsl82ot4+Ej2Ez+lneVqGhiw52LlOpbeZB7m:hAYkjsl82ot4+Ej2Ez+lneVq8ycv
TLSH
T107A5CF60B9458427CCD162F29B5C7766445CE8A4473598C7E3C81EDFA3A43D2AE32CFA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1148	elevation_service.exe
700	elevation_service.exe
3240	maintenanceservice.exe
4600	OSE.EXE
5932	PerceptionSimulationService.exe
1832	perfhost.exe
2428	ReFsDedupSvc.exe
4568	SensorDataService.exe
2300	ssh-agent.exe
1652	AgentService.exe
5532	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7412455d238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000daa621fbde40dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d60ea2b7de40dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000080339fbde40dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005bfa95b9de40dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5536	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
5536	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
5536	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
5536	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
5536	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
5536	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
5536	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
5536	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
5536	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
5536	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
5536	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
5536	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
5536	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
5536	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
5536	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
5536	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
5536	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
5536	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
5536	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
5536	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
5536	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
5536	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
5536	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
5536	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
5536	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
5536	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
5536	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
5536	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
1148	elevation_service.exe
1148	elevation_service.exe
1148	elevation_service.exe
1148	elevation_service.exe
1148	elevation_service.exe
1148	elevation_service.exe
1148	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5536	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeBackupPrivilege	2428	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2428	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2428	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2428	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2428	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2428	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2428	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2428	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2428	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2428	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1652	AgentService.exe
Token: 33	5532	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5532	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5532	SearchIndexer.exe
Token: SeDebugPrivilege	5536	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	5536	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	5536	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	5536	2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	1148	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5532 wrote to memory of 3648	5532	SearchIndexer.exe	100
PID 5532 wrote to memory of 2500	5532	SearchIndexer.exe	101
PID 5532 wrote to memory of 2608	5532	SearchIndexer.exe	102
PID 5532 wrote to memory of 3656	5532	SearchIndexer.exe	103
PID 5532 wrote to memory of 3948	5532	SearchIndexer.exe	105
PID 5532 wrote to memory of 3028	5532	SearchIndexer.exe	106
PID 5532 wrote to memory of 2784	5532	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_7b3ecdccc65738283093cd3ba53c1c0e_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5536

