43fec22a42f7cd2597ec06b0e5c5937e78b8eeb6eda8388acfe71621ac78c51a

Analysis

max time kernel
148s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 09:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Size 2.0MB
Sample260922-ll5fcada83
SHA256 43fec22a42f7cd2597ec06b0e5c5937e78b8eeb6eda8388acfe71621ac78c51a
MD5 de7ba7c11ea2286b43f63703b5a598b6
SHA1 1621229a21ed3be002b774ce58c34957bdf3f702
SHA512 6a91924a34b687246b4a7110a96a62aa0c76e33f45e44418a7e577c6ac6e477ebcc8c21fb1ceffa41b344946bf99a0ba87a8d6f68685ff472d27c6ef966fd2a2
SSDEEP 49152:NKKepYeEAYOW1+M5A83M+svqia6iGpP5K9mM:YK0W1+M5NU2n
TLSH
T16AA55B1177E95A29F1FB2B71AEB851604A7B7C615F31C7CF13802A5E2970AC09936B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
28	1496	Process not Found

Executes dropped EXE 13 IoCs

pid	Process
6020	elevation_service.exe
124	elevation_service.exe
5976	maintenanceservice.exe
5216	OSE.EXE
832	PerceptionSimulationService.exe
5052	perfhost.exe
4716	ReFsDedupSvc.exe
2220	SensorDataService.exe
4856	ssh-agent.exe
880	AgentService.exe
3764	SearchIndexer.exe
2380	Reader_sl.exe
3988	RdrServicesUpdater2_x86.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe

Drops file in System32 directory 58 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d0a817af227843b8.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrServicesUpdater2_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000088d04c40764add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000ae173741764add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000a703940764add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006a627643764add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005963ef82764add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b9903283764add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Reader_sl.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
2712	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2712	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2712	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2712	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2712	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2712	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2712	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2712	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2712	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2712	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2712	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2712	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2712	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2712	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2712	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2712	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2712	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2712	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2712	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2712	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2712	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2712	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2712	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2712	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2712	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2712	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2712	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2712	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3988	RdrServicesUpdater2_x86.exe
3988	RdrServicesUpdater2_x86.exe
3988	RdrServicesUpdater2_x86.exe
3988	RdrServicesUpdater2_x86.exe
3988	RdrServicesUpdater2_x86.exe
3988	RdrServicesUpdater2_x86.exe
3988	RdrServicesUpdater2_x86.exe
3988	RdrServicesUpdater2_x86.exe
3988	RdrServicesUpdater2_x86.exe
3988	RdrServicesUpdater2_x86.exe
3988	RdrServicesUpdater2_x86.exe
3988	RdrServicesUpdater2_x86.exe
3988	RdrServicesUpdater2_x86.exe
3988	RdrServicesUpdater2_x86.exe
3988	RdrServicesUpdater2_x86.exe
3988	RdrServicesUpdater2_x86.exe
6020	elevation_service.exe
6020	elevation_service.exe
6020	elevation_service.exe
6020	elevation_service.exe
6020	elevation_service.exe
6020	elevation_service.exe
6020	elevation_service.exe
124	elevation_service.exe
124	elevation_service.exe
124	elevation_service.exe
124	elevation_service.exe
124	elevation_service.exe
124	elevation_service.exe
124	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2712	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeBackupPrivilege	4716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4716	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4716	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4716	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4716	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4716	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	880	AgentService.exe
Token: 33	3764	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3764	SearchIndexer.exe
Token: SeDebugPrivilege	2712	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	2712	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	2712	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	2712	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	6020	elevation_service.exe
Token: SeDebugPrivilege	124	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2712	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2712	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3764 wrote to memory of 2148	3764	SearchIndexer.exe	102
PID 3764 wrote to memory of 4280	3764	SearchIndexer.exe	103
PID 3764 wrote to memory of 5072	3764	SearchIndexer.exe	104
PID 3764 wrote to memory of 2256	3764	SearchIndexer.exe	105
PID 2712 wrote to memory of 2380	2712	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe	106
PID 2712 wrote to memory of 3988	2712	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe	108
PID 3764 wrote to memory of 4092	3764	SearchIndexer.exe	109
PID 3764 wrote to memory of 5256	3764	SearchIndexer.exe	110
PID 3764 wrote to memory of 2868	3764	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2380
- C:\Program Files (x86)\Common Files\Adobe\ARM\Execute\808\RdrServicesUpdater2_x86.exe
  "C:\Program Files (x86)\Common Files\Adobe\ARM\Execute\808\RdrServicesUpdater2_x86.exe" R32
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3988

