d482b09283f69a9cb78eca64f1738004cf187d3b69058bf6c10ed438e5f9076d

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 05:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
Size 1.8MB
Sample260910-ge3wqayglc
SHA256 d482b09283f69a9cb78eca64f1738004cf187d3b69058bf6c10ed438e5f9076d
MD5 52be22a71bc3c0da32f39c5a3676e872
SHA1 48f338852e99b2613a13cd9c782831a4d9c9f81f
SHA512 0e931d037b9a18b1dc7e3e79b8e2ad88534491d8785f8f9175919334ecf5006fbeb1de6e213a681813b189a9c5b7597f328c0072342d03ade4c46a7e059024f8
SSDEEP 24576:GLECPTTOIJ8a1ntsmsEv9dPWTXNyxknw4FYnshx8OfVe247:G53TLsmsmXPWTX4x4x8EVep
TLSH
T1D495F120BA72C03AC57241718D78E7A5456DB9240F3146EFF7D85B2E5E708E2AB35A33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
3240	elevation_service.exe
2608	elevation_service.exe
4956	maintenanceservice.exe
2828	OSE.EXE
6088	PerceptionSimulationService.exe
3476	perfhost.exe
4864	ReFsDedupSvc.exe
4744	ssh-agent.exe
824	AgentService.exe
2136	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d9f892b7209659e8.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001ef35eade740dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009804b66be740dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000000188ba6be740dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aacfd36ae740dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d3c4936be740dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000939b336ce740dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008332fe69e740dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
5064	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
5064	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
5064	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
5064	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
5064	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
5064	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
5064	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
5064	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
5064	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
5064	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
5064	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
5064	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
3240	elevation_service.exe
3240	elevation_service.exe
3240	elevation_service.exe
3240	elevation_service.exe
3240	elevation_service.exe
3240	elevation_service.exe
3240	elevation_service.exe
2608	elevation_service.exe
2608	elevation_service.exe
2608	elevation_service.exe
2608	elevation_service.exe
2608	elevation_service.exe
2608	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5064	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
Token: SeBackupPrivilege	4864	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4864	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4864	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4864	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4864	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4864	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4864	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4864	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4864	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4864	ReFsDedupSvc.exe
Token: SeTakeOwnershipPrivilege	3240	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	824	AgentService.exe
Token: 33	2136	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2136	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2136	SearchIndexer.exe
Token: SeDebugPrivilege	3240	elevation_service.exe
Token: SeDebugPrivilege	2608	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 1744	2136	SearchIndexer.exe	99
PID 2136 wrote to memory of 5572	2136	SearchIndexer.exe	100
PID 2136 wrote to memory of 3984	2136	SearchIndexer.exe	102
PID 2136 wrote to memory of 4680	2136	SearchIndexer.exe	103
PID 2136 wrote to memory of 5816	2136	SearchIndexer.exe	107
PID 2136 wrote to memory of 3856	2136	SearchIndexer.exe	108
PID 2136 wrote to memory of 1796	2136	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5064