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1148

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:700

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3240

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4600

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5932

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1832

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2428

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4568

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2300

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1652

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5532
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3648
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2500
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 2992 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2608
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3024 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3656
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3948
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3024 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3028
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 2992 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f897382aa709bf06e332bf3f9e9fb172b46177a18e9a8932f388b3d74a062135
MD5 900fc319e272bf971c8ea52809726d15
SHA1 497f5bc7164782e3c787134b9865ff7574df8ef5
SHA512 3eefb0cfaf929fee9134ef9470c85153d35c0eb26d34220590e36f3a2f2ae50d8d10b6bb94eb7d52438040c6036eea98113c0ec3d52022e708ebf9ffaf686239
SSDEEP 49152:sb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnT2LlOpbeZB7m:W3q6sjB6ycv
TLSH
T101D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 a2e1e449b093a62e2c4cd9d4fb25ed33695216f8a1c64b6b197d6cc29a6e7a77
MD5 2021170803e66d9cd7c318924e066503
SHA1 be67ecffeb186cc906d54157e462b2d84384156e
SHA512 d20d9adae111907cc8b53eb15b2e12de0f3efbbb4c38d3db37a65fbb7487a9cb7b730cf9e82bd8447fb479d207cc3ca403dcc83c665d30934a631388ed1d45d4
SSDEEP 24576:iXYfDtczAe22C9+bmOmbTk3reZCIT59z7m:ptc52LlOpbeZB7m
TLSH
T1B975026467D408F9DC6B823CC9A28411E633BC9587A0E7DB03E489661F737D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 cd5d54885768beb28c2cde1b66e6164163f531aeea70204188a99364130f4d7e
MD5 37feceeed4fbbc50d7fe8487912f3037
SHA1 a2c77ec05872f208110729e4ea48742294c65695
SHA512 79a33e4abb9f582abdc91e59585533a6f60a0230a29ddf7dd6cbf47677bf8c9762dfa622af370ebc9673fc00e2bf50ef7d3605c4f86b484d4420b6ba9fc2a551
SSDEEP 24576:y0Le5ji0hmxxrMr22C9+bmOmbTk3reZCIT59z7m:yPji0Ajo2LlOpbeZB7m
TLSH
T1FD95AE56F6748371D073C0B9C5D2A69EE97130865B308ACB4286C77C3E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 39d3272203a967ece0f478d40e486a02055ae0bc88a1762caa85c691e1319658
MD5 346fc014257b0dd2b2d91698f2d7b7f8
SHA1 0a288080a4e6819ef2ed912816927e6c9082f626
SHA512 72fe620f73ce63dd05d5bc01942d5085722c7adf32d0aab7e544f8f53082a7d8963193146e8188ac1d40c2d2513c42f6e05357e8e0d8935662a936f510438a68
SSDEEP 24576:9a7/ezSC6vUyD/aqgrvWn6q8wyup22C9+bmOmbTk3reZCIT59z7m:0/ezSC6vUzPveHjyc2LlOpbeZB7m
TLSH
T16A755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 674b0bca5721ea185ae0debd2af771a842fbf8b5511cdcfc7d627f5126dacefe
MD5 39f82d8f860219085d8d3e42faa85604
SHA1 9842f135caa408003f497ccdd1765d2f2fe82b3d
SHA512 ae4053ed38e6aa0a5481c40c9832d8ab2c7d26f1f129b57d669ccbbb6f721f462269d4c01c9eb7b82cba15179ae9fbc23f9e95bf5c1a8595bbb347273abe5952
SSDEEP 24576:WVbqPb88hv/l+Yq22C9+bmOmbTk3reZCIT59z7m:WVO88hXl+x2LlOpbeZB7m
TLSH
T1C4559E66F6B48331D073C0B9C5D2AA9AEE3234415B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 6f5edbcdd42d58c3519bd50917a6fe28b3170adf35e8bee303c0da33739bb92d
MD5 21a343f4009ef32b57325f21832eb096
SHA1 d28bce7a4c88fa4dd0bcd4acbef4d1b776608cf8
SHA512 fd51542408b6553896c8d86bac777f9b960728184f8cdd8f3b52888936cad83781d692be745536da5c1f9d8cd417170849a174b49c65867a99e9e6adeac946fc
SSDEEP 12288:XLn22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:XLn22C9+bmOmbTk3reZCIT59z7m
TLSH
T17B5523C18FD8C8FAC67F1230569164E52635EED8DDC6B45B81891ECF14F1AF8D44A24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 6f2f2433274985d4a10eb72bd1957f8dceb455fef209e4d408d8dc77d061a610
MD5 430dc241cc03c3d06942e1800f5db531
SHA1 99c11dc84857048a5f1f9635553121afea9176e9
SHA512 bf117d8023eb2ddb89f64a7dae39306a092a608bb9fe88e254f3b7a904b142bd30fdd74e460ccc476f0f1bce2c2e8c9cc575ddbf221b89e5b5c6758dc464ea00
SSDEEP 12288:3eBNUbTVO86UC22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:3JIUC22C9+bmOmbTk3reZCIT59z7m
TLSH
T17B75CF7BEE28FCE2C27E4D7857918640E77278708F52A3CBD165820E9E235E05D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 31969b0d223d808fcca223cf98c3926fc89cec1c4cf14f32997c3e57d37e5f68
MD5 4b56d7899828787f2054d709cefd71ef
SHA1 cf6bcf555d9ed96554d0c2bf9c3638881a4200be
SHA512 c2761d93928cf71a1ea6f59dac2de0773919cf87d11e6bbf52108fb423908170e942338c571d68dd10eeaec359ea365815969ae87c00ec266a3f2ef42efd20ef
SSDEEP 49152:EQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THg:EQvGAdlCEL8c/DRNw5CZycv
TLSH
T118266C656BF880F5E0B7E134897A85B2F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 67e0c7e0a8939a279a44b62834de8549fb48c58f4711be05b1c2fef4829a2674
MD5 dcd01bec01b946e09c057a244fe70b2d
SHA1 a3028d5c6c3b083755a83dfc784a94cf77ef67f5