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6020

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:124

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5976

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5216

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:832

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5052

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4716

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2220

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4856

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:880

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3764
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2148
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4280
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5072
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2984 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2256
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4092
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5256
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2984 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
Size 1.4MB
SHA256 2453f11c8a91ed71669c9576814c1ad74a673677ed8fa781fc428df76a327a59
MD5 9abd509025e6ec67dcc8b90e9cf59717
SHA1 c1dca88489b626d17096677956ae70116b7acdf1
SHA512 0532892016bb15fe48d8861d035609ce3dc1736a03cc8c696d1675221740dd2146160c8166ebdaa76974b971b0cc6100e7716ed9a12fb3c135d633c430ba4c06
SSDEEP 12288:9FHKp4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:bH8iGpxAoYmK9jSjwp
TLSH
T1A265232337874EA1D95005B078A5A6EAD1BCFE34AF0006B3134B7B9FDC756D2687285E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
Size 1.7MB
SHA256 a91294da99d4846dc21a1bc7340c4bc270df23267416c565ee7c8f7f826baee4
MD5 7da48886072072da9cae80ea1eb76fb8
SHA1 33da1267091db51813d4dba268bc45b2c273ad96
SHA512 e642cbbc58b646bae6c653aefd95721862f19f3c3142903dc1725b2313a23859f8beb52f268bdf911d16024781c3ad96790ae95310fe960dfc476f3be1a6cd22
SSDEEP 49152:oSgouvAeFfenxyQ5XS7uQ0NImiGpP5K9mM:oS1uxax1S7uZ2n
TLSH
T198855A0267F94129F1F37B71EEB993645A77BC71AE39C50E5280125E09B0A90EE71B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
Size 1.7MB
SHA256 6b647ed5227e9a0152faa0296a1e3bedf754445435d59227ea4b42f612d757f2
MD5 7505e94ded3f15d6a5cdf793b13b01ca
SHA1 b9598cbc569b620aff1ef1219dffd59e85d8ac89
SHA512 fc4bed07f0f7ca4a5d695b9355f20235d49a57ac028b0b4b1d72201f8c6766f074f961d7ad60873b1a9e13b7b0de20fba15d016996c3667995c0b82dcdac5c54
SSDEEP 12288:F6dVWnxlMKn7nFKbltn+Ch/m6Xep4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoS1:UKTAbD+OmeYiGpxAoYmK9jSjwp
TLSH
T1BD85E11133D1C035F1B329728ABFE728556CBD715F6881CFA3891A6E5D70AE0A931B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdrServicesUpdater2_x86.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\Execute\808\RdrServicesUpdater2_x86.exe
Size 846KB
SHA256 6a142c879a0676aef5c825d6fd6336800846167fab422d0f912096d286aa0070
MD5 a447c3cf3b7547e5a1e12dbb92d8c052
SHA1 d2b246eda6302534b21b2003719d9f911d0c77d3
SHA512 ce7446e337cc13a560a12b0b789813bfb5a96a6a9d25a8b3e2fc1ed884f0c4950f01937714614666befb9b92123d359b9597116e9ed9e8efd46b77a640d002ea
SSDEEP 24576:uSU4vrTQA/gK/c8DV5Wa1ZmPEKBLeiGA5nEJ:uP4j5gKU83W3FLeilVEJ
TLSH
T10C059E22EAD18073D563143102A66F368EBEB9310971D98FA3D41A4E5E705E1BB3F397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a80e4dfdca451d6fcd0aca84028e98c80adbcdff5112645b16bcefbbd0447e3b
MD5 9e0ec85ba76da9b579c1ad108e001142
SHA1 789d5add6da86f93d721fd285de5a2816c8a6638
SHA512 6ff6395ab15dd9caae48c12289af13f77529f505c0b246d236ee3de7a3e5cac5587a6a1d4532285c830c484f478ce9bda58546e407c748755f4c924b589b13f4
SSDEEP 49152:5b+632BuPkFKRrdE6ohrstBhuXjfS4LWxn4iGpP5K9mM:P3q60jBv2n
TLSH
T120D58D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 a19c905f89e3cb4143bce9f722110d342299b44ea3e473dd57a3a64bbfa01987
MD5 c2865594a674297a6fb5af4aa5d36fe5
SHA1 1fcb6821e20ed5cf9b073b0cb7afc45584302c59
SHA512 b9357724d094278849ee657903b79ff2f1e7cbfa7a0ffd59202b63a56f0491a58f2b757117b3d67708dae23ce62bc8ed5877fd1100638b41ba98b9ce948cc28f
SSDEEP 12288:n1XLsswWkxy2lRq2czAd4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:1XYfDtczAdiGpxAoYmK9jSjwp
TLSH
T1D975012573D10CF8ED6B8178DCA28402E632BC554760E79B03E49A6A5F337D86D3EB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 68e7ca7a20df7c5a214547c0efe27884d30a163f778aff918df4f2d4883c67e8
MD5 b37c4190de5bd8f09900c312e9415e66
SHA1 2259e5bfbbdf8bf95e8708d70f0b6f5d631a46b3
SHA512 29f079a00e8a8f83d05835224eaf5666d32611d751e95eba12cc374ab6a26d650e7887c7616407275055942cf4a7d0ac803af0e7e300f23509c76f79fbf47579
SSDEEP 12288:qXZNYVLeyUji0h90ZD0wxpGZIVuNrHsA4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zp5:e0Le5ji0hmxKrMAiGpxAoYmK9jSjwp
TLSH
T10695AE26F6748731D073C0B9C5D2A68EE97134825B308ACB4286D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0d7b1eb979c4a49183c23581ea52094df31df85f971620c2c837b6a5464d8ed3
MD5 f1e7889fe2b42ed190456b6ab1cb3d83
SHA1 dea9a5d17d7eea6cd40c5b7cbc06607857201153
SHA512 8ca4bcdaf6dc1d915d5ace02b96e07cd0471320119476ee7f11b6b0801b7a888bcbe626c3e15bf31c6ac14f23db3fa5649b873c8c4e96705e07af3868e9f5e0a
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWr6q8wyu+iGpxAoYmK9jSjwp:+/ezSC6vUzPviHjyriGpP5K9mM
TLSH
T175756C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4000ad39bb9d58da4d24f60e015fa446f8c30c2b244965aa68f228dbd186b25d
MD5 802f2c21477b93eb10f0071739de8baf
SHA1 21d400f6e4883cfa3e65a29ce9a2227a30f09b0c
SHA512 fce55a102f463947597efe2d81de56f7fb377182b8aaf6b8b586b209d686ee4b218c9352c01860897f187dc0e9a2efa54e175e9458393fece5a17960a8278ecd
SSDEEP 12288:ZVJjBq33vb5O8M+l1D0hwsEBoW/lx45f0Im98B4fPt6tpm+OXhWS6rVoVlK5KZmf:ZVbqPb88hv/l+bBiGpxAoYmK9jSjwp
TLSH
T1DD559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 ac1de705e345158422a93ccc93e402e73cad01f33b571c772b83709b07ac2ee5
MD5 9ed7b7a68fb83e7f68975fbbc5354448
SHA1 3e1cd7f34b43e588b809c11359e9dadbaad1f47e
SHA512 a0adac84e9e6d5ba98fbdf22b019c2544ed8e7ac5140ddd1e8e4576be46cdd19c4a6c5c76a974753fc7cc006f3b3a00aa6d4efec8a9577253ea4e2c83763ec81
SSDEEP 12288:Y/E4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:Y/EiGpxAoYmK9jSjwp
TLSH
T10A65232363571CE4EF6925B0F8E5B4C68254FE74A8504933125BBFDFD832A61F4A188E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 f7eb7081ea90e087ed64be557191ca52f582577bff1ea4feafda4670e741fdeb
MD5 829397d9847e3730b52f2202b7c1050a
SHA1 b93650f0bb801c166df631cf75d955863e811730
SHA512 d9f690d6a2d03b4861fc6786db0409ff0fa20b815321d7d10d3cf30cd66c3d40be2cc3975800345667bdf2e44a43b053df0a56b997a8d81b6ddfefc87252e85c
SSDEEP 12288:BeBNUbTVO86UJ4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:BJIUJiGpxAoYmK9jSjwp
TLSH