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3240

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2608

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4956

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2828

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6088

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3476

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4864

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4744

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:824

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1744
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5572
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2864 2800 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3984
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2896 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4680
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5816
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2896 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3856
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2864 2800 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 716d7ba27135d212bd875430dace50cea606b36056be94ec23fdbeba63663919
MD5 d3e4ca0ccaa67bc85978a3eb4dbc95b1
SHA1 23e9d7e3962500f6be57f86623eaa30b395e5acb
SHA512 a58c9199c59a5b29564433a6507d3820ba47d5c8dd10d4f070a2b41ccdf6374a91f7485ef6674c0dc02dba9509fa44cc988b9807d5ef8a552fb558ce4685b4cf
SSDEEP 49152:Nb+632BuPkFKRrdE6ohdstBhuXjfS4LWxn0x4x8EVep:T3q6mjBnix8EVy
TLSH
T115D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 96b62232f016ea19409121eb1512ec7d6c3642b4c5d6ec8ed1f9006118813c91
MD5 b75a5493e9a5265b3029ba4f713eb867
SHA1 e0ca3cbd4a0dfc47c6e5f794da062f5b6e3c457c
SHA512 10e91ca51e45bfdc41dfd39056928520f478b10c5502b39c487be43be6fe0ed2a29963bbae018dbf604f3da4d8ee5cfbaf99ce89f101f5dcdafeea8e3931967c
SSDEEP 12288:f1XLsswWkxy2lRq2czAw+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:dXYfDtczAwyxknw4FYnshx8OfVe247
TLSH
T1F775F12877D548F9EC6B8139CDB28112E633B8554770E38B03E4A52A5F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 827d4317cbf676acfda0b81ba0f6fdc1c22559d864f770d9302c9feaa58ffef0
MD5 ee26a0bceae39e59404ffae9c6180ffa
SHA1 ff14294e2c4eaac87c1d5ae6d9771d71e8953aa4
SHA512 c7ba98a7684a23f3d56c16319d5d7da8c72fed461913c1175e84cfa215f6790ef8aed31bdc823f2e24e6740f12f88bd0d519cd1918b31f9271ce561cfc0108fb
SSDEEP 24576:x0Le5ji0hmxSrMGyxknw4FYnshx8OfVe247:xPji0Aoox4x8EVep
TLSH
T1A095AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a8ee4e45669d6e631173eb7f608c73decac35289a98abfd15a4d2862fc131cc8
MD5 b85667b31b1f674f30daf5679234df6a
SHA1 cc76aeaebcaded06dd887919f658739c4682b907
SHA512 a9ccf20064a2e7e836b206608210e92f139958a147d562e080a7a01a6cc3565ed90b97ebf828fba2630a97ba16d92a4ebac416aef5742a456a9a33348121888a
SSDEEP 24576:la7/ezSC6vUyD/aqgrvWj6q8wyuEyxknw4FYnshx8OfVe247:s/ezSC6vUzPv+HjyMx4x8EVep
TLSH
T118756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 eb46c0e891335dbc93a03381ce02f39a7c7af3738ebfa1539de91f59dd868701
MD5 a21f92a2cc0c47d55d44c30fc0b6dad0
SHA1 fe90f47eab21962c912062d461f7b2bd7a63f091
SHA512 ce4d232afe4f2833c724e5b1ff95543e174d957cd23653c4fd2b6f94b11ca80611a72b2678159ebef5de03a87d0b84029f0e4ee4e5a9b5926dd478d9d534f812
SSDEEP 24576:rVbqPb88hv/l+B/yxknw4FYnshx8OfVe247:rVO88hXl+Ix4x8EVep
TLSH
T18A559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 bf0704afe5f624f1adf13e5a045de891aa6f96410c3c2a07834848b1d91ec4e2
MD5 d60af4ceeb4a54bdc53f06a303854abf
SHA1 a3426572f9a577259dba9f0c175ad283ac0f0e6f
SHA512 1f15d8f9cd836b914630897dacd8b9b1ca26e39ab856b2e9ca05a8ab93868d65fe6d2473666ab5ab9f6867ac374a685a6619156c8eff2dbf1033d056ad222073
SSDEEP 12288:aaa+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:aaayxknw4FYnshx8OfVe247
TLSH
T1B265237CABDDE4E1F65E14331A7572223606BDA0DAB4C11BCB78B55EE0B0C54E06E623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 9a639064ff475186f817a3dd2c9cb1a381d64fe1fceccdc87cba37cc92b3f735
MD5 46cb73d67be251cec0272a11c2d6cbd3
SHA1 4d6af8aaa528f0bfbe770e72f02329309c6ea3e3
SHA512 10f55898869e41f38d6385433e7c535303372fee916f7aa72740c20913063720fdd1d76e17001303d97da053516e33a8c606b1a26e335b2bd430dff6c1ef8e0b
SSDEEP 12288:qeBNUbTVO86UH+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:qJIUHyxknw4FYnshx8OfVe247
TLSH
T1DD75CF7BEE28FCE2C27E5DB95B918200A76274704B6193CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8c81ef5d65b0f18c77dce4362767b82dcb58ff4d18e0eed476984a50133b897d
MD5 d7654606d90764fb7f08ee4c53d62c5c
SHA1 40ae259ba133074cc6194132313fb95e1089a625
SHA512 09954087c058e8889ec9adfcd75d860f38b56300023bcd7f524761e37e1b5d0c4eddbfec3452ce88f2bd93f8758e6aa51e42f4e5d2aefa440f9791a33f825147
SSDEEP 49152:0QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH4:0QvGAdlCEL8c/WRNw5CPix8EVy
TLSH
T1D6267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 78c26613585ff5603ce4d1c8d9791c085804864140d845d52460c0eed6505c99
MD5 d40584799e612ede3d51a9b1bee07aec
SHA1 4d92cbed0849cd2c1b14cb27a7cb30276ea80f20
SHA512 d993479dade47efdf4ca5af77a9d4328cff2453b9799d2cebc1ceb162037e9d9b84ab45037d9dc5a46ab13921b8a0f4cebf1fef2c8a5e81dedf1fb593f772a9d
SSDEEP 12288:UAwSfxL/2Dc3zDLLmt0LDQewsAjt+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:p+ewsAjtyxknw4FYnshx8OfVe247
TLSH
