fefb2b13b6c98cc469481ed8e0c309258134042f3bf389ec788482cfb79413f6

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Size 2.0MB
Sample260925-xtdhdavx5k
SHA256 fefb2b13b6c98cc469481ed8e0c309258134042f3bf389ec788482cfb79413f6
MD5 d57f929f0ba74a5cc8a884e22034dcb4
SHA1 76f5740bcd32bce2d4edca7ec133c5079134434d
SHA512 5b78eee4a6c78a6ff619e9d21dc54ab56b820240b034a05dc7fd083628cb0a9184843ef06c7bd72abf2c699b62892d884a2ecc11674d2d9d12ec0878fbacccdd
SSDEEP 49152:hFx9+qVD2SouuFOnYIsE5JIMzHRX4+Dmg27RnWGj:Xx9LuFOnYHEXRD527BWG
TLSH
T16DA56C117BE95A29F1F72B31AE7852644A7B7C619F31C7CF13801A5E2934AC09936B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery ransomware spyware stealer trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
122	5932	Process not Found

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe

Executes dropped EXE 24 IoCs

pid	Process
3532	alg.exe
5076	DiagnosticsHub.StandardCollector.Service.exe
5504	fxssvc.exe
4768	elevation_service.exe
1740	elevation_service.exe
5416	maintenanceservice.exe
1760	msdtc.exe
3928	OSE.EXE
2572	PerceptionSimulationService.exe
1776	perfhost.exe
1100	locator.exe
5152	SensorDataService.exe
4332	snmptrap.exe
3268	spectrum.exe
4772	ssh-agent.exe
3196	TieringEngineService.exe
4164	AgentService.exe
536	vds.exe
4852	vssvc.exe
4088	wbengine.exe
4820	WmiApSrv.exe
2640	SearchIndexer.exe
1892	Reader_sl.exe
5928	RdrServicesUpdater2_x86.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
\??\F:\	DiagnosticsHub.StandardCollector.Service.exe
\??\F:\	elevation_service.exe

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d259816d4bb6346b.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114625\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RdrServicesUpdater2_x86.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RdrServicesUpdater2_x86.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrServicesUpdater2_x86.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f35b5b44214ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000002134a42214ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000054239b42214ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c9302a43214ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000077af0c44214ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e50f2e44214ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000683a3242214ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4592	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4592	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4592	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4592	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4592	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4592	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4592	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4592	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4592	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4592	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4592	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4592	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4592	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4592	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4592	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4592	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4592	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4592	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4592	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4592	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4592	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4592	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4592	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4592	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4592	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4592	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4592	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4592	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4592	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4592	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4592	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4592	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4592	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4592	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4592	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
5928	RdrServicesUpdater2_x86.exe
5928	RdrServicesUpdater2_x86.exe
5928	RdrServicesUpdater2_x86.exe
5928	RdrServicesUpdater2_x86.exe
5928	RdrServicesUpdater2_x86.exe
5928	RdrServicesUpdater2_x86.exe
5928	RdrServicesUpdater2_x86.exe
5928	RdrServicesUpdater2_x86.exe
5928	RdrServicesUpdater2_x86.exe
5928	RdrServicesUpdater2_x86.exe
5928	RdrServicesUpdater2_x86.exe
5928	RdrServicesUpdater2_x86.exe
5928	RdrServicesUpdater2_x86.exe
5928	RdrServicesUpdater2_x86.exe
5928	RdrServicesUpdater2_x86.exe
5928	RdrServicesUpdater2_x86.exe
5076	DiagnosticsHub.StandardCollector.Service.exe
5076	DiagnosticsHub.StandardCollector.Service.exe
5076	DiagnosticsHub.StandardCollector.Service.exe
5076	DiagnosticsHub.StandardCollector.Service.exe
5076	DiagnosticsHub.StandardCollector.Service.exe
5076	DiagnosticsHub.StandardCollector.Service.exe
5076	DiagnosticsHub.StandardCollector.Service.exe
4768	elevation_service.exe
4768	elevation_service.exe
4768	elevation_service.exe
4768	elevation_service.exe
4768	elevation_service.exe
4768	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4592	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeAuditPrivilege	5504	fxssvc.exe
Token: SeRestorePrivilege	3196	TieringEngineService.exe
Token: SeManageVolumePrivilege	3196	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4164	AgentService.exe
Token: SeBackupPrivilege	4852	vssvc.exe
Token: SeRestorePrivilege	4852	vssvc.exe
Token: SeAuditPrivilege	4852	vssvc.exe
Token: SeBackupPrivilege	4088	wbengine.exe
Token: SeRestorePrivilege	4088	wbengine.exe
Token: SeSecurityPrivilege	4088	wbengine.exe
Token: 33	2640	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2640	SearchIndexer.exe
Token: SeDebugPrivilege	4592	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	4592	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	4592	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	4592	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	4592	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	5076	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	4768	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4592	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4592	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 3368	2640	SearchIndexer.exe	114
PID 2640 wrote to memory of 5836	2640	SearchIndexer.exe	115
PID 4592 wrote to memory of 1892	4592	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe	127
PID 4592 wrote to memory of 5928	4592	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe	131

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1892
- C:\Program Files (x86)\Common Files\Adobe\ARM\Execute\8510\RdrServicesUpdater2_x86.exe
  "C:\Program Files (x86)\Common Files\Adobe\ARM\Execute\8510\RdrServicesUpdater2_x86.exe" R32
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5928