T1AB75CF3BAE28FCE2C27E9DB86A918640D77278304B61A3CBD165C30EDE235E15D75C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 07ab9c0f26c7d032dc8975ade4884dc475331e4f9e55c90bdd9a0d779db73b54
MD5 f82d8abe46539e63f1ff8fe89b2884c1
SHA1 2b78af77803a759371667068c8039ebda070fb1d
SHA512 d10009c01b8a6f45327b3677fc9d6597e33eccbbaded7252ef4fba00dd40fd3ce91f3b53cc007cf57f9b1f95f50451b23c95637c342433e1daa40a1d0ca3dc73
SSDEEP 49152:2QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THs:2QvGAdlCEL8c/RRNw5C42n
TLSH
T193267C656BF880F5E0A7E174897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 13ed0b46a3f35edeff7ca5bf96b01fdb8ee7fd14dd07b81198b94761e19ad4e6
MD5 0ce32b8530381fbedf60bb435982358a
SHA1 11e32d73b77bb1c4c5a7ba0698fa5c9fda3b2b0a
SHA512 9c3e22ce831043b3f56c9b169e22d7ff4b3cd3b959cbe219869468b6169d97260f5b9f228a75322e75192e8ac9ce41d3dfebf7b4095ce0a11cde220bd706aa1f
SSDEEP 12288:KAwSfxL/2Dc3uDLLmt0LDQewsAjP4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoS1:fbewsAjPiGpxAoYmK9jSjwp
TLSH
T1A585E031FA75E436C77F0DB12B26D716542CBE204B5119C3E3A89E9E99302D22376E1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 484dab109ea9529403e72395693625e021f83e0c3ee8390985745bf0a2fe2e84
MD5 ca052016f5c2f9d770aac57f3ffb8414
SHA1 00b9e35f63f06fdb607eaf01fb7781911e56ca59
SHA512 2a2f45eafc4d0b9e501d63935205be170cd3aeee0463aed5bb5389b6d93789de55598aedf596bf23bcc6dabe7e7df3cba27286084de18fe4a42875d79459d6b0
SSDEEP 196608:wUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHB:wUEtQevvqc2W1cpV2RI32B
TLSH
T13D474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4489b399f2a04f9d3d8b23d1da1ae0453206c8046d76ce908fe025709fd3126b
MD5 a7a1beabc363e23b2fb6d44e2e3e872e
SHA1 43e61b7963bd9bdbe7bd6d8376c6f97a70d1d6e1
SHA512 13764a16921717ded3268d9d9e5cac71eb1173a33fd99bdbedb0d475dada54b9a8fd8cdc1ca7b760f6e2770c93bc4c2132fe8cd8a8a0e202f3589f8a3e02dc2c
SSDEEP 49152:wCbRquA/m2yL5zQfFiV+XenmE3/zviGpP5K9mM:ZoqtVjnm82n
TLSH
T1A8D58D0976B881E4D1F6C77896A2C647F37178154B309BEF4266461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 98caf4f6acf2a49d4704e5aefc33b14d2f7228a4a8cc1c09ef774f12e6736460
MD5 14d3bff2d41ea023029f1eff36a0baca
SHA1 47a510268d38cdb33746f94c740b54cccc8d5046
SHA512 0eae31d80d104574337236d26b3f9e7437783e3ace3c5d23545604638e2dca9224b2354e70ddf6751b661bef6a164e2dc63a5313f227fd4c2063e3d6a6b80b57
SSDEEP 24576:kAhGL2IFoiwtA5l7S53KiGpxAoYmK9jSjwp:kAM1Foiq5aiGpP5K9mM
TLSH
T12535AE81E7F955D4F5B3AAB8A9B69071EA76BCA65E30C20F2150D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 b02fae34495bbf7b344abc0ee46dea5610a36c27d412dea4722048d0421a7822
MD5 3df8bce315d5623b6ca9b4c1ba57b47f
SHA1 4d8d4a7d1459fca2bf8333e80717a1de7999d767
SHA512 0d6a0d95bc54a13c01bb001a48d3fd425cb8354dc712549ffa5446bb3cd5df872e6d93430f7acf3f506139d341da7c24b08a129489b2e283e388e08f7282a2d7
SSDEEP 12288:Imw5HEjsChNjBFgl0WDm+Ce4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:lwuWOWLiGpxAoYmK9jSjwp
TLSH
T1EB75F14673A51CF9E9675234C597D036E7B2BC112A21CB2F1360CA5BAF33361BD29B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 87736525aeec24fcd30f4f1b7964186bac6b553275dacad726daf36c87c5d2a2
MD5 c30f89347788ec76fd614bfe6b023991
SHA1 77f789c4e9d43cdea88db5573c461d772d36ef16
SHA512 2f2b138fa6335f8771b7585d82a8776d791ac1343d926869ce9c56e7fdb03ee5ef7ee7bcaf508615dd1b922007ea92191b21e2541f3149d47debb8d2962873f1
SSDEEP 12288:4LZ1Iy/4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:QZuoiGpxAoYmK9jSjwp
TLSH
T12C65121233E624F8D6A75174E8E15446C371BC66673043DF122A9BAF6E33BD26C35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e5f17bdbc0ba9f1588786ebcf106557bce04e5ef8f5f9cbd8342653f2d9fa597
MD5 67fb92d2180a6e8d595c574e11e1c13b
SHA1 ed0f79770ecb597407641c7d30323c2e253a382f
SHA512 735657a8bdd775a347bcec16c99383cf4635794bf59fb51cbe663fac0a9f7d41a9bff2378c91b2819cd6665ed0c80de61c729d96049640662fc744aab3bc394e
SSDEEP 49152:Hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Ug:2QRQyi36YOcPhLvw2gAf+PN3b2n
TLSH
T10F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2954884237c513a1620c5d36bbca44d20c99cd7410bdef0b38be0be3520c3b9c
MD5 3423d929bdad78e587dfb53986b1f728
SHA1 fdd1d1cb457021537ea05b06d0b985bd6e0f8fb0
SHA512 f7677393a87adaabed81809ae3c6b87a74c66e8fb6c4bff14ccf87d173bd029ed6522322018e4235efbd10aedc41c859235a286aaaa95cf0a27685480f832db6
SSDEEP 49152:Qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Ug:3QRQyi36YOcPhLvw2gAf+PN3b2n
TLSH
T100667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c1e21500ba35a09533694470040b2dd15399b9d51d0b9d9ef4f991cf38c34625
MD5 67365996b68580a06ab12a84eb396feb
SHA1 0390d551dcaa5dc8e1989bbd5f86c0aa94555283
SHA512 b5c96dc66a73a4cc24e524fcadd9dd86cd597eca49e44d069442c532f8b6862962441c1a53448bc5f0a838dc5d0a0ba342d3aba9ebc8c8c4b3881fc239a84685
SSDEEP 24576:fwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL04iGpxAoYmK9jSjY:H68Qg55nhceWu7PNU3/fiGpP5K9mM
TLSH
T162B54933B2F600A9C44DE1769F4A973196D17C758FE0E3DB8115720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b62845ff4551d864e6984f0cb98d4a19f7adef626855ea1ee99504af580f0c41
MD5 dd7578da9d0dbe98ea95e15a29db2209
SHA1 fc25086f43e186ea7307c7174256db33769251f6
SHA512 919cbbdc111cbadcc260d78cf5149ae512a212d65f2ddce830636f8d7939813558de67dd39b3e5ed3aeb839e13c202d6d3dfadea26cda6431d59746a583f9299
SSDEEP 49152:T3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99S:Gy5112gYy5azzVva69nLKnhZC2n
TLSH
T171167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c0b0981605fc25265c1225fc0bd03ac9be27317423942768d724aa668128c695
MD5 509091eac03ec8b0fd05f891b9fc4ae8
SHA1 bb294838b0b94f2afae6a2ea9a8512797ebf0fbc
SHA512 7176676c26fec40e87b14e1423bfe459545ef5576616de4fb0a0bc2b244e9dc5f7ef537edf4a22fa2a1ed7ac57272eeae2a90681424ed6d102c2bcad5fca193a
SSDEEP 49152:xB+taZ3usBWOBr4tEG20bqx0z+n217aau1gltiGpP5K9mM:nu6JmUxd2dj2n
TLSH
T18ED59E13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 86f5569ef372bf241b7d2ddd9e3b947353bc8a1ab8566196820e1e1f2d39b130
MD5 47d642e992092419acb061dd03954802
SHA1 43fbb06044ce921333d22e03d1b6acdf47e5fc9c
SHA512 1e50435ec1d596311a80f7dd473bc72594d96d94fd17f51bb0dd857a8371147d99d2e57973b879a3d2a512f57e3c16f1070ac9bbaa882f3b4ab27cd6dd681737
SSDEEP 49152:O1hpsNoJpF1A6BU44CwH7R4xpiGpP5K9mM:OmifPkR82n
TLSH
T1D7B5AE13F2D900E8D06DD17897569232EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 cd46e42606a8007d4fdfe46604ba70dbe7c0c45b05eabfdb185174b5fb16ae62
MD5 77920e84e00958b00a217e4cf588a090
SHA1 910764996623c05b8260f41cf37521e257c3d158
SHA512 aa451e898f30289443026616525fa769ba401f19db3400768974e1d89972126e1e156cce99e918903528b6b84ed95be785f4e3a6500489fa956fe9cf700c46c6
SSDEEP 49152:GSuZQIY0Be2KNRVtOnks6NMHqoiGpP5K9mM:I5dKvi61e2n
TLSH
T106C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a89ea0cbdd0a5a53e0f2b73d06654836ef643e642c13d4a5ef5a91390189b08a
MD5 f2f8babbfa149d3325402e18057106f6