T1CE85E030FE74E032C67F0DB21B36D716142DB9604B611AC3E3F89A9E99705D2637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a38522cc5328942013716cb36e1e5065dfc97d7d81403d0ee6967557f9753029
MD5 c534884a75b1f1e7a152af5025bb4ff9
SHA1 296306741196d9acd3f679fe14c0e2d89f9b0a0a
SHA512 a68d94df50a29b356fe6a81b7962a139120327a3216fd0fb2ca405c63a3a1d65ebf308922ffa1d0579b80214f40896137af6a1a5f3043cc9f5a1993a16854ffd
SSDEEP 196608:dUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHd:dUEtQevvqc2W1cpV20I32
TLSH
T1C8474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 def4b54857f4577dfa29ae3e2a768ffbb6a032125c64347d0235456fa2154c92
MD5 a113376e822060c78e7325b9b647fc82
SHA1 405d0c610de1a552b027a1d30c10ff04c944beb2
SHA512 cd0f8d9e8cb725a1841f17c5e6d9d8a83909923e56f5c272d7831c95332d29e581794cc46c81b8eeba252aaa40eb81a439a1df2c2fdf509478d25ec53aed8163
SSDEEP 49152:KCbRquA/m2yL5zLfFiV+XenmE3/z4x4x8EVep:/oq2VjnmDix8EVy
TLSH
T127D58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1b97cadae9bd60f2a18c7472b4b437010443527a9884fa7915648969b3f117eb
MD5 1c0901eb446d90cc8bb26852d9e2abcf
SHA1 4dc1b579d028a1a2a40f5b7fc69cc31113313bcc
SHA512 07c863c3ba341a1f4db7d67518398ad8ab7cf9d2b5b4fe8e93374d43d066fb1b4087d5ff7ed2d982b052472b650d9e41ec41d2c3bd7fa55478c86d26ae27c05a
SSDEEP 24576:WAhGL6IFoiwtA5l7S53gyxknw4FYnshx8OfVe247:WAM5Foiq5zx4x8EVep
TLSH
T1D135AE80EBF955D4F5B3AA7899B69171EA76BCA65E30C20F1260D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 9d47fc63ad06afe58b05b32bdc973cf02f6b1c022228605f07326d69804773f1
MD5 bc193edd5aa81110332f23f0519d488b
SHA1 1a2e0eefadcb9df7c2a8d0032e37469dea5163e3
SHA512 2ee662621d44686631124f2749f88a876fc6175b4a6b5453c6e5715f265a10a95889de4afbd42dc05916f471f5d33973c82bde6defacacbccb6471939399d9dd
SSDEEP 12288:Qmw5HEjsChNrBFgl0WDm+CX+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:NwumOWeyxknw4FYnshx8OfVe247
TLSH
T1AC75F14977E81CF9E96741398697D136F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 51e64f3d2852c7eab2f26bf8649cf069e1cbba6ce8820ce48b1d934d5805b1b7
MD5 48244efb0abd1c7d43590566efe29142
SHA1 6f8815c33807cfbe029aae53c1fd381db3260029
SHA512 28661f47199bb347056264de1d5dda453b22b4202c777e761f4fe7b5cb5410f238d416446a7197e8898c9de814e1f00f09a81503d19426deef9d1e6ce2a066e6
SSDEEP 12288:AvZ1Iyd+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:gZuOyxknw4FYnshx8OfVe247
TLSH
T1B76512AC33E860F1E1A7113A89F15206E762B4A2677183CF4768625EAF71DD09D3D723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 fb221560342542bf53f409a52db19857f075b1678630c6489daa81ccb67c3330
MD5 38d4d6256a401566e7ac53acf94b4c26
SHA1 055811430f13da738c602806d28051b6b8a0d40d
SHA512 2e1d7554c654650591c119eb36a2904b28c38efd9eaf470de7777ebba5ebd01186e04bbc9c9d539d8b19d8e4651f76ef1e2d43d3408df0ad5871c176a288755d
SSDEEP 49152:Bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UE:IQRQyi36YOcPDLvw2gAf+PN32ix8EVy
TLSH
T130667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b988c970d31dd2be2e96dff599aca54d728425c2ed4048a182374c67d1b5fab9
MD5 f750509fd15f697e45d0e01c544b8bda
SHA1 ef134f2f8653178457de81e414cdd6ce04651328
SHA512 1f95bfe54deefea479f41a054f373342c08bcda3e7a158b30ddfe0a919305153aeb5466417f856d8c2c8832cfbdf50ae46b15482809f63e33ad626d4de8ab247
SSDEEP 49152:+j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UE:NQRQyi36YOcPDLvw2gAf+PN32ix8EVy
TLSH
T10B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a59424d9096269a9de5486563f9227d0edb189f785bbd5f32e3c6a5e1628ea59
MD5 6b1d538a750dfdda053aca28ff2d8cc5
SHA1 f40e83dfae9d5887e39b1fb046b763ac9a17e0b4
SHA512 5ca7a0e5110b6ce77b782fde71ba716c759fd633c52c0517fdeb544ba8a68aa7f1c5a51ebc274f30eb757549eba698227d8a39641e194c31ce0c6ef9a45ec624
SSDEEP 24576:awvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0eyxknw4FYnshx8Z:U68Qg55nhkeWu7PNU3/ox4x8EVep
TLSH
T1D2B55933B2F600A9C44DE1769F4A973196D17C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ef67a6900d6caee1f25f08e34d2a727074b34771d95afab6b57208af7a05f9cd
MD5 df85fc72b1ae9eb0e000d6217f4feeca
SHA1 8d0f6708374a5eecc32ef102a8700c08c1d51154
SHA512 d276c58562c62dcbd5dbf3bf2671882f777659b056c05082a445b85803da75b9d958d93f177934a516353b286a320d7df2d984213506a7cde5fc8ddbb2e48880
SSDEEP 49152:/3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk992:yy5112gYy5azzVvU69nLKnhZ1ix8EVy
TLSH
T107167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 36017b6bd0ac78909d260c9c3ebb600073c1a80a3df0dc91417b92cb6dbebe79
MD5 1ff15c4424567a344cc40a7da586ff7d
SHA1 d8c3b9e8ccc4587d47c2c1e18cf411e92d7478e8
SHA512 15e0a824f2707fd007e4328d61900712babdea4d7c6aa5a58281a1672bd5f8b0ddb8c9017a4ec2ff2bd2dc5a5c7eab14d8c73b0f02f99c52d3968145cac2a8fd
SSDEEP 49152:ZB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gljx4x8EVep:Pu6JmIxd2djix8EVy
TLSH
T16CD59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 5f930d9a6abbe3ed15eedf2ff2d8ac4616db2ebb635d8ae1d63218ddd035bbe8
MD5 9b3a71c810c7c8aca232a2de367b41fb
SHA1 9bf386517ff4c830a1fe92146b235efd35844309
SHA512 bfae2802686df6b6b0a95a87f35a2d0a963c1ba3eaebad5408c3d14ef47dff7e00f00184ca36e455c6ef684734c8706b53c5f1f6270d01d58b4f0f776c1de112
SSDEEP 49152:m1hpsNoJpF1A67U44CwH7R4xyx4x8EVep:mmifPqRDix8EVy
TLSH
T1C2B5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c2894c31e91ce60cd62aecedcdf4ac39d01a4ebd6f4d0dda364eb6769c38bf0d
MD5 23cf926b0c6e5bea0016e2720877e7d0
SHA1 cfe08c0eba58c59a17bfc291e5175593f420dcc7
SHA512 ceb12442a4ced22ffd8518b65e5b45ba8ff4ec1c0fedf5fffc5ebc7b6fa1cb2fc26cc29ab255e9e7edca6b384d672eb51dad6f25c3845f6ae48b55303585a385