SHA512 6c18e81ad443ad7e8cad7f05e014dd5fb740884297c7bb7bf83b4a884b9fcb1af600356f05e8bb850778f56a5a1a7d31b19b8a66116ea854364de1c3de09b050
SSDEEP 24576:l0ewsAjY22C9+bmOmbTk3reZCIT59z7m:eljY2LlOpbeZB7m
TLSH
T14985E071FE74D436C2BF0DB11B26D716143DBA604F9229C3E3A84E8E59702D26376A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e8bbbb91708699c1dc37058309ca77f0922b9ed21a93567616e05a4cf997dfc9
MD5 651af48024d8f2de00ec1087cb47faf2
SHA1 65f079824494432b9bced540680aeeaf5402d3ba
SHA512 2c66af68b848f28c3a7cae780c0672d482fa9a34930fdb6ae466308854f00d29892c9ec457f42d7f1b5e66f867f666a6449c8b5eff973b39dca1c43fff526024
SSDEEP 196608:OUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHYv:OUEtQevvqc2W1cpV2tI32Y
TLSH
T136474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 27074d100948de9c771bd1bf48782d0dd4f0d4f1a2137bd9baa935a203958051
MD5 ac60041e6379b1e509b32d7cdf822e01
SHA1 1ae9d95169a4d4e08a9c793374d5adb6567bb943
SHA512 aca53feba092235f40ef1a8552e0f2b16bd2afe1f14426057f4b4941549d72a50326f1a0a541632183bb1c328b081df7c46a2f2a5ef9ce08c515ff8e0369b7ee
SSDEEP 49152:+CbRquA/m2yL5zTfFiV+XenmE3/z42LlOpbeZB7m:zoquVjnmdycv
TLSH
T146D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 fc8bfd0a17d40a41e939e08287370dc65a563e3a40a35a8bbbb8e1c82ca054d2
MD5 d45355e095fba4eb905fc3af0ac7acd9
SHA1 51a26cfb3a2c0357ab1ad597af7e3b045b17e7e4
SHA512 39fc2a122171b9b7df2e701a7e6454e0e0b8ac030f64db16f7b6ef3abfe1440997b5db01cc16238ec183456bbb6ca7f108831a195dc66b4545cbea6eea558065
SSDEEP 24576:EAhGL3IFoiwtA5l7S53922C9+bmOmbTk3reZCIT59z7m:EAMUFoiq5N2LlOpbeZB7m
TLSH
T1E935AD81EBF945D4F5B7AA7899B69170EA76BCAA5E31C20F2150C11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 1fcd27d5c823cad122b30009695784b09a59a7ca593983fbc4cbe8e9d93cd0f2
MD5 2342eaae2f863b0ae88cf7657e8833ab
SHA1 46b19141b726c157d5d152903d820f6224095e89
SHA512 a5ff69cf936c021c4206a2b7a9e05b103e40a0363a73b3d3d747b2aaabbc8f1612b4052fe1f17bbc3bbcee8de2aacd38fbc13b9a511bd2dea9cacec235801cb1
SSDEEP 12288:xmw5HEjsChNVBFgl0WDm+CJ22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+114:swu4OW822C9+bmOmbTk3reZCIT59z7m
TLSH
T10675F18677E80CF9E96B823885578136F7B2BC152A65D71F0360CA5B2F73361AD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 db36f88fd43709ced17998058aec01b47c70132111ee21c523dfb7d2d8a308b5
MD5 e7a1c38a88edf0daf97230e7084c31ab
SHA1 fc24531896c0e3ab68d4a80f8bcf1a39632e12a9
SHA512 ccf30945244e80520fef337126d8fcffd37dc9f3b403c2f8f7967310284c418116e9342482c67f065e21e549e98accc4ee5f74c1bf10bd965df641af9b3fc2f6
SSDEEP 12288:neZ1IyI22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:eZuD22C9+bmOmbTk3reZCIT59z7m
TLSH
T1CB6512C627E860F9C1BB4238C9E15545E372B896ABB253CF02540A9A1F73FD59D39323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c563331a530bc06eb670ba3554493c93a0c61b4492a707ff9ad9ae1e55f81d63
MD5 b6812dc3d86c25d568e14810162a82f1
SHA1 eb3ccf765ac804bc55018a2e8bfbd1657cc8e094
SHA512 a091df5407fcc1e9de66be7d3284ad433387444c275f6d6188c790bddb5698bd2480f34b3339ef17c13d7b8bf246cf83debe6cd921b56b9f2ec24b1ff0261302
SSDEEP 49152:tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UM:kQRQyi36YOcPbLvw2gAf+PN3Wycv
TLSH
T11B667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 71415015b305aa3729cac2122717572c316e265e0e7ed0dea7c01c14ded21573
MD5 ad8b2fff25bd80a1deba7587ef597988
SHA1 f873aedaa881eca6d8466c811d2c6b2186bb8bb0
SHA512 480494739648a23967366a592e0425d4519ad3035de9482a6f74edb6b104895e9e307fa9974a8769d3e47472a641c3884dc2959d8d64f41be0e4fcf2b21c68f0
SSDEEP 49152:sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UM:jQRQyi36YOcPbLvw2gAf+PN3Wycv
TLSH
T19B667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a836a49ce62b1d61f87b2be87581d5ca1803a38d298e922abb29bb1ffc475369
MD5 f653e66d9104d17602b7f30d319b3604
SHA1 ca3a30b3600280fe3f5a9bb112888c1afbc4a8ff
SHA512 a13e5053cb687acce48ee48f09752927040e63250e512999a12028dda99e1567c0ad35e001231f0f48094c39339bc9f595bd603f51f0eca58f36b4c207ccec66
SSDEEP 24576:WwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0T22C9+bmOmbTk3p:A68Qg55nhceWu7PNU3/o2LlOpbeZB7m
TLSH
T1AAB54933B2F600A9C44DE1769F46973196D27C758FE1E3DB8105720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 27509304c417289c36b879cd4cd9bc858b6681d9ed0a17efb10710804360b945
MD5 a8147926e364deb01082c9cc8e4626d7
SHA1 a76afd07eae9c48ea65cc8f6ca36ffd1bdaffa97
SHA512 c930f5d927f3d0b56e3c14ca8883c4cbec5af679f7e631aea85a8b15083ddef6df204e9eb33ab6a19683f24f88eb86988c094e753e1cf50573fb3716d88eb19e
SSDEEP 49152:a3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99e:Ly5112gYy5azzVvt69nLKnhZnycv
TLSH
T10F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 baf4dff558ce304ed2e010b2ea749a16192aa3156396b8b90ba024a2e15e4f90
MD5 8cbed8fc3dbf08e557f9cf849152b241
SHA1 a28518c8ae52a264a47448ac52e2f202efc1bfe6
SHA512 88635ea549bfb1c244181a0ea1ba9fe646732f0e7f8962a20f95c33f5a4ebe7ce3f3a09026202bbee6bd0cc544cbea42c2885a8f2ddbe4f0b0d411f49781ab18
SSDEEP 49152:WB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glu2LlOpbeZB7m:ku6Jmdxd2duycv
TLSH
T11FD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c9a39a37aa8b8a0f9561fdbcc163632030e04108c9e182fff4f5a70bf1e2e0f0
MD5 aee7a50a03310c784d581161021f5e81
SHA1 1f69c1528c18b303502b80f09a0301a17ec6721a
SHA512 c7a5433bc65f362f69b1304b66b3ef0062be0a69544f6c536787378087989f9cb1a45247be63293f0fad35642a7577be705faa72defe56ae45923c3dc47e278f