SHA1 52c8b3568650c3f30cabe5fb65a43d372cee2199
SHA512 167da8517411f3783dd915c0bff7826b090894edf825eb4573d180e9a70fb02edb3c001ec2b9a63b0aa65d869cd777aa8be67c25262040f0a4637e1ff341953f
SSDEEP 49152:xhtSn8EApI0figXgiDn0AP5wdiGpP5K9mM:gX2iyphQ2n
TLSH
T11495BE13F2D900E8D05ED174C7568632EA62BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 5a17d52f621f26a0a89b8fa5d9fe6e587416110a9be08150c7cb88279d14c0aa
MD5 5a0ddc691ff14fae54d5a049408681ba
SHA1 b25265f8e12011c599c499e3543396f6cfed16c0
SHA512 9e9cd5abe8b9e9f74bb7b12e03cddd7ae6393c4b227027018d5039792463aa3ecce341e424d82ce88fb5feb3613806521584689ecf77e1064ff6a175ae2947f1
SSDEEP 12288:JM4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:JMiGpxAoYmK9jSjwp
TLSH
T17765232372970CE8DA1925F0F8D5A0C6C254BE7AB5500573225FBE5FE873A6174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 11f825dcbc22d680008c6f1549df44d1a19b68a76d789dc0cabf164e628fcf5f
MD5 9868346b76c4fe31b48f219dc80aa0df
SHA1 9514c97a2cd023e94f73f4de4eb2280cb172254c
SHA512 7743141b86ea626ace728d38be0a7742bd2a3456e89c174d249c46b09010e24057c2e119425674a0855e5e4900eb5324c2a09f4a6f44999d79adecbe10300be2
SSDEEP 12288:ND4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:NDiGpxAoYmK9jSjwp
TLSH
T1AF65232372970CE8DA1925B0F8D5A0C6C254BF7AB5500573225FBE9FE872A7174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 c8ff491a157b7db3eb9f81de47473019ce1ac83faf301b31bd639c1f908e1207
MD5 241ca592b6ef8226fc6e442c20f80202
SHA1 10bd0243912fab2b0320b31cc9ba9ebaffd04c25
SHA512 16bd9255aa3f5d223ff00bc31fec222431a2f00e9d72e06023e2deffb49de7af6b5e2e0b93d10ed7705c155510c10f40b5ac9453fa721180d1d9588ae4baa30c
SSDEEP 12288:rR4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:rRiGpxAoYmK9jSjwp
TLSH
T10B65232372970CE8DA5925F0F8D5A0C6C254BE7AB5500573225FBE9FE833A6174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 488299367875bf316af5fa29b5b14037629302371977ffe2f3b8eb0f9614525a
MD5 692edde77217ee7177db2b1f680014a8
SHA1 d7a97b0e9828a22f6eb78e64610f2df156b2f3f2
SHA512 2b94c1c1a3f802de595ab8de3781c07307c2c05e5d79179f98482792c7580d0674a1e96ec7ce0773fa6d952d4fd9236877a28606fbf107afb68bfa7889e02ba5
SSDEEP 12288:OVq4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:viGpxAoYmK9jSjwp
TLSH
T1B1652313339B0CD4D965A5B0F8A2A096D3B4BDB5B72046BB13077E9F9C727A17870C89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 346ba439122325839e440c05bc53a178a6283921091cbcda6411be8414f26b0f
MD5 813fbbfbeadbdd18193b86def5bfdae0
SHA1 0fb371c4486c9a5178dc174762b0610c4c68cede
SHA512 e97172c1a4083568fb3b944a16c872901bcf5c04a6322969481fbcaf0867a9e8f2e7a1db9d80ca97b7123ed4adabaaaae354393300ae854a4b28f7c5265a16ff
SSDEEP 12288:CC4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:CCiGpxAoYmK9jSjwp
TLSH
T16965232372970CE8DA1925B0F8D5A0C6C254BE7AB5500573225FBE9FE833B6174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 0ddb3d7a93f02f5841498c5820915b8d6a5bdf2f5a9dfd449451d1da86841699
MD5 271c48563f18a02868fef5b5069903ef
SHA1 f718f290f5622f966c64444916382aae6177f35c
SHA512 13b66a03e05071d6a2fb60786b77903af992b4feb3ed84ff845b4c1a01b6898990a4813e2cf0c45b514e7e971a01bbb33aeef0e055f1dbfc0641e529427dd9a3
SSDEEP 12288:X34fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:X3iGpxAoYmK9jSjwp
TLSH
T10465232372970CE8DA1925B0F8D5A0C6C254BF7AB9500573225FBE9FE872B6174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 1eee4cffc59fa33dd413e8a6de69da01bc1c992b844abb534e862894b6b21e83
MD5 aa927c1f01ea872d0972f8af15ae78d7
SHA1 da8f1d5fe25ac6df2ba162f1f0edf48f25840772
SHA512 55c1b231ba989cf750b4416a4c683d13461cb3c7b4e6b5d445558465cb67c89ed5ab1133dca540ef422d8e9161e03f4f9ca2f8df1a193fc45f271881a6c230a7
SSDEEP 12288:cb4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:cbiGpxAoYmK9jSjwp
TLSH
T10665232372970CE8DA1925B0F895A0C6C254BFBAB9504573225FFE9FE472A7174A0CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 ebe6ff8e6cc263fb818f6556ec5af4d81e3caf4107e0d56c5efad02f7fcf5b50
MD5 5ceba155fc0c5d8e54c58092f1262909
SHA1 2b58b9d103495f93d36b6bbe38b9df6622575795
SHA512 13a69030438e4e41e6bb6067f37d5e455a5f6aef031cc670a33dd7e273cfaf997b9ff456de41cc041d60a8369c54fdbc578fa969c809e53a2ce86c7205e6d912
SSDEEP 12288:viZwbbzzFEoS2cPvyj4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:KZMvzFVSOjiGpxAoYmK9jSjwp
TLSH
T1FE750161B3911CF8EC678139CC559846D2B2BC6A1B60C61F13A9366B5F333A11C3EF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 09e18f434813f7cdce6fec3ba212b1b1e9d9c68b50c7640582d7ff77e24dfbce
MD5 acf903ca26870dcb5d961ffa091be39e
SHA1 c688aea75c644c58262c8185d5285e803ec3554b
SHA512 ef7ae5b120d74595f6c216d0e8dac4fa60c86d26a3822665bffdcd77cdcf9adb1fdfb0a4aad9b39b0063109d574b316f2f911f8bf74e18916a68018a2980188f
SSDEEP 12288:5Y4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:5YiGpxAoYmK9jSjwp
TLSH
T15C65232372970CE8DA5925B0F8D5A0C6C254BFBAB5500573225FBE9FE833A6174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 3e16043ae48f8f5a49b0b0abbdfe02a7df68a66280e691ddf84b3fb5f5cca68c
MD5 5ae356dc52d3cf8e4f4206ca34a8b901
SHA1 7726e08ac2182de3fda19287ee56ce0517350f93
SHA512 f4f3623f5d23c328c86d9a903ac37da9bf131339cdfd0614fd17368e9b55d0aa20d8479e7c58062e1eaf623474eab07edcf6d5962ead4f0baf0cca348277a38e
SSDEEP 12288:T04fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:T0iGpxAoYmK9jSjwp
TLSH
T11765232372970CE8DA1925B0F8D5A0C6C254BFBAB5500573225FBE9FE832A7174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 be6480bae3176401349c493b940e34a76e448e5cbe4078a14b80afd82dc9f6c1
MD5 48b944c4967431ed9e66f76fa1d2895c
SHA1 79558447f12d940b73cbf8d839f34e975529cc23
SHA512 9ca2cdea9ff0b96ca961bd562ceb79990b4b511ec5e4536505b211c6c66176135402cc7d60b9bd5a10c1247310987307c8dff6fbf3a397a9c25364b8aee358a0
SSDEEP 12288:OyPz5L8/4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:Tzy/iGpxAoYmK9jSjwp
TLSH
T16375121373A234F8D5365270D8A21942E371BC3657208ABF13655B7B6E337E1AD3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 2f7593a6daf532bd5b53bca63575b33c5db301b506650c9179e35e6592b28480
MD5 2e5716b89d0bc1204ff871d14bf55454
SHA1 28197205dd7c66f1324edb416979af14864ea078
SHA512 e3f86111c0678c6418068bf24ad1d1aec49574e9578a1481514313b00c0fb8261f512469969fc797a6b6a1c6edf81661706e4afc505d3262c622a47ca840f39f
SSDEEP 12288:iY4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:iYiGpxAoYmK9jSjwp
TLSH
T19B65232372970CE8DA5925B0F8D5A0C6C254BFBAB5500573225FBE9FE833A6174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 132232175e1a33eb75bcc0057af2da60534ab3608a249b265f670c438c2e0fdd
MD5 c068da26a285265f07b79ff599c8b257
SHA1 860c0d9fa615e6e757083ffa19db7c8c0e92974c
SHA512 c66359294381217f5ba8962c04472a82fc9dac7f542947ae5271d6825db661eaa4e3ca6226ff67015e539cbc2a57c792d479566734b54f35d244d277a54eae0a