SSDEEP 49152:VSuZQIY0Be2KkRVtOnks6NMHqBx4x8EVep:75dKqi61Bix8EVy
TLSH
T18EC5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c24f612ceb1fbc757598173afb4aedb9b99aab41c93911ab2a92e276a668f8bd
MD5 d362911b46137158a612a8aec0a1f3b3
SHA1 65d4d73825ae5fdaddff3fa85234f0f9c860be48
SHA512 4ac988279e4278f9dd89a645c84e340e9f6f1787d72fba59949ffcae92185a1087e4da77a0dd9f882a11e2dac8b36257750264fab67dcf3007da371ba44c2023
SSDEEP 49152:HhtSn8EApI0figjgiDn0AP5wOx4x8EVep:WX2iWphnix8EVy
TLSH
T1CC95BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 ec06fde88dbfd980cb0727abf4643ae73e9724eefb4c4fc4000264967f5ec726
MD5 e8262617693b6829dd200d6638604409
SHA1 745b7ef1086b6a11d788f8f78e7157ccfb3664ee
SHA512 b04e0d34d5168ea5fd64e6a269a80fadee26be1d05da46275ed9423b920ae3015647a1bf5950b506efb49638014f19f9b0cd030dfdb97c1e2e93671bb85a2ffd
SSDEEP 12288:/C+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:/Cyxknw4FYnshx8OfVe247
TLSH
T18865237CBBDEE5E2E50D10734A7133666609B5A5EAB1811BCB7CB00EF1B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 a758e9e2bb68027f3a989cf615d886e563284b8d045bb769c6e2acb0a87bbe97
MD5 c902a5a9afa9102b39c9ccf1ffb300af
SHA1 3f97d9676145dea71415ab1f74989d9b501d5a10
SHA512 1eb1c8e91bf8cc3c0cd92cb3ab3c61d9c57a4d7b2dc0fb5d5eb61426e7726a6546e7fdb7db1fe5e7c68e44feaf951c1e04214e611f21cdeeb7cf21abe3301ca1
SSDEEP 12288:Qh+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Qhyxknw4FYnshx8OfVe247
TLSH
T19265237CBBDEE5E2E50D10730A7172666609B5A5EBB1811BCB7CB00EF1B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 f2d27f19b90f93d31faa6b6b3c82ef8ee1f4477a0f95aa769511218b77c2843a
MD5 43ebddbb5e95185c07ef08a28cdf1ddb
SHA1 35efab1368a6b17722168ef66adafe10819b654b
SHA512 56f9ae8176486d9926eb378648862348b9d891b575bb863d173f11950808ab0b494e7cd3724ddc472cd07ca473481c34d7894e63ff4e1978b10ee2ebdb10a7a4
SSDEEP 12288:HP+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:HPyxknw4FYnshx8OfVe247
TLSH
T1A865237CBBDEE5E2E54D10730A7133666609B5A5EBB1811BCB7DB00EF0B0C54A06E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 add11d2b87ea26e584629a771a2473a46bf99aaf92d9f37961321eae45dda08a
MD5 4b32455109d10e268ae7761e6ad299d8
SHA1 32ba3ad396d7004fdeb1533e7bff6ed3e8b6a936
SHA512 a12acb580d785a7eda5706cf209dfc0ab28934969dcb33c4503493aed45f397e370be0694e722e9ad9358ce037bb7a7ee3a4c30c8ade3881a6532356a8afc29c
SSDEEP 12288:dVA+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Iyxknw4FYnshx8OfVe247
TLSH
T19865237C7BEE90D1E45A51738A716222B365B8E4E731C35FCB24750EE9B0890A43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 5f9462970b46298c841b62da45eefdefdcb1e3bb6a76ceccd22a5bbc5db668da
MD5 06de3b69947a7db493e85c692059c5f1
SHA1 0aee5ec7a3c43317f9ccab49d4b6c0cc3e57d8bd
SHA512 c7c1ef62d8d2137e21aa01eff3e1509911991c5676345a3f8402edb7622da4377b0c35756aabb7a09181b41f1f4a8c518108f463c104479cb0bd4c1a68622685
SSDEEP 12288:ZY+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ZYyxknw4FYnshx8OfVe247
TLSH
T1DE65237CBBDEE5E2E50D10730A7133667609B5A5EAB1811BCB7DB00EF1B0C54A06E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 1dafab1d235dd9c21069f09c3ae2d3707545da073062c758c5b151e4baa86566
MD5 272d5f06fda97663a9650296dc42feed
SHA1 6a64083579a8de750fbb3ea16f464383613e6995
SHA512 34a1b814104353b73613aae52b5c61a9a2b766aa3ce70c8c8a2203ada6538ffa87f0b45fd460c1b52bfcb152249ac05aecf2b2682043213e5793bdbaba63857f
SSDEEP 12288:M1+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:M1yxknw4FYnshx8OfVe247
TLSH
T16965237CBBDEE5E2E50D10730A7173666609B5A5EBB1811BCB7CB00EF1B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 b911b4085fb39d21ae9b9545f5d9ab583be95e42a25f42c527d30d5feb8624d6
MD5 8f0b67831a4bf1c97a7748b1cab78aad
SHA1 43052bb99e63a96eb907560da61217736073140f
SHA512 ecba4997681bb1da95b911ac181a6f6ad71427d5795148d27e59b3c6b135ba76c4d4bec10c236afb8ed79fddc450c280de88c69b11ff47513d8f4fcb73fe59d5
SSDEEP 12288:75+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:75yxknw4FYnshx8OfVe247
TLSH
T1DA65237CBBDAD5E2E50D10730B7173666609B5A5EAB1C11BCB7CB00EF1B0C64A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 11ea8078d8e69a940066fddb96a91326aeff06ac019b8bf676cdda24f742c1e7
MD5 b95fe1b04d7ce0dec6423cb1fa106933
SHA1 4e227e3c9fe16d69b01385ace529dfe7152570b3
SHA512 18f12c9d86fff689b6a22c0e8e9ea8fe2bdd43b06499672c6b808a1b15ac5e28ee35073b63d3ac1aaeab5855f4f8109ea94ae856a772b71db5ce987c93f3cf89
SSDEEP 12288:1iZwbyzzFEoS2cPvyB+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:4ZMqzFVSOByxknw4FYnshx8OfVe247
TLSH
T1E07501A8B39018F4EC67413ECD259916D6B27C594B70C21F43B8362B5F736A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 c4305ec480bb2b8b53b2236b59f428de60f87dcda69c4aa995d58bc533adf4ad
MD5 f936d38b55d250143dcf3c19fd5a2e23
SHA1 6aeef00d56983377783fdb1750627928507427f0
SHA512 1a58ca16e1d26762ca41e734893ff6fcf338f28f82c03656c49d42df03fc9674511b4a405e564ccd8c7d13a6972c86729bc34241fbdf7656ebda22853fd5a3c7
SSDEEP 12288:Z++hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Z+yxknw4FYnshx8OfVe247
TLSH
T19365237CBBDEE4E2E50D10730A7173666609B5A5EAB1811BCB7DB00EF5B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 d52d8871c0b5b18b819c17188fd4ca605b820a385fcb79ccb44a3ee04c941d0a
MD5 aceafb670a753d594fd29dfcc380f5f4
SHA1 bd108a06050a48a5e1c0cd7c73e61d4bda7a6d33
SHA512 6384f0edf6c83420235f780158d7626db9e366b001dc8c68b32b6b6784c44560664fbee399401482f488a9239310a0838462cb65f33f9cfc97ede98dc85fcf32