SSDEEP 49152:51hpsNoJpF1A63U44CwH7R4xi2LlOpbeZB7m:5mifPWRdycv
TLSH
T13CB5BE13F2D900E8D06ED17887569232EA62BC460B35B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 cd9790a6f130af0c92e7cb391e500977c4ca7cacd5e02356fcbc25cbf05d1bc3
MD5 dd9ee845c10b58c281155ae8039b27c9
SHA1 0a57c02abc46d66b594d34ed95f346df628f8152
SHA512 00f01bae1ee291de7a94453968d21b85edc061773aa2fa126f4d64bd2b253ec2d793386b7fb07424b79b72f2f2acbab499f360071ab421bff38a1bab61bcfb75
SSDEEP 49152:lSuZQIY0Be2KcRVtOnks6NMHqD2LlOpbeZB7m:r5dKii61Dycv
TLSH
T12EC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 52d3e1c528b6311e4a6759e5bf24a78022fd693f9b0ff8b175fe8cbfd9dadf7f
MD5 93845eb00ed7c89444df6acda9f445c3
SHA1 feae29732f69173eec49b29c9bb005294f36e9d2
SHA512 9a4461761988fc32a6f1b72d68f2e26e929f2c1c2352e0174b9ab13ee3e3754a95d0d5f7ed29327ca3157b44814f3869a510d545b14634ca2d0e1f08a9be3572
SSDEEP 49152:LhtSn8EApI0fig3giDn0AP5we2LlOpbeZB7m:KX2imphhycv
TLSH
T18E95BE13F2D900E8D06ED178C7568632EA62BC150B35B6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 36d1c8dea0578256241c1962e0d6055fd5b0991817d11b810145448ba50ad5e1
MD5 0baff9868e3ce73bc01b203d08a26995
SHA1 c829b8f8947210ae6afa941857133fc5985784a2
SHA512 d4b00d8c4e7d1b282d66c2e3f919a29d0e88c4b1d6aac5cafc4d4fc4eab7785f77ae601de592e27bc54d51ead9c591594510a47a71d5133d0b134d5a10b6ffd2
SSDEEP 12288:D/22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:D/22C9+bmOmbTk3reZCIT59z7m
TLSH
T1495523C14FDEC9FAC03E5230865120E56569EEDDEEC7609B428D0D4B26F1FF8944A54E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 6a07bc534b2cce040fff12b07ed6d2e435559215523ed35719be6d0d4fa9fead
MD5 07de45c3da8bd1216ffc6603fb791331
SHA1 5f26393b3a6f3863c3b288851a2d04a42e80b3ad
SHA512 92db513aa098f76b11ff82866bae67864e25127ab306b2eedcd06a1ca5500bfe2378e6f30ea4238b8f320d26b20ffa1536168407d019219b0327dc80dc1bf2b6
SSDEEP 12288:/E22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:/E22C9+bmOmbTk3reZCIT59z7m
TLSH
T10D5523C14FDEC9FAC13E5230865120E56529EEDDEEC7619B828D0C4B26F1FF8A44A54E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 cf4054c39b6a8f68738dada988626afab6c57ef98c7b05c612b9413adb0acfa2
MD5 c2e55edab7b1dd1668213bb98aa03041
SHA1 74d08f3c9fa0bbb8d90f574fdbfaf437a0ad6895
SHA512 53cce07cde06a210b4cb5a639691d6ea9d5467bf39ceea35526e1d571add30ae87ae50ea8995faae75fa6099b51a46a260d80454d1f2cab93aa70be4721c60f8
SSDEEP 12288:G622qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:G622C9+bmOmbTk3reZCIT59z7m
TLSH
T1945523C18FDEC9FAC07E5230465120E56569EEDDEEC7609B828D0C4B26F1FF8944A54E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 6fdd7406181de7d7b4ba26b53fe09fb7afdc0b4c4f9dd4dabfd32c8fe436e52c
MD5 ae88b7d96827550f64e76d325151c799
SHA1 63d5ccd47953499fa300ddddc17ea06fa562aeca
SHA512 3343c0f778c9b1e9bb55c4c4f91a7458320c123320cb8c37306d1438fbdeab9b0a2f0ed664fe7243851f33a64572baceaa4fe34414f41f74497a70fdb0f52a55
SSDEEP 12288:QVd22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:i22C9+bmOmbTk3reZCIT59z7m
TLSH
T1635523C11FD984F6C47E9234C56150A1A275FDD8EFA362DF82440D8B1EF1BF4A829B4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 5b0f098e50f3845d3732dc804acd6e281c59baf9caaed886f38dacd1f16c2f7c
MD5 a0af98014e7e7bf5f21372004f7fa4a3
SHA1 a74d977fe3e426996922db9b2bb2afcdeb425142
SHA512 84f0eb779346524db9f8acd4e26eefd7540d23b3774bd3dc90e2cc1953c68f935110682f5e1feb4f9f3e1edb8fedb12fd3aa26d0e9fef6ea6d804fbe29db0a50
SSDEEP 12288:IF22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:IF22C9+bmOmbTk3reZCIT59z7m
TLSH
T1675523C14FDEC9FAC03E5230865120E56569EEDDEEC7709B828D0D4B26F1BF8944A54E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 4044b144c0864e7a4413c0d08b576a410266ea4976b20d5723fe09515214f17c
MD5 d05c70c1cc10254bcc29de54c3ced7c6
SHA1 e1ade6f7d9c459fc912145d2aa1f549bfd594052
SHA512 d24e25e955bfb6acd106fc52516d40a314553aaa7c03ec7cf4527d369c8c57d230cd0cb7680a9d628f358ad9c3fcf9220b213f2ece7a2d468dafb430b5d7a57a
SSDEEP 12288:TQ22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:TQ22C9+bmOmbTk3reZCIT59z7m
TLSH
T1D35523C18FDEC9FAC03E5230865120E56529EEDDEEC7619B428D0D4B26F1FF8A44A54E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 eb65d5ccf2c2278b79457cd215d1b1c9ea6ecb3dada9a581df99d2253a899acf
MD5 02c2844d8dfbd873ef21cdd95fade18e
SHA1 62dcd1e1540835436a9a2a9d843ea1ac49f17c84
SHA512 0c82944e11ba847a7e3a5cdd667b718052930d6140322fa7b8627a6f4bea603077eff3a2c020777f35000ae25d28bc15d3062067feabeb0eebd60d2e62cb6ade
SSDEEP 12288:JM22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:JM22C9+bmOmbTk3reZCIT59z7m
TLSH
T12F5523C18FDAC9FAC13E4230465120E56529EEDDEED7619F828D0D8B26F1BF8A40954F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 fe15334c7910e50cfff4041058de04038b65ed231d94941c8b9d5a241d9b877f
MD5 0429fb38e35687c67cf2e26789fd15fa
SHA1 ac50c9c217a8f233c49faaf9f3e178f49db3f725
SHA512 ffbc390025e8b8a9504c03024dd872e717aade0d35330b48c97c2063e8a2c0c302d2350390ab81a52b4bc12e4567839940145cd194ea42164cc2e94146145f2d
SSDEEP 24576:wZMRzFVSOk22C9+bmOmbTk3reZCIT59z7m:wZMRzfA2LlOpbeZB7m
TLSH
T1D37502D5B79008F8DC7B813DC9518855D2B2BC594BA0C65F03E83A6B1F733A15C2EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 21c37ba040b61ec84ed5d4ed975a86cf0fc7b50bb2606bf85c654c2d335a1696
MD5 d7166ef1223a2c5b2c5bc972753330bb
SHA1 b38368639e010e711915c833d09926e1f3b2f342