SSDEEP 12288:fY4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:fYiGpxAoYmK9jSjwp
TLSH
T16265232372970CE8DA5925B0F8D5A0C6C254BFBAB5500573225FBE9FE833A6174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 c17e365afdd65e96292e40416034d73d59514eb139a0138a9d8ab1d88d778b2d
MD5 9aa324232ec48a17afff8bba61c82999
SHA1 ecfc8b2caea61a64d6b91dbe17b4bf06ddaa7612
SHA512 46cafe9db1c0733283b0ade721a72f04e8a173dd55f6f023a8be421aa030316bc294f72ff63d1c6bcb33bdd4516bc8aa5530d8891921000171835ddd6a548959
SSDEEP 12288:CyPz5L8/4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:fzy/iGpxAoYmK9jSjwp
TLSH
T18875121373A234F8D5365270D8A21942E371BC3657208ABF13655B7B6E337E1AD3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 2ff623952e311f775cf17c42adde27da7460aae25dd1d2e8fbafa2e23e107aa8
MD5 c44a4d7094596353afc180ec340d2415
SHA1 e5d57c4a1c8efec7e47984860482344f0e0e4be8
SHA512 affa224efe2714d31d9460fbf5ac4afc31267b93876931ed9010b34d9b6ee15ecb27c1876ae49974e495371980023a55f683ad616cbebf7e30cb217528aae68d
SSDEEP 12288:JCd99WYoaLHF3z0z04PDvhh4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:UTkaLl3z0zDhiGpxAoYmK9jSjwp
TLSH
T103750265B3911CF8EC678179CC559846D2B2BC6A0770C62F03A93A6B5F333A11C39F99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 a59af5c0c9d58d37b7d67abee7dc9ded6f7478b412950bfcdba76220d6b6a896
MD5 2c37c62f46f961a8151d01f817ebac6d
SHA1 41655da85931f790edaa6c4146bcd9285c01a7b5
SHA512 a0e8d4166a358b3dbd72ddeea0c74c81058b544c0d5e4900b3bfed866f6d12b00470efe870fe38979a2c7219ef180272e2b938b5d93153c992ef931992d0ac77
SSDEEP 12288:Vi4e7vRdTfgwCHKy7GLbbdIv24fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgx:V3od9CHKy7GZFiGpxAoYmK9jSjwp
TLSH
T11E95CF90F3E414E8F0B79A35D8765511DAB67C691B30CA8F03A8665A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 841f58825c226a8eff20b8848ae87bab45f4c67be7a0ff4de1afea8889d3b753
MD5 3870705d8f1b686c98eeffdbd73815ce
SHA1 f9e10348271e472ce450d736dca9170062d3d9ad
SHA512 c8568e71861d73abfa6025fba5d4030ff1331d00cb5166f30bcd562c2a27907c27ab11feaa1d83f859136fa450c219efc3d9a9a59e0aca95612c25bd9a0a8ec3
SSDEEP 12288:3x4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:3xiGpxAoYmK9jSjwp
TLSH
T12865232372970CE8DA1925B0F8D5A0C6C254BEBAB5500573225FBE9FE873A6174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 ba903a83cab2e3fbcf5a90c3ace2ad87d0f7455376c0a6f368eea3dc573dca92
MD5 60c9a389ad198f3f096d0f8a5b223f70
SHA1 e5da32ad107c042c496b4f201d2c3ee0c43e3773
SHA512 db757a051b3bce3f946f3a7fb5aada82070ff1af06fba3c054066f2a12d9003aba29a15baf38de3e0e2670bb205963c5e532a5e8790fd5d4bbfceee0ab2e0f96
SSDEEP 12288:bf4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:bfiGpxAoYmK9jSjwp
TLSH
T1ED65232372970CE8DA1925F0F8D6A0C6C254BF7AB5500573225FBE9FE873A6174A1C8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 5be8e0ce0792a47ab52dc8dd7b54908259ecab462442d7f1291ebc4aef575056
MD5 a188088218bb7173d549f3231ef1c8f6
SHA1 85c6010fb7b66cceb7e6d3e4007c291acd7b44b8
SHA512 af4c9a6070f574b6f8f70053c7e7dd2186c5f9bdd34181ab97452c1d53b3e0af96b39d98b4d4a4b5327da8b93880be92d639c0c6fefd8ed689c8d7760414bf68
SSDEEP 12288:E24fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:E2iGpxAoYmK9jSjwp
TLSH
T1EA65232372970CE8DA5925B0F8D5A0C6C254BFBAB5500573225FBE9FE833A6174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 32ffc9e9222a19927f4d4b33a48ba7f108a902d90e97e30db78d91b0fdb8845f
MD5 e26dae6fe59ab71b718d1fa6426da7e5
SHA1 837ed576c4ee4d5a2f4739beb865b207de6f0f8e
SHA512 ba9b78aea6451bbd183ec9723daeb334866ed7edf112febfb1f966a0c20e876f8edc6f856327d8644de1736746ea9029ad1b5b1270483008f882b6a624c0ab8f
SSDEEP 12288:vY4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:vYiGpxAoYmK9jSjwp
TLSH
T13F65232372970CE8DA5925B0F8D5A0C6C254BFBAB5500573225FBE9FE833A6174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 f138800123d053343b3d532044f035caf7aed23f49626efe7cfa68001eba0ccb
MD5 61c1c59d99b0eff1e2f372bf1abe5cb0
SHA1 66f8b8ed7970ab8caf70a0749a64ac3e8078eaec
SHA512 6436495a519bfc12965a6b8590400b94fce1ba6277a619f7ccce83a223d216e239efc3840d28125d37b293a395f53b014423e1d71c8d5d8787ecbc0495a03174
SSDEEP 12288:NfwvD5u+64Lk3tRX69qkyAI5u4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgx:Nfwvdk9RX6wkyAIkiGpxAoYmK9jSjwp
TLSH
T12595D029EBDC08E5E177913899B7460AF2B17C691B31C6CF129A53AE0E33ED46D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b86351b7f10b495570706b4552f8b095a078d681396b967d5ce3b30bf54a407a
MD5 98183bdc2a21912c9c0a435ac771a176
SHA1 1204ffacc17fad3bfa0d40ee67024e6bf8b5edba
SHA512 c9859778f41d1e9278b7a84b7dda0086f62868f229c54c357217eab5107a99932c72b841da640394cc6e9c4ee043e81c2bf0647e8c3c68b37e55ccb59665627e
SSDEEP 49152:qYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK09iGpP5K9mM:WySzP72n
TLSH
T11C066C56A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 caf1b44822aa719b17fb809389c29827f4a1cca44f5e9a70349cbb266b32f80e
MD5 07175426aa882f7f1f276ba8e39962ee
SHA1 4b44273d31ee2784f95054e13222108aa38eea56
SHA512 730b4b5aa359dbef807679e7f34f6a409198b386e0b1774c39227e79a0b013fe78ff2fca4d6e1b807021be98bb2ce1d92580161368a08125eaa2b290cd410350
SSDEEP 24576:p47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYTiGpxAoYmK9jSjwp:p47JUQj4irIhCnDHUPfF/tiGpP5K9mM
TLSH
T1D165AE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 15234adfd8ce2e048d8ab7636be53453128c0404b375d553e8c629692aac441b
MD5 be8614d1d0943505f79a3d6f39367156
SHA1 658f29f1429c5916a07f1722bb4f4a948fd97d4a
SHA512 3cac726b33a65e72be699b23ff49abbe894769808aa761d4009163c49a67e0c6506253c852a03ce53f889e911c391424b50a32095b90a76940fff1ff78f6553e
SSDEEP 12288:tlsfo4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:eoiGpxAoYmK9jSjwp
TLSH
T11D750116E29906E8C06E6170DB969581F3337C6597E0C3DB13D1FA7E1F32690ACE6A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 dd6a57424a0dbcd5d63ad20f5251b811984349ee1e5a10a9b5ca002f536cc761
MD5 7aa10f8c977fe04e0943171514d2d1d8
SHA1 620daf0eeef39b0324d36692e13485f89eafe632
SHA512 b3e49bd1710bece1f0b361ec713d4dc413e8cd525dd43e81a59411ed76546f379d3141ccd2a4934e62058495434855810b480394e9fa1ef0be9f6a3ae29def1d
SSDEEP 24576:rMaf7UP9JDajq4vJEEaGaDRMvaOORwpl:Z7UjDa2o3a3DRMvaHRwz
TLSH
T1C54528017626DB4FC6A940325E36D6CCA7707D02EE04AF1773C9873F9476659BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 b05958956f2d57a38a947915a776b0f54a0a5ab851370d0b9405bab672a1edc5
MD5 3a9fa32863296880fa151f62f6bd1d10
SHA1 71b1e01ef521cf4b206ffc82f7ea2fb032329cc6
SHA512 a6d9adbfe46f73a0350e8955ad2f226545735d20e94d1065c72204dbd5feebee2c7a15081614cf816d3ed22fcd31e4b34b843db2c1694c25e0e38e7f07701c37
SSDEEP 12288:42FQauoLDkOcY9zdlkPqMZyLaVKMmtD1OfyaSZHQI366UMZXP7a3qWp/G2xDO+K:9QaxBnZnmQ1OflSZHqt33GQC
TLSH
T1DC651701A5A7EB4FC9BA8037423686CDAB746C07F7453F0573458938986A96FB5F23C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Rdr32756.txt