SSDEEP 12288:jK+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:jKyxknw4FYnshx8OfVe247
TLSH
T16065237CBBDEE5E2E50D10730B7173666609B6A5EAB1811BCB7DB00EF1B0C54A01E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 dffe30cda7e51c73f15141830710a732878f01dd0cecdd8698f844a606916c3f
MD5 af43a871b47ce692c140447c5953fc6c
SHA1 1b8e9bbfecfb9df48959d8401cdba7d2bfa083c6
SHA512 8a2606909860f537ee66ada5c9a1b6f4cd330278f0ace5a98ecd89a089191e59543b725a6b7e80d6cfdbaf65a75e9cd5cd0a9de687b987871ba7f552fd8f474f
SSDEEP 12288:HyPz5L8d+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:qzydyxknw4FYnshx8OfVe247
TLSH
T1C675125B73E530F5E13A423689621602F772B872473086AF87A4537E6E725D09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 9b4cd85994e5a0b74f2241cbe22e65f9a4dbc74c0126b5bf04f0865acb582ad1
MD5 42e7c78bd9b90371adba928f552cafcf
SHA1 dfe77ac08d584c92d92e763b367fb128916c9dff
SHA512 df8c663ea95dd1343989954d9036f4925f3462f8a0e80cc7eeec596c05bc3c03fad152913f4e388f7fc1d5e6f026b62b58920097e007321628e7b73a5b320bc1
SSDEEP 12288:F++hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:F+yxknw4FYnshx8OfVe247
TLSH
T16C65237CBBDEE4E2F50D10734A7173666609B5A5EAB1811BCB7DB00EF1B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 ca15907014409f43c22c49b76343265cc59d347f75a2b0dd57f7d1d7d9344a4c
MD5 27abdec23417f7002c58614eb810abcb
SHA1 e257e63c9c07185f2e4f5ecd0b65e43ebe51fd1a
SHA512 1aa0b2a767a411436fcd448ae6416675b0cea1f61bf353bfda1a843af9f1a7c546fb6f3eda16fbe66aa55a38b953927710fb221a7056d67a15ce338e797e7dd4
SSDEEP 12288:Y++hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Y+yxknw4FYnshx8OfVe247
TLSH
T13965237CBBDEE4E2E50D10730B7173666609B5A5EAB1811BCB7DB00EF5B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 419ffd224213ef089cb6736ed1411537cea3e94afff797f03c511f21683ba6a8
MD5 63595e78fc636629b1449d3fac361559
SHA1 de9d6114f3c90bd92a04e0e703afcffd48f86ab5
SHA512 6bdf8c7d957fcf1883bc4ab58adfb477a0b19aaea59a50ccc2cbb226119203d4321b53dc88a1c035c3aa2e01cd2122f2aac6eddfc18ec95423d9fc7c27962af1
SSDEEP 12288:eyPz5L8d+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Dzydyxknw4FYnshx8OfVe247
TLSH
T1A075125B73E530F5E12A423689621602F772B8724B3086AF87A4537F6E725D09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 c7ea40c9bab982bae2dc6c9600794e892c6af0a1f9ec295e79504def25d03ece
MD5 dbbc01fde0a45f69bd610ec99e9fb1f0
SHA1 df1d68de3a955a57e4d5b86582cc50fa72d38f12
SHA512 c06ed931fdd10a016741423fadb9b802c1da601e6abd93918c2c65dccda3825db7fe60ea44ce7c0c3be211ad67e69bc7b316e82d82c900bb06ba1a8f4e6d3fab
SSDEEP 24576:uTPaLl3z0zDfyxknw4FYnshx8OfVe247:uTSLljfx4x8EVep
TLSH
T10F7501A8B39058F4EC67413FC9259516D2B27C6A4770C21F43B8366B9F336A05C3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 b125a3ef0abe9fed8131cfc66d34ffeb41a2249b41d82bf3be86ee9133727916
MD5 ec1f5ea07c75ae7c6e0d277e106bed49
SHA1 b203c76ff3d46bd2af9718c38e034fc3d458933d
SHA512 6c63300648cb78e6b37e66b76cafc9f1ca99490ea874fc2c00c58bad87420dd03727bf71abc163d733b0c122ffda872a8fc0d09ff9d12516dad9057af1500192
SSDEEP 24576:330d9CHKy7GZTyxknw4FYnshx8OfVe247:H0d9CHKyawx4x8EVep
TLSH
T11E95DF90F3E410E4F0B79A358D765512DA767C9A5B31CA8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 6eea37bbaed8b4535c304f146c927888248960b238d3da01aa420f3fd46709c0
MD5 6a0a534c0f8d2332569026c5727addfd
SHA1 0e6a695821744a76c109f7fbc360bae04636d3b0
SHA512 ef64779e1e465f009817ac3bfb410fa111b6e0a5e31a225d2fd2163923c78986b36f629c4923111b5e572cff643fee3d02aea2fd96429dbac99b2a358c800973
SSDEEP 12288:zv+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:zvyxknw4FYnshx8OfVe247
TLSH
T18265237CBBDEE4E2E50D10734A7173667609B5A5EAB1811BCB7DB00EF1B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 615fe8726a390e5b5908b5c9aac1f7f85e41758c2eea62cdb9ab32e248709697
MD5 869695be78113070d374dc4f7e868751
SHA1 99c78a1ecbaafd9bc2dfc10b9e19479c36792b38
SHA512 636c2f2806f3186d30de4756eecc8743a37f9f1be94f6b6019e94f7e8d0a5c6f002c673b66bc79eae580530c03f3226f34d62e85c038abdaee775e36a8fa2bf8
SSDEEP 12288:69+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:69yxknw4FYnshx8OfVe247
TLSH
T18965237CBBEAE5E2F50D10730A7173627609B5A5EAB1811BCB7DB00EF1B0C54A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 ef8b37a93bac7e3570d0ea7767cf9786408d50d6a3bab578b0d31b1b66c86612
MD5 3e6305e0d17bd12455ec59cfa5ba5435
SHA1 f1bd12c74d647919d0530fb34d8396fed33b99b0
SHA512 8a3a66bd0ac4d436e863648eb45ccb2d6a775e0de67ccb25c62eb0ae7344a76525568e84c5b6896e4d367fa96423604b2bd18f0784020784128794725c79bd50
SSDEEP 12288:Y8+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Y8yxknw4FYnshx8OfVe247
TLSH
T1F265237CBBDEE4E2E50D10730B7173666609B5A5EAB1811BCB7DB00EF5B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 cb74e14178f34e1326502af2d51bfd3b1d61a6058de1fc10f4054485d907ff43
MD5 8b557d732e53629d90ce20026222f934
SHA1 f74fb67f8a81a2167937b7e7f7d71d13f38f013d
SHA512 d50fb7dee7ff9a4c8caa0ced8716396b875cdac5ac8ea1487c9feac7e6b5c8587982adec8093e378685deb9e38f309c3dd07e79b020a1ecd49437cca58d3eb8f
SSDEEP 12288:L++hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:L+yxknw4FYnshx8OfVe247
TLSH
T1CF65237CBBDEE4E2F50D10730A7173666609B5A5EAB1811BCB7DB00EF5B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 8eae733bd0cdd6a3c56b42ac6fb93c5a940ed6b12e2d214f3c93ea36eef8da50
MD5 5cbf7639e7225fba665911f59cb55235
SHA1 37a4d89691851a0cb6ae99b1ec8465784091dc6f