SHA512 c1e28e72ec401f29a02ba4686a137c674f6404ce73f9ceafa4d3481752365e344820fc767d2a031852c8e68bd9d59ec279060fa80330661966d9682a8403e0ab
SSDEEP 12288:Wz22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:Wz22C9+bmOmbTk3reZCIT59z7m
TLSH
T1D05523C14FDEC9FAC17E0234865120E56529EEDDEEC7719B828E0D4B26F1BF8940A14E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 eb371356760a3641ae8fe141853771e66ff92461f5887ce147e54c992447fab2
MD5 91b3c4da323daaa70dc3b9bf5056022c
SHA1 2f2aa5f35464adee99f1ab51a4daef629fbcd24c
SHA512 1532a0a19186edf9e819b13b22cc19b501fdd14cc9c3a7a45a75803d590c37db67ee0a78315a1e38def491924aa173db569a755ef9db14080147c5b905df3da1
SSDEEP 12288:nX22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:nX22C9+bmOmbTk3reZCIT59z7m
TLSH
T1835523C14FDAC9FAC13E4230865120E56529EEDDEEC7719B828E0D4B26F1BF8944954F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 1790b1fa543f4b6f03f3a29c1ad6426c00a45ef140774c3181099be647e6353a
MD5 b72d8b38ded0457891655629c561ab37
SHA1 5c453939d00dc8b2b234c68f198552c1e08a1e7a
SHA512 b75b9dc077937100290a5f660ba8b12afead14d4acb0aa92f1ddce3b07d0d7e947cf8931d0552397ec99c2a0ed1d9dcb127dcb17906a1acde56161b5ea9810c6
SSDEEP 12288:pyPz5L8I22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:IzyI22C9+bmOmbTk3reZCIT59z7m
TLSH
T10E65128367A520F9C13B8234C9521951F376F8758B619AAF03940A7B2F737E09D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 80eabe0e875aa4caa5ea3791e4c34ff801c25031b4350102ca300c801812f5ea
MD5 ca7bdee65129b88b60f440a9aaa18d71
SHA1 d1d8c0d9e6aa31268509bc35515bce0d6a4daf4e
SHA512 26645aabe7655d2e58043a8162d94852cb9f5818b7bc0bd68afa467b1aef2b8f8095670385a1c49dd263e023519d8ae26cee3a218abff3262d67a0f7f8882910
SSDEEP 12288:Lz22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:Lz22C9+bmOmbTk3reZCIT59z7m
TLSH
T1045523C18FDEC9FAC07E0234465120E56529EEDDEEC7719B828E0D4B26F1BF8940A54E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 cf9db4222c68a9e5204454e162be2ce7ae181b3910193ad8a30c187866be49ff
MD5 1a46772338be5db3f3269c11c2012faf
SHA1 c72b3a95d4e52be474ad4e9fcdd2a7492233e023
SHA512 ecb838e1e144b4b5bc8c935e3877bbd33bea3fabc47f13abdc51bbc23886dd0fcdd7d878c49fb7747631536bca4a6afba9f224e438355ca55bf9be02da16aa7d
SSDEEP 12288:Az22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:Az22C9+bmOmbTk3reZCIT59z7m
TLSH
T1B55523C14FDAC9FAC13E1234465120E56529EEDDEEC7719B828E0D4B2AF1BF8940A14E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 59fe3f50ece85d26685369cc1a58faffe429d980f4b6e504b1523a86fc4e9973
MD5 50d7b73001bb97408d6bf9e45b55d210
SHA1 8d5479113b7e4f46f6d3eb7ca52d8166b84fe626
SHA512 255edf49b57227a5660790449bcbad4707fb9f5f0411c35aa4899471ade6c7ba859debab99f7c50301605b4d72c8753cb8f4aa5396d21501b25e1fe6a49ee178
SSDEEP 12288:2yPz5L8I22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:LzyI22C9+bmOmbTk3reZCIT59z7m
TLSH
T17365028367A520F9C13B8234C9521951F376F8758B619AAF03940A7B2F737E09D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 08d4bcca25b215f582b3d3eabc6fff452f727b53fa01220f9d0083025d64e1f1
MD5 d8915561cb0383a731f62ab093dad42d
SHA1 085e5d7cb0adfd2a4d1cbaa3fd1f26e650683bb4
SHA512 120ee738e936c84e15b28b93b747e8d17c367c6e12de83b0613357a608bcf0cf38c8664591c78859f91543d7ecf94b1f37dcaa4d2797e46d8e5e3d6635e02ab7
SSDEEP 24576:KTDaLl3z0zDK22C9+bmOmbTk3reZCIT59z7m:KTuLljp2LlOpbeZB7m
TLSH
T1037502D5B39048F8DC7B813DC9514956D2B2BC5A4BA0C65F03E83A6B1F733A05C2EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 e9cea26dac26e41111300a6d46e87b6287c9a10edca2d3c23b7d55f0153a8a63
MD5 9d676b72a2da1b5ff49bc88c94f0ee5e
SHA1 d648f4ac86d6d047a60351801e37ee141c4e088e
SHA512 9925eb0084003b001d747f451dd43a4d48ce44ea610fb191859a84a5b30522cdb7e8f45d84974fcb4bfdcc00670bd9a3a1b367b81a394ee830bc789857a1719a
SSDEEP 24576:g3vd9CHKy7GZ222C9+bmOmbTk3reZCIT59z7m:qvd9CHKyaA2LlOpbeZB7m
TLSH
T1D085DF90F3E414E8F0B79A34C9725511DA76BC995B71DA8F03A8261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 0897c5ae90b22d3e6d2d5467251c5ad47d87c6a979c94abf3924b58b572bc435
MD5 16560442eca37eebc5b04cccf827f998
SHA1 dbd1b94559e624d74ec39c7d05186ffceb4b94b5
SHA512 a18b6a8d0e8499a4e4dcf998976e772d1bf16196c039f38ce8471d3d9f2d5f4fa5b3db5505dc3c67f278e5da630ca635892b506f558702d46d4d9b7ce9baf93a
SSDEEP 12288:va22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:va22C9+bmOmbTk3reZCIT59z7m
TLSH
T1025523C18FDEC9FAC13E5230865120E56569EEDDEEC7609B828D0C4B26F1FF8944A54E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 df7b669b7abd08b9e85a7d4d67c017746f1ccd8e01f58b92f6c803b6c26fd7f3
MD5 5d1752b2643cdae0b7d24537080ed7f9
SHA1 c4a7ce96032e78dd3d33b0e43f1669686eaf8ecc
SHA512 c76acda68de4a141fa84df3e81ffa6510f1c6004f8552b933cc39657b88a5c050a25038f0581ab6ecf27dcc0b1a208a2ab0f34a278440532457a8f31c3cdfa96
SSDEEP 12288:wo22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:wo22C9+bmOmbTk3reZCIT59z7m
TLSH
T1C05523C14FD9C9FAC03E5230469160E56529EEDDEED7619B828E0C4B2AF1FF8944A14F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 0be3d386ba084d042803dc3585033a70873f7f189a77dd3a68c4280b76290268
MD5 6f20161402835e372389838b20a8aaca
SHA1 49f0573e595dfc12424d43372609a21e1a339a9a
SHA512 28d2c547865d9ceb4f25462a6e16812415c2687b3a93ae49b1df4a3e1b3fbecb2ae1f9ecdadf76803e75898b70251766e3f844f97147d8809a96f31766d5e73f