Path C:\Users\Admin\AppData\Local\Temp\Rdr32756.txt
Size 13B
SHA256 b633a587c652d02386c4f16f8c6f6aab7352d97f16367c3c40576214372dd628
MD5 c83301425b2ad1d496473a5ff3d9ecca
SHA1 941efb7368e46b27b937d34b07fc4d41da01b002
SHA512 83bafe4c888008afdd1b72c028c7f50dee651ca9e7d8e1b332e0bf3aa1315884155a1458a304f6e5c5627e714bf5a855a8b8d7db3f4eb2bb2789fe2f8f6a1d83
MD5 SHA1 SHA512

Submit Download

ReportUpdaterPolicy756.txt

Path C:\Users\Admin\AppData\Local\Temp\ReportUpdaterPolicy756.txt
Size 4B
SHA256 69bf0bc46f51b33377c4f3d92caf876714f6bbbe99e7544487327920873f9820
MD5 455831477b82574f6bf871193f2f761d
SHA1 f44217a81173869e08671753c52553646ff5d95b
SHA512 cbc0ee58e447428bdcf72fc8b03c8cfb086edbb14205b918e75ebeff1d85ff1dd254e9dcb387afbd3fa766c803937c306e0a2a79870c0d87abcb7ab93661cf85
MD5 SHA1 SHA512