SHA512 72878609c00e81b37fa250c137989bb66954cf6a6eaf504d1c53e4e261fe5bb31d99dbd03f4fa3f20c16b0132a6e3ca34d66f8e7df33f388657287b8118e9049
SSDEEP 12288:xv+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:xvyxknw4FYnshx8OfVe247
TLSH
T1AB65237CBBDEE5E2E50D10730A7133666609B5A5EAB1811BCB7DB00EF5B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 4b0fcbae0772527d34b0570d11ff4839f3f0410dd3c84f96541930d58197fbb0
MD5 95c0c39dce05bf403433048e57e853b2
SHA1 a5c437f8d1ecc81f0181e0897f2f47c0f9b78d11
SHA512 f046b7d0c40c64ac818aab00a22991f08b18373410431cec572741dcab47faf022cba0e7b0a54abc4f011f188ba17be45990734b45eaeddde5918c420fff53b3
SSDEEP 12288:1W+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:1Wyxknw4FYnshx8OfVe247
TLSH
T1D665237CBBDED5E2E50D10734B7173626609B6A5EAB2811BCB7DB10EF1B0C54A01E923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 64074f2380258c7115e31a0613158964ce0ff7fa3cd0560f499e69bd5b597356
MD5 e940d20329d94cddd7a4d2a5b89ea329
SHA1 4d1544d529585f9e38e6212bf11bd7d27196dbfa
SHA512 11d82ed26819afc3b93969735fa45c819221400aee1d5b3eefe428637af07065bcd6c3605479cf99e68cc977d0001ef596fe19e7893f477b8bcb85aeb24bf71a
SSDEEP 12288:IY+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:IYyxknw4FYnshx8OfVe247
TLSH
T1D665237CBBDEE5E2E50D10730A7133667609B5A5EAB1811BCB7DB00EF1B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.4MB
SHA256 1ca31350f9c9c5fcba7b177c50ac582b4c3136d09601b15f5702037133c796cf
MD5 ccc652bcaacfbe3ab9c82f232a99d32a
SHA1 ee517beb0384b96aa7ca9721315086e74b1418f2
SHA512 aed06aa4ce1f996431dd1ebcea93af5191842971859c78efddc375095d7e18f99d160b905b7bd0aa08b9c39bd7c8aa0b492d31dde79339b0fcebc16f3792213f
SSDEEP 12288:63+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:63yxknw4FYnshx8OfVe247
TLSH
T17965237CBBDED5E2E50D10730B7163626609B6A5EAB2811BCB7DB10EF1B0C54A01E927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 d0927d3e7f056ff538567042fb7ddcaa4642e2aa2d572cfab3a0bcc458bc1fed
MD5 b2700ce3cbbabf2bf85c2e6ee1f371fa
SHA1 e6b14e1274f18be7de1ccdb8a2fbae352978a8ea
SHA512 a2a8717d14ebf1590fd6e0e3fb805149f1c01fb1724fb282068fe2565895a7d0227ac2c6fce4dd7a8769e7fb5f96a027f0f5d83a9bd424eb6e21eed115b0d1ae
SSDEEP 24576:Afwvgk9RX6wkyAI1yxknw4FYnshx8OfVe247:AMnYIAx4x8EVep
TLSH
T19495CF29EBDC44E1E1B7913D89B3460AF6B178695B31C2CF029A536D0E33ED49D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 c36bd06597ce5ea632a40cc465d75e8c90ff4932fc20c7635d57890277100c94
MD5 8fb10c2b4e93743ec182afc397b3d7e0
SHA1 5bc3b2e4594759b526a88f969b3f5b8faa33ad07
SHA512 4daeceea9834184a57b45b5e348856a534bb8254fcc3e6e73611d2657601e5b160329463a7f9c57739821cd2bd31c8e1de682084ec05f07ec3242c7b5cfaec8e
SSDEEP 49152:nYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0ux4x8EVep:KySzPWix8EVy
TLSH
T163066C96A1A841D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 6235babb29a3b2c270ebb763ea5bce37ca613696acb3194a71d59a29e14839e6
MD5 76e3f1ff4ce33dd0554cc64a15c390bb
SHA1 eb1c549edf8a3265bea556f0027a5bb3fa9ed43a
SHA512 09b999b66226b9419cec1a636069d920f9e9c13fa4e7085ecf1a94b296c2fcd64861de857c4fd5f03e424a65b66a85284168c4b5a7d6df1390e2bd276b986b52
SSDEEP 24576:n47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYxyxknw4FYnshx8OfVe247:n47JUQjqirIhCnDHUPfF/ex4x8EVep
TLSH
T1FB65AE1DA3EC01E5E1BA927885154A1AEA71742E1F31CACF1270837D6F63ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 8a2dcc8bcd680558631486a8063b2bbb35a093d582fc586c26de7f5f72bc3a70
MD5 8973fd8fbaef18b80b67e4814f123f60
SHA1 f87ca350b8c94e502b76083d3a53bda12d7dbd1d
SHA512 121442036bb48b090b2feaa21fce3a596da6b0888c1a0c81770a6e3b6f7472701fd5c1535dc097de33b8d8557c4e38971a8159ec015c9d98b9cfee91836637c3
SSDEEP 12288:q0sfO+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:IOyxknw4FYnshx8OfVe247
TLSH
T114750128E29852E4D06E2176CB625641B3237C6597F1D3CB93E0F53E1F71990ADEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 3509e21db88d12a5c2eda8831c6e288d8ac313034b3d766b30785d585cab5867
MD5 1a43ed0bdac0092883f3f1050ca81e9b
SHA1 d4236ec5d7de8d9b5f4a081126bf564746659b5b
SHA512 da96cc9e5972e9e33a7076f6aca92f1d67dd52ac43790aae456329c84d98d8b839ca8d7a10e6268a88f0c83657aee2c22fff5efe836c04d7e4d452dd1082a69e
SSDEEP 12288:OMSCkykU3fKLzqE4bIbuqOAU/svTEBxAzfO:OMSCdkUPSOW1x7InAzfO
TLSH
T124350740766AC75FC6A944321E32D5CCAB707C41FE446F0373C88B3E9576669BAF2286
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 4a32a0c1781fb89e2148603a2a4adebea8bd963ebaeeafe4775d9b2a6702a010
MD5 fc1b4f97c463c5d6d1a05220f587c090
SHA1 5d56a6c17e6d0a093e3da32444327520380ac72f
SHA512 13da5140cd990ecb983b83177a9ad2368cea25b36303150f8d9e95c1d4fbec45b02a29e7972502a66955f3ac92ceaa72c5c59c7b42add6aa10a3d6b77b6ff1f9
SSDEEP 24576:ORzfq2Rg161uaGZl5kw2mDbsmn+ARVUZC79sNYsvlishOis9Wisfis45isfbisdO:X50q8
TLSH
T1DF750B816137E39FD1F760310726AB4DB764EC47B7096F2673C8443AD86AB25A0B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 192f388d704866b66b98b3dda540bfb7019fbd3f9e11602bead0182b0df15a65
MD5 9ca5832d6dfe42de83b246eea71c6f6b
SHA1 b51ed0096e08bfe93b26adb02982336883b0a314
SHA512 32ede01f5af39dfac7bdf28cd56d77e5cf2a41bfac4539ec390209993d3876a5256da3b9d54192e8b21a6e071621c9b27f89c18b05e07581e115f602982cc686
SSDEEP 12288:zR7J+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:dJyxknw4FYnshx8OfVe247
TLSH
T11365237CA7DEE992F46D11730A75A231360AB5B49B70C0DBDB28B14EE4B0CD0987DA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7af680467060ecf8a2bd0acf2dd636004d5f0435203c843625692bbbd5eba117