SSDEEP 12288:PR22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:PR22C9+bmOmbTk3reZCIT59z7m
TLSH
T16A5523C14FDEC9FAC07E5234865120E56529EEDDEEC7719B828E0D4B2AF1EF8940914E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 d3241d75cacc1bb8d2ad84f0d84ad4c89a0998853a76ff7bcdf89a265178386a
MD5 8c91962afde63cb641d9b6b6f8503c7f
SHA1 588a937003a976162bc0a097e3a24c8028e415ba
SHA512 841c850d01128ae0c8e3d0c956334f6b5933fcfe390a6e0970dc370f912d26299e61523d3961411e311905b0d643c46c410e983105bae3afe7b6e7eb0939a750
SSDEEP 12288:wz22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:wz22C9+bmOmbTk3reZCIT59z7m
TLSH
T11B5523C14FDAC9FAC13E4234465120E56529EEDDEEC7719B828E0D4B2AF1AF8940A14E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 097785453b1fb1a65f9eb3f19f91e7766b1688f69b020961531060b7d8afd6ec
MD5 3397351132f4f750d779ee4e68ddbf62
SHA1 485ca4748cae9fcd23c6fe82c19350f1a06d8684
SHA512 c385334aa7beb436d9d51430e38dd917f4d1896acdd036f597b199f5aeb176e18053229950b73c9215081c73a703faa58863b1d4ca511f774cd6a5714ae7d4b2
SSDEEP 12288:Ga22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:Ga22C9+bmOmbTk3reZCIT59z7m
TLSH
T12A5523C18FDEC9FAC03E5230465120E56569EEDDEEC7619B828D0C4B2AF1BF8944A54E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 b53e3139b7afe3b111c987c2f28c3da60d15688b4ff29703305e1a2c121eb037
MD5 a196c0cd3ecb2e1e0c41c0f7cb12fe14
SHA1 ad4e5e5f0ceb61c07763df04862e72505b179f14
SHA512 06e63002ccd5f466cae2ada2cd47afda67e02e8ef8c92a56d98b8c360d63daa737d64c4cdb56b980d3a65ed99f2fe9253e90ead4c3036bf064b90d6a04486918
SSDEEP 12288:u722qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:u722C9+bmOmbTk3reZCIT59z7m
TLSH
T1775523C14FDEC9FAC13E4230865120E56569EEDDEEC7719B828E0D4B26F1BF8940A54E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 14403482151b934ce40b928dccdc60f94ffc8c26de5a5facf8a79026cdc42ed5
MD5 af3969b7f83739a4a57ae0259a22e742
SHA1 a1c699902e8222f277328640f85903d47814326e
SHA512 79b16225d5edc892f03eaff93983315a00abd56a36533705e3e8759d0d78734e2d154f56ab48ed05a751a7014e0167f6c55b11773197d9a84afbde3a813b671f
SSDEEP 12288:dF22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:dF22C9+bmOmbTk3reZCIT59z7m
TLSH
T15D5523C14FDEC9FAC03E5230865120E56529EEDDEEC7719B828D0C4B2AF1BF8944A54E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 c232060382c1941b53ecd1cd240351318a64dd4165546ffa97fae274f5b2b8ff
MD5 1cf75aae83f8739c6d4f5b3efd1c871a
SHA1 ac76a22dbf9272513df4ccc031ea64d4e80e69c1
SHA512 e10d3c044d95bca15ba0f88cb0a20383e2fd8565aad070a4c3ce7b7851034bbc00ea245e66e983c9599b91ba22adcfdb5fb577a2581b1b8c1d66297d3a39d4df
SSDEEP 24576:tfwvUk9RX6wkyAIH22C9+bmOmbTk3reZCIT59z7m:/MnYIH2LlOpbeZB7m
TLSH
T10285DF29EBDC44E5E177923C89B3460AF6B1B8695B71C2CF029A53AE0E33ED45D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 ae331848d51e7cb6962e2fe91a88e40dbaffa39879c59d48eef74f45a0eb9f59
MD5 a7dff392a06cb180556b4296bf13b42f
SHA1 a5e49f7bc64c523d976d6a360f31d24bbb719116
SHA512 4abcb3e80153bf203036e2b5c959818c2b3b72372341de18c935173f649025d8b40407d757165b78dc5e9b34d614d51b08a2fe307c8bdae03f3cd51fd26b6e43
SSDEEP 49152:zYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0+2LlOpbeZB7m:GySzP2ycv
TLSH
T1BE066C96A1A841D5C1B9C1B98B0BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 9888c804a8ce1c1d40c1f68fa2a51c9e5947467a829c766b2fde31ad2aeaa81c
MD5 f8dce327510f11c81de20b4037743f7f
SHA1 2d15c714b2a34faff70a856911c54edecdd05267
SHA512 62c81d78ba1f68b9021ee5d76b0a2503565c4b44133becb1897413dec0f9695b6bd4bfe01a44c600fe479010c0e2d87af8f8df2cc1fe880d194211d88dac5d49
SSDEEP 24576:S47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYU22C9+bmOmbTk3reZCIT59z7m:S47JUQjTirIhCnDHUPfF/u2LlOpbeZBi
TLSH
T1F965AE1EA3EC01E5E1BA823885154A5AEA71782D5F32CACF1270437D6F63ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 530806a9fabaac64ceac360353cbf087f138f43bafa978aa6d1ab5ea8bd659d9
MD5 acae06f89bb18ec43922f94e9e2e6ec6
SHA1 26517edd89da70bf8abbd9bb1afb6bd16e4e11e5
SHA512 e02427590f320cf6c384f632b2c73712921a0be1064ceeade41cd00ccf6ee4bae2ac018241b495b44fc588061e3fd9d690c2637cb8bc5e91301b89dc05f60dcd
SSDEEP 12288:/bsfD22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:SD22C9+bmOmbTk3reZCIT59z7m
TLSH
T15565F185D79842E8C06E6234C7515681B333BC659BE2E3CB52C0F97E1F766A09DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 a2865605b5c1c89cf5d5a2441e402c681f137072922bb31bbcbdbaed4462cb06
MD5 9a6d7f3117646f374c957d655a20904d
SHA1 b6a9fc1967c3d4588c44ae5442e61a8fae66c408
SHA512 ed702a1f8e6753dcfb72f4f5f842666f8bfc169a84af1325218ad72044590e411faf9e86ee1794c3ba5967d217102891417a0773b5f02784174fae0bbb5c2c65
SSDEEP 12288:Hjt59y5p/DCia9p/7tQXBE2ahmghFLgIXko6/SZen2ZY:Hf9DFtndhmg7gIXn6K4o
TLSH
T1B7453950762BD75FC6A940325E32D2CCAB707D01EE456B0772C8873FC576668BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 cccf6452f4b48832c7bf3c7048fa59b3d8706db6ac914eaceba661bd4364772b
MD5 4c5cc7ef1b362ac429dbb89c64401d49
SHA1 2cf399ac1832812deb95a8cdb809eac985be6861
SHA512 2e3ea2fb7398bcc8ed49d27aa0d88b6390347c73fa17f494e2889eef4dd907d6766ae9111611719f5fd118c84518501460a049affd29a7a86642c6256bddb2a6
SSDEEP 12288:0T/CEns63BdHmmGyjAPxXf95uu5SdohisL/+g:XEnKmdds7Z
TLSH
T14065E781A537E38FD1F76032572A5A4DBB74EC0277086F2763C8057AD86A725B0B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 73a872bda2ac8dda6dcb4ace0be0398fa194abd49b60327365d3d9bb027acdbe