Submit Download

Tmp984E.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp984E.tmp
Size 5KB
SHA256 b2e41f3d236f5418f702111b610f382663c8893d82d5284462d2133f0e0c0fdf
MD5 38c0245547bc1440fb56c7308c2bb222
SHA1 8ccf6f27b9644fad1c8f13d98e9d680154c8d572
SHA512 78da2e84d0ebb47faec6999320198da63e02f8653a0b0609a16675592ff26b2ecc8de6a3210c31e28b72d6ee340dcdd792207cba96e1ae92b72c07d1d9fec897
SSDEEP 96:HX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yJF46R:3ULc8pq8RuwdmL4pUQrNyH4o
TLSH
T14FC13BA388946C45EC27ED00B4C89A23EDF576591DC0D1C33248C2A58B923973BDE2EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpB3A8.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpB3A8.tmp
Size 5KB
SHA256 512146b59d21f56f01882290e8b1e93e0553b85435b4d31e4c51d3d9ccd14df5
MD5 8de699a7d8a071e752e129d70525fcc8
SHA1 da6fcbafb68dd579195ff775afcf64f4209ef52a
SHA512 43697eaa55d5b7ca68036110d2bd12e01f6fc45fc7e3d4baf99b1de506170707a4eb801d6460dfcdf491fd58bafa3c93b8aeb5e2b36435e5249a2d7fe6a30be5
SSDEEP 96:PX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yh54pD3D:fULc8pq8RuwdmL4pUQrNyh54pzD
TLSH
T1F8C12CA349907C45ED17ED00B4D8A923FDF2B6952DC1D0C36258C5A58B823973BDE5EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpBC44.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpBC44.tmp
Size 5KB
SHA256 e6bcbcb70401d63ff0746fcbcc63230269058736f7644151393edfdcec8b8765
MD5 1b7ade3253fc67477dea69ef2147603d
SHA1 b71e8e749a3461c9b37ff2c3d099b1911d9cc6a0
SHA512 0edd5eb1635b1599e50b368cb254c94bf1588acf1d063e89f45fcfd6fa625e33d2c7764d9d00afd53dec2dfb342e9cfe199d256edcff8430ae183d357d4382da
SSDEEP 96:7NLX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yGtDwwBq:RULc8pq8RuwdmL4pUQrNyGewBq
TLSH
T16CC12AB388D06C41AD5BBD11B4C89933ADB272992DC1D0D33258C6A58B913873BDE2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpF42F.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpF42F.tmp
Size 5KB
SHA256 a86ac1b119a6653e0c3fc24c2c40e44a7bfdc435fd81c4442af9d5526ef64e85
MD5 5bc2d1f7a5fd950dd51547ead6afdabd
SHA1 90f4e48ac87f4eb9dd10f1a80d46a7063f06a7d2
SHA512 45f18bf24c7f1102c17dd30aa205498f27336259ac3869c1d6129609a40385e68d9a2f353e3b13f18f40e7d1d32c4fb31d10f7b2fa204e24e4411183bb749f55
SSDEEP 96:7sX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yQRlOelNMQtU:gULc8pq8RuwdmL4pUQrNyYlOefM/
TLSH
T13DC12AA388D46C05AD17BC04B4C49A23FEB2B2855EC1D1D36258C1A58B913973ADE6ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 c4c19859796de47fb4bf73f5d65dcb910c4cca053790408d91168fcbc6f505d7
MD5 3a5dc29c4b30d76c33390e7d15417bc0
SHA1 c94ba7dc3e1e820f577044656fce999777e92952
SHA512 0dcef94b136177c6fc080af9a1db14132a2ea38e0504a808d1ea1141792b3cda827f9da1dd54b191bd03b109fa543303700fe1ab2f71047db6057e7d690ccd2f
SSDEEP 12288:z47g4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:cgiGpxAoYmK9jSjwp
TLSH
T11E652323639B1C94E97925B0F499A0558218FE756B5045F3610BBFDFE432EE1ACB0C4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 6d24aa9798636aafe4e70d6e60aa15fd2511608ebb7abcf440efac65fb26ed40
MD5 d397a97c5f32dd90ca980a1026f10dfe
SHA1 e2cd122488f2f300df0855ba4c4e586c75365132
SHA512 7f3e02b6cb22e5c6ea19e2bbda0c864034d96e5b13c9169b9940cfe2b92c7ae18aaca9a33dbab541a0e991061f0f471083e58b85c7219fc64580f060fac8f38d
SSDEEP 24576:Tgb6bmBIi49WNNFpg1rSvFv7bY+iGpxAoYmK9jSjwp:Tgb4mBIBhGFTiGpP5K9mM
TLSH
T14D65AE1E22EC02F5E0F9E2B4DDAA4417D6B278160731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 1d1568fc79e39d800eb3fd048147dfb2b5bc624c2dab4c6a401ec2f28dded8f2
MD5 fb69f561907ab3c9e7ab1666741fd8f4
SHA1 032b473f7756261ac09136861cb0e283a3851e6f
SHA512 a73f03d0e4a43006cd2e0cd5c9c3cfb421af6491d676f8240c615be79f90f9c9754f2eef25ebc59d479fafe9c2a4d22d506d2bd230c715edbfd1f89012bb5430
SSDEEP 24576:QG88u8FpJqH1Dzria7/mjiGpxAoYmK9jSjwp:D7ZFPqVWa7/WiGpP5K9mM
TLSH
T1D995F12276E105F0D47BD13489864663F6B1B8251360EBEF07AC8B561F33AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 3ca620286c8a717d0aa1c45016614aac5bef222016cf359325c60340bd697ba2
MD5 d54812e3ac88dff8805575e35583fdb8
SHA1 d0e6ac748de46ada41d13ef6dc7f63e50c60d2c7
SHA512 ae4a070b0192a91e9360624e91d2ccf34e141d645a2e1198099b930ebcf8b12b0aaf44f680a0115529413ca6e71ebc19d5763adaab73afb8e60fe9d0bbe56081
SSDEEP 12288:PHvUrBFrEjwaQn4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:PPUr+NQniGpxAoYmK9jSjwp
TLSH
T1E275E22F22ED1CE4E676A178D9828609E771BC621711D2DF02D1817F5E73EE8BC39A14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 065d220aaa6c7fca033cbb298aa663c31d07c290f9286bdfc6d62c983aa01d8c
MD5 dff62f91a51e050b2183dc9136efdabd
SHA1 24e242dc62ea82227cdf9a3bac0e24831c90429a
SHA512 cc2554a3dbce2b7f54a8ebe9edc479824bd150ca54a91c254feae4dc8392ab8635a0b424d25df6c439ab1fe27f81e251c1ba43720b9c21ddc855ce9c1aa79201
SSDEEP 49152:wBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj3iGpP5K9mM:rG05lO43ba2n
TLSH
T1FFD5C06A62EC11F8D1BBD17CD9C6460BEBB23825033556CF02A486A91F27FF4A57E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8ccf3719f1e1575b7b50b90adb1229a9f0f99c95fd5fd243f433615ff1c83f83
MD5 fadcce6cab167bdd6aa4336194b09f0c
SHA1 f8b1a05721fb356cd69646452d64748d3de90690
SHA512 b55c93e8dc6922810ef6e4de7edfd0d80057c5e3fb8642d640b4abc88597634d13bdabf92abf100c32955b3927e94fb5d6b48bae235dbe95674efee2d637bd69
SSDEEP 24576:1fa5POZ3dpqWVM50JicR2hG0lasx2+47eidn9iGpxAoYmK9jSjwp:Va5POZ39Jt2pasx2+mfiGpP5K9mM
TLSH
T17D65BF5EA3FD01D5D5B9D17CC583861AE5B1382653319BCB022182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 74cc3e149a78f4b87972616e20da252dc565312fd96f8b95654d8bceea021160
MD5 59336c0dc794e8f51e1a8a876ebe1991
SHA1 c2d1e737aaf8e14b8d37a1245f093eb1eff6f93a
SHA512 cf80c443468af615237fb7ce11bde0a8e512fa94df4084d07c96a94638e41399bdb06c5a34b9b46735a8a92f3605cddd2c43deb426605a51d77bd88691ff0a12
SSDEEP 24576:5NcwHdjbyQ4nLC18lb/EOjowL7FkriGpxAoYmK9jSjwp:5Nc/zEOVHF2iGpP5K9mM
TLSH
T10A857B2623E901E4E5BBE1BE89779546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 472B
SHA256 9d7407b8bcd4af6820eae7da00db7598246d0f58dc502ef3c89aacbd9cc8a104
MD5 150650f8b4ce06bf6720a55c29275c38
SHA1 c69a908cd7138d119f38c8db07031364b1d21388
SHA512 fcfb7f30078c6e1c43cf272b96b5fbd599fb6ea694cbb79a7a3e40de0eea9e031a4b67d1c2f348d3ab19760b48b67758fd7b4ddd921aab9f3e8d3a064c662bd4
TLSH
T198F0651725F54655E0F75F11DBF990B35B367C456D18846CA0C8031F0CD1A51D872BB3
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 596B
SHA256 550a13ba1f49e521874c12f8908b48d130519016d3abd734b9ba3e3695f2a8bd
MD5 dc1ecc554b3f04dc9600236cdecc8a5b
SHA1 5ae617e99bdded544273928e3e02147405e6a032
SHA512 5c18ad0696a910c5806e952965b6ea6a7943443714eab387cfe0437c5546b6b43c87d70495e5a21ecd284faaf545ab0b6c7fbfc5f89b27ab4779e3cef124f11b
TLSH
T168F03A5726F54668E0F35F15EEF994B31B367C026E19D4AC90C8031E0CE1A61E9727B3
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 726B
SHA256 c89ff4970db3664d4435522769ed127af57f09ba648689de94c00a60572db3c9
MD5 66912ae2193d013c3bf5b8b031c7a36c
SHA1 e5288840baebf03420e92c9deb1a60121f24467d
SHA512 c519bdc0aaf38be5206f763c6ec85e3b1d245ef900c36f2fdfc8865783430e62e09c53fb344e4559e939e4ac40a2fe4e81b79e396264be2dedf9a237cdfb1462
TLSH
T12B01D6962AE91235F0F35F45DFF994731A327C131E18C89C50C8410E49E1EA1E871B7B
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 910B
SHA256 29aad3c953b84d978bd9c489ec6365d819b090264d3f63d55b4dce568fffdade
MD5 a450581a2a8b8beb8dd3de0a9d645c63
SHA1 1bba5a58b4ba51023c189f482055bd4408b20709
SHA512 603c344f420bfcd2931ec5dce59a6bea8e078d8056ebb86f61a6a79c0e4f3b3410000d67e20fa5dcd840d2b9cfc304028d69682b1e118d1c9d7ad9ce27d65a4d
TLSH
T14211C4862AE91275F0B35F45EFB994721E363C532E18C89C40C8510E0DE1EA1E972B7B
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Windows\Temp\ArmUI.ini
Size 234KB
SHA256 790b06745f32e0f56a7af24c871ffce225ba05ebf0d8f8a71a00c727c97dcf09
MD5 cd12a965da4fb66e7f8a07e3f421196c
SHA1 f6377f231362acbd1063aff829ced283a2660b89
SHA512 3fa242c3f573c706e0f36b477ce03f47d9ba0712ef72b94eae4f426dfe21ebbaf1dbebb0981335970b5186d416b4d25e175773796486f39e17de1df0a68a9b0d
SSDEEP 3072:03IJ8zcVOWmxltum8PMkufNWwhEIrKNCpNugYWKOlCIr0YxbFKRWSp4Vf37FbAjO:BxJvW
TLSH
T124342A5667FD1209F6F37F41EEB852944B7B7DA2BE3AC14D1680014E08B5A90DA72B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0b5a10d061d0ce1d8989f1ed6d1b2827784e9db3afcaf19ddf4ce23a3cc0bd30
MD5 e0c73870af7f9833ee0c274279bbd85f
SHA1 4bd4f3950500018ddf38dcbfc755c6fa47ee8dd6
SHA512 3b0f4c1fa9e292c9efd64eb34f9c255feb9cadf23f168bc44126c4e3716a3d2a9243f4a1cba694c6d97fe645179ad375b8253fd7b118a2d5b4bb87df4892cdd0
SSDEEP 24576:ktkNvNnaFeYhJNtmZBm5iGpxAoYmK9jSjwp:ktMwBtOm5iGpP5K9mM
TLSH
T11655AE2EB6B806E4D1FEC6B4DD238512E6727861173293CB5290C13F4E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 0a7a0ed31a88f140911b08131305b1947d61cd109304eb73987ec7ead3f9213e
MD5 79bea0e495ef5b5133b49f0586d86006
SHA1 7cee6b1e7355f2c419641179e94890cb99ea4f1e
SHA512 ebcddfa4e3be3719f38b237a30f0686bd606230b9b2c7703d7029acadfeab27ee41ee1385f47f02f75e73162ed5ac47b4b24f738bcc0fbfee42382b2f1baa9fc
SSDEEP 12288:qQcMxWDXN1Dp/fshBItT1IQgAs4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwM:4D3FHshBIYQgAsiGpxAoYmK9jSjwp
TLSH
T1C985E13EE69D04E4E57AD1B8DAA38906E3713CA9032156DB02D5C1BA5F27EE47D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/124-110-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/124-196-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/124-118-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/124-111-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/124-117-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/832-148-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/832-156-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/832-150-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/832-349-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/880-210-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/880-211-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/880-217-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/880-219-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/880-221-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2220-399-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2220-184-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2220-191-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2220-190-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2220-395-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2220-397-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2380-695-0x0000000000400000-0x0000000000568000-memory.dmp