MD5 c8ec86c31d4431c4b7db2c7d3d0130ad
SHA1 73d9e0930fe0ca8e80c7c1cd3b1bfd5c3b8b31f3
SHA512 8abb2ce8c313b0057b8485f5190dd504bf96838115ce085e3a652f62ec49d07859416359f711e2c731ccc254cad98821ef8569038133b3001bdd9425b2a6c396
SSDEEP 24576:qgb6bmBIi49WNNFpg1rSvFv7bYEyxknw4FYnshx8OfVe247:qgb4mBIBhGF0x4x8EVep
TLSH
T1E565AE1E22EC02F5E0FAD2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 694387fad942230cf4538d0f10164651305d99dd5efc1b4dc8b955a6d22fbc99
MD5 99ceb5d256f8b2e7ad7908cebbf8d2e4
SHA1 bdcc0711ce50cb2ae7286d8bacf1fa7ef17e924f
SHA512 f347f5a9d3a8a3347dc341922ff48380b1be3f12dce81be625f330a9f3d8f11059e44f1fd24a31ff6c6c262b17cb08985dff38dbef1ca3ad33f982843101e62b
SSDEEP 24576:jG88u8FpJqH1Izria7/mByxknw4FYnshx8OfVe247:S7ZFPqV3a7/3x4x8EVep
TLSH
T14695F16577E101F0D47BD1388A924663F6B2B4250374EBDF07AC8A561F23AE44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 ef87689ce2c25d5b17285d97fd554282937977109cc942f87afc2856fe405618
MD5 159236a8243a28a32981bade2ca93b6a
SHA1 4a9a14588fa0ffb1fe2d2d8466ba15891a6059a8
SHA512 53287fd35bee882443a5a5d6c7a18cbe01a8d8226fde3d248c8e5e6888328c7fa0f0f727eaf7e2d603eca7e5075beb29d18d751559d080d9d95e78860628a473
SSDEEP 12288:dHvUrBFrEjwaQy+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:dPUr+NQyyxknw4FYnshx8OfVe247
TLSH
T14A75F12E22ED18E5E67AA17D89924319F771B4621712D2CF02E0817E5E73DE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 92bd01d55ac725a7247f99b4865fc23bc48906e29391a58510c2c3ed8906a33e
MD5 e532242b4a6d4e5e4ca6557299b90460
SHA1 040cf9459a8847de041015731c41063dae481e99
SHA512 09f4f83beae4529462d6161d7a3ad79331918c73d3604673d1d4d8b58be2fac0505a894c42e8b1984b7443a83ab9cd6780bd5da9b61a1091541079387e5d81bc
SSDEEP 49152:QBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjdx4x8EVep:LG05lO43bIix8EVy
TLSH
T156D5CF6E62EC11F9D0BBD17CDAC6460BEBB23425033556CB02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 934b6df195619cd60278b84cb90a6eb36bcf61a737dad4884856d8bca502a35c
MD5 94fbfbf0366c2d692e913eaf65fafe65
SHA1 27d95d6cec963fb244031dd4ccea9dc3c5cc1a5a
SHA512 11cee7cdc40f64a6bee4e3895d2c968d496c1b1ad1bd01fbf384740ed7dc42ab2e371e77f995ffcc2947efa54ad06ed164115b043585cca64d581c24e4523e2c
SSDEEP 24576:Dfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnLyxknw4FYnshx8OfVe247:7a5POZ3lJt2pasx2+mox4x8EVep
TLSH
T16665AF5DA6FC01D5E5B9D17DC583861AF5B1342153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 2f080ec738d8fb91ab4c7063791629b6b6c16704da811be3af08fbf9c6972b9a
MD5 af38fd32b06401126c5c87f8059a358b
SHA1 52a8e09734e115b67f5d8e4b3201e499c00e0260
SHA512 409c20ca4a8575e589dabe78f4bf1416fc8535525ae04394caf41a1be3e74e9a0911bbe748b8452b9a18b8126e04ac41c85b7178fe969e512819e2add796bfae
SSDEEP 24576:+NcwHdjbyQ4nLC18lb/EOjowL7Fk+yxknw4FYnshx8OfVe247:+Nc/zEOVHFKx4x8EVep
TLSH
T1D5857B2A23E901E4E5BBE1BE89779546FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 456d9e9a83a4998379676d9864c4a72b501fc7be79dd6306c32d7225f2ad5335
MD5 07a41407c1e36d65f0c3d8034ae338b4
SHA1 784fef548b36c2f5b231f0a38378278fc2dc8e64
SHA512 a65abc11fc4f9de039ca54ef7476f8b82f3b282cc8482f69d572458a8ac2a2a8b848e399fe70384bd38b48467fed087d18db85c1aa1c97f50ec8b495dd6edf4a
SSDEEP 24576:vzkNvNnaFeYhJNtmZBmkyxknw4FYnshx8OfVe247:vzMwBtOm/x4x8EVep
TLSH
T1C555AF6EBAF846E4D1FEC6B58D238112E6727461073293CB8390C13E5E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 905096b44b7e2506bd5fb46992000daa6235d11b63c5ce7af1a2d1dabaf45166
MD5 2425d782cc93620a9ad6095d7b124bec
SHA1 0da19334bd747f81bdb40bcb59c4c59ce63dca5e
SHA512 cf0921e4489002bebb961211e7e69e8f6522115a22f6a6eccbec4eae5167641cbc521ea696455b2f40e2d6add1b8e55b690c833ce84346a340e850ce5cca33bb
SSDEEP 24576:aD3FHshBIYQgAiyxknw4FYnshx8OfVe247:aDVHeBIAAdx4x8EVep
TLSH
T14685E17DEB9C04E4E47AD1BC8A638606E77138A9033256CB02D491BA5F67EE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/824-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/824-134-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/824-130-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/824-124-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/824-123-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2136-140-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2136-146-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2136-139-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2136-307-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2608-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2608-122-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2608-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2608-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2608-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2828-289-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/2828-55-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2828-61-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2828-54-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/3240-20-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3240-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3240-14-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3240-22-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3240-102-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3476-78-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/3476-79-0x0000000000990000-0x00000000009F6000-memory.dmp