MD5 bdc841ac0da042236ce8b8c913d2218d
SHA1 4c741c0a1fd7acb158b52e673ab371028c2d8978
SHA512 5300551fe35a4719eda8a71bfa774b91c90363456fa3577cd89e05f5806d9d281f609d0691c4442415359f53e2a63485ee1456c9de726d02c223798b7b4f6bf2
SSDEEP 12288:I07L22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:FL22C9+bmOmbTk3reZCIT59z7m
TLSH
T1305523C28FDD89FAC47E523045556074222EFEA8DFC6A0DB91490E8B25B1EE4DC7960F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e446423ab761721498dada749e2db0b89ced20122d3ada8fefe1e6b73e31cc5a
MD5 01f9dc9a44dd1d5c7fb3b05aa7cdeafc
SHA1 ca1b0c5712a97482b474bfd8f58b5a428ee7581f
SHA512 d40c9c61c61c42be9d737bd9a62afff5381c02db3c220199c230885eaf1e59bf53735f8079edfbeb7b63ec9eaca32a6672951a4f23058a526611884d5643bc64
SSDEEP 24576:Ngb6bmBIi49WNNFpg1rSvFv7bYp22C9+bmOmbTk3reZCIT59z7m:Ngb4mBIBhGFU2LlOpbeZB7m
TLSH
T1EB65AE1E22EC02F5E0FAD2B8CDA64417D6B278164732D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 9ada8c344e4e4fc1afb145081d60004b744477445936292e7c509f2b1fa30ed1
MD5 ebdb07134555db043885fa8ded3c9dce
SHA1 38783f7b4216fcf591b8bcc4c4f4091414f51261
SHA512 357ffd1eb437abf51908dd51f8e9e200dd2b7309e7305d2c7a0002d74893cc6c0b139a827532c3f2964ed14ff8326e7e148dbabf4b5137e484a44265f4b9fda4
SSDEEP 24576:NG88u8FpJqH1bzria7/mk22C9+bmOmbTk3reZCIT59z7m:A7ZFPqVea7/x2LlOpbeZB7m
TLSH
T12F95F16167E101F1D47BD13889824663F6B2F8250364EBDF07AC8B561F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 6c77c03e1ae7918de58488a27e6f83d974ec383650f42837a7197dc4afef3351
MD5 d35203170ebf81db61ecb80eacefae48
SHA1 c41dd2bf6e1b83f84d120f73ec477c4f2a56b7df
SHA512 984fdaf5a14ae7b9150f14859515e64881b5c99dda4a1e5ae34c5a57e2086e03177d3c21aecaddda829dd2f0f6dbd03e6f6bc81b184d99930a58a96ab1976236
SSDEEP 24576:1PUr+NQA22C9+bmOmbTk3reZCIT59z7m:1JQA2LlOpbeZB7m
TLSH
T15975E15F26ED18E5E67AA13C85824619F771B8625752A2CF02D0817E0F73EE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 72e492c2d6d9f0252f789c116ce400a5e039a4b4a4cee5fadfaa346eec17c035
MD5 80759cbcc91933d1391e3548346539af
SHA1 2455813181b95cea6483894f0800f8f6c6bb5130
SHA512 09664eb75bfc39505711de2bbc8108e15cb475d2ce252413bef9bb2e13c28cded288cac7c109005572acf25c5e768e79d71743791b7c2669708c70d90de17033
SSDEEP 49152:oBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjQ2LlOpbeZB7m:DG05lO43bvycv
TLSH
T1D1D5C06A62EC11F9D0BBD17CDAC6460BEBB23815033556CF02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 945448b2ef578750440d41d776af6685d34e713ce07fe44708a76a81faa2b049
MD5 8b1238cfc0280da1abdb96c53bcd14f5
SHA1 523f627926f289ef71f37b37c77ea863212e1609
SHA512 93f92eb72101feeeb75ecdd9998a0b6d6e0eba790b97a0600093646d1687ff0f91bb7afc7c573765def4e68ff56c6916cd9cb6941749b502f66aaf0d9f00cb24
SSDEEP 24576:Lfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn+22C9+bmOmbTk3reZCIT59z7m:Ta5POZ3BJt2pasx2+mo2LlOpbeZB7m
TLSH
T11365AF5EA7FC01D5D1B9D17CC583861AF5B1742553329ACB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c8b7bcc60d25aa391f37929398e324bfefcf36c1a8e9914e6d4e26f947272266
MD5 3430dcb7e314571d511622cd0f2acd16
SHA1 764691b6f43703e83eaf3ea8047a90ae7168b096
SHA512 b0f3c940fb04461d71b706c0350651dc725ae38987422e1879e4ae3c4b8f9a4fb1459ab35c18f285ed2ac1cfd0d03ec2f8434740b781efe859e686de51cf9bb4
SSDEEP 24576:FNcwHdjbyQ4nLC18lb/EOjowL7Fkc22C9+bmOmbTk3reZCIT59z7m:FNc/zEOVHFR2LlOpbeZB7m
TLSH
T19A858C1623E901E4E1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 43f2413b223b0b60e4cf27bf3abd239f4ad44b9828c197335bdb6d1f43e8f04f
MD5 22ec9a18b300bf7ea94246fda64c72fb
SHA1 7f3ba1db3d8c6d530b3378b363170a02ae5cf5c8
SHA512 9b20cbb4ecd4485dedb099f428443daa6d4ad779bc739328e736b6f71d4fc544e0c9349409fb6d738928e4f8aacc46828dee93d5a944f1ff5fb86d3b69dbd250
SSDEEP 24576:ITkNvNnaFeYhJNtmZBmy22C9+bmOmbTk3reZCIT59z7m:ITMwBtOmy2LlOpbeZB7m
TLSH
T13955AF6EABF846E4D1FEC6748D238512E6727861073293CB5290C13F0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 7eb05ce05245e17cffe2abc06dc5f24d508c33ca4cb4cb01b31e17d0931ab484
MD5 5cd7a4431cc8538fab5d52132c84b7ea
SHA1 d67503a40f4879d76b270201d239ad4a92e61ae4
SHA512 15ae37f457a38d4549bec3f4a5eea38286cf5b920acb9096d7b653d2ef45faab4af6f77e0bf4ddba5693c0709333cb8624d76776a1b1ebf351b9e3f20e0bcab4
SSDEEP 24576:tD3FHshBIYQgAf22C9+bmOmbTk3reZCIT59z7m:tDVHeBIAAf2LlOpbeZB7m
TLSH
T1C385E17EEB9C04E4D47BD17CCA638906E77178A9072265CB02D481BA1F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/700-107-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/700-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/700-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/700-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/700-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1148-81-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1148-20-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/1148-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1148-21-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/1148-14-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/1652-129-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1652-127-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1652-120-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1652-121-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1652-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1832-78-0x0000000000400000-0x0000000000618000-memory.dmp