Download

memory/2380-548-0x0000000000400000-0x0000000000568000-memory.dmp

Download

memory/2380-595-0x0000000000400000-0x0000000000568000-memory.dmp

Download

memory/2712-0-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/2712-160-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/2712-645-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/2712-1-0x0000000002640000-0x00000000026A6000-memory.dmp

Download

memory/2712-8-0x0000000002640000-0x00000000026A6000-memory.dmp

Download

memory/3764-226-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3764-400-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3764-227-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3764-233-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4716-173-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4716-179-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4716-594-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4716-593-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4716-381-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4716-172-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4856-199-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4856-197-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/4856-205-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4856-396-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/5052-365-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/5052-167-0x0000000000880000-0x00000000008E6000-memory.dmp

Download

memory/5052-162-0x0000000000880000-0x00000000008E6000-memory.dmp

Download

memory/5052-161-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/5216-302-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/5216-137-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/5216-144-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5216-138-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5976-133-0x00000000023A0000-0x0000000002400000-memory.dmp

Download

memory/5976-123-0x00000000023A0000-0x0000000002400000-memory.dmp

Download

memory/5976-122-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/5976-129-0x00000000023A0000-0x0000000002400000-memory.dmp

Download

memory/5976-136-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/6020-103-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6020-97-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/6020-106-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/6020-171-0x0000000140000000-0x00000001402E9000-memory.dmp

Download