Download

memory/3476-304-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/3476-84-0x0000000000990000-0x00000000009F6000-memory.dmp

Download

memory/4744-110-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/4744-112-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/4744-118-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/4744-306-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/4864-95-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4864-89-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4864-318-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4864-305-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4864-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4864-320-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4956-45-0x0000000001880000-0x00000000018E0000-memory.dmp

Download

memory/4956-50-0x0000000001880000-0x00000000018E0000-memory.dmp

Download

memory/4956-46-0x0000000001880000-0x00000000018E0000-memory.dmp

Download

memory/4956-39-0x0000000001880000-0x00000000018E0000-memory.dmp

Download

memory/4956-38-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4956-52-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/5064-103-0x0000000000400000-0x00000000005DC000-memory.dmp

Download

memory/5064-77-0x0000000000400000-0x00000000005DC000-memory.dmp

Download

memory/5064-0-0x0000000000400000-0x00000000005DC000-memory.dmp

Download

memory/5064-7-0x00000000008B0000-0x0000000000916000-memory.dmp

Download

memory/5064-6-0x00000000008B0000-0x0000000000916000-memory.dmp

Download

memory/5064-1-0x00000000008B0000-0x0000000000916000-memory.dmp

Download

memory/6088-67-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/6088-303-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/6088-65-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/6088-73-0x0000000000750000-0x00000000007B0000-memory.dmp

Download