Download

memory/1832-289-0x0000000000400000-0x0000000000618000-memory.dmp

Download

memory/2300-108-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/2300-115-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2300-306-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/2300-109-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2428-304-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2428-89-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2428-323-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2428-321-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2428-83-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2428-82-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3240-52-0x0000000140000000-0x0000000140256000-memory.dmp

Download

memory/3240-38-0x0000000140000000-0x0000000140256000-memory.dmp

Download

memory/3240-45-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/3240-50-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/3240-46-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/3240-39-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/4568-94-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4568-101-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4568-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4568-307-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4568-305-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4600-193-0x0000000140000000-0x0000000140250000-memory.dmp

Download

memory/4600-54-0x0000000140000000-0x0000000140250000-memory.dmp

Download

memory/4600-55-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/4600-61-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/5532-137-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5532-310-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5532-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5532-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5536-65-0x0000000000400000-0x0000000000602000-memory.dmp

Download

memory/5536-0-0x0000000000400000-0x0000000000602000-memory.dmp

Download

memory/5536-6-0x0000000002330000-0x0000000002397000-memory.dmp

Download

memory/5536-8-0x0000000002330000-0x0000000002397000-memory.dmp

Download

memory/5536-1-0x0000000002330000-0x0000000002397000-memory.dmp

Download

memory/5932-68-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5932-75-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5932-66-0x0000000140000000-0x000000014024C000-memory.dmp

Download

memory/5932-272-0x0000000140000000-0x000000014024C000-memory.dmp

Download