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3532

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5076

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3300

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5504

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4768

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1740

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5416

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1760

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3928

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2572

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1776

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1100

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5152

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4332

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3268

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2388

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3196

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4164

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:536

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4852

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4088

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4820

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3368
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:5836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
Size 611KB
SHA256 c5c7313f9890a51521612c4897ca9a8b6a1cb1f9c8d3bc7f0365beeccb5ff706
MD5 849307ff652f480941c1bd586be1c8ce
SHA1 185f444ee87c426cc796a2e860af475cb65c37da
SHA512 83a3d648ff2a198275398611c074b1f7fdf4d913c00886404e9e3f2119b3359153d93f093d860ed0a9fa1f5ebafccf748f5ccaa58e79bdc4ccf8555827c6fa4d
SSDEEP 12288:aFWAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IWAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B5D4226B6B498393D82144B102E9E7BDA46BFD31DF1019D3AB5329BF9DB84C04A3512F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
Size 1.7MB
SHA256 c73019d4d2b5cbb27cccb6d0505d82ff4ec9898cfac9730991c676a3fc0dd45f
MD5 1efc847cc3e14d8a67b048fd6794c917
SHA1 ab23692395e5fb28e3852d97a82347626511ee2b
SHA512 e16247e2ac27655c9b82c03057c3ed36d7abfec85cbfee507c523ac698c69ba3912a640580f73ec5fda2800c4fd583528da540da062320b4334e9e8df1a18a3b
SSDEEP 49152:6SgouvAeFfenxyQ5XS7uQ0NIiDmg27RnWGj:6S1uxax1S7uxD527BWG
TLSH
T17E855A1267F94129F1F37B71EEB993645A77BCB1AE39C50E5280125E09B0A90DE31B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
Size 973KB
SHA256 c7e0c196e969014a1be89760993f1ee4bb0fea6617ad45a684095541757ab678
MD5 3a8af91fa1cf9a4725e6429dd131d175
SHA1 4547126c81ff4d1ad53522362cf1df5ae8de171d
SHA512 3fc34f6c5c8cad1952e26045b106d56183717e2c17dcf6f702ae6fd9ebb2f0dc2d413b043fedb332e45a3a83c67f9eb37d27592f1b2523d1a38f6b7aee1466c1
SSDEEP 24576:GGTAbD+OmeMsqjnhMgeiCl7G0nehbGZpbD:vTAGOme4Dmg27RnWGj
TLSH
T1D525E11037D0C136F1B329768ABFD728542DBD715F6841CFA3881A6E5EB06E0AA3571B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a076e5e728424025a5b5aa9fe6e8fdd6d6346be25e1933c8bb863eaefb483667
MD5 16a604e2a87a19b2cf8ebd721aee4213
SHA1 c87881e6bca0b2d34211bc3b46b83d4db9218405
SHA512 de845433c26c52f4c2381feb62ecb6ad89913c299ca90dfa83468bdd67a7e35bdc8cd7b0172290948cd48b64549cb1988d897696cb800ee4af8f9f80ce11ca55
SSDEEP 49152:Vb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnMDmg27RnWGj:r3q60jBnD527BWG
TLSH
T194D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 511dfc1e9a779b8dede70ffb40cc44841100f05205d5e6eea13a9a5d76894221
MD5 6ae59b7b5335f1578346526c7844a499
SHA1 9480b0f3f51e7edb4fb1667cca1d8193ad5e0077
SHA512 a57b47b4b56a67bd5bc1ddf5a65e93fe97776058fbd451cf9a7c9aa82232de66730a727dacc4b88032cb898aaa6c8be5f2f6ccf46bb1959a2224956008e73beb
SSDEEP 24576:mXYfDtczAvsqjnhMgeiCl7G0nehbGZpbD:Ftc2Dmg27RnWGj
TLSH
T187050129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 0458aadf08522dc458ab32a2e4a4328014c209953a0047627688cc234c13f62a
MD5 032c13b4ef68cef84d0543935f76cd88
SHA1 b00931654c6ac81b20acaa43a6371fb203e68df5
SHA512 61a359b18541140d656046beb0579a4e48e7645fe1241bb703f5360a55f0eed41803fa7c727e2ba3535e5b51c8e24b4eb578bca8ba24fe15e358a3891a8ed1da
SSDEEP 24576:Z0Le5ji0hmxNrM4sqjnhMgeiCl7G0nehbGZpbD:ZPji0A75Dmg27RnWGj
TLSH
T127359E26F6748335D073C0B9C5D2A68EED723086573089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b5d1146254bea014472314f8e85a354e2fb2dceb9fd32380d0488c8b6fe00e04
MD5 035c5897b62338bfc8dd0a2fcf73cea6
SHA1 e380ee6d223a8f086e7a1bf12804d47b9c4217c5
SHA512 bd8445031826a7adce0b5fac17306ed658ce381cf17ecb5289969e6e0148e6a0d2ace459b744a755596e5448d35460e0c8115ce6799b6c63e198d6ca56cb89df
SSDEEP 24576:ja7/ezSC6vUyD/aqgrvWr6q8wyuisqjnhMgeiCl7G0nehbGZpbD:O/ezSC6vUzPviHjylDmg27RnWGj
TLSH
T1AA755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 937435ba34597d180af8a36e1a0cc1ef13baf7cbebee4e8151c4d7bfa53c2c7c
MD5 a77d0bb01ea075568d641f1a2a3dec16
SHA1 40afb3e0f0617655c1ec9e9ab31dbd3c037b9c1f
SHA512 298f397344e5a79faed91296f9c25aa21de212c968dd135200022f4056391f6bc4247e032611896f9dfdb49fa245ce7293a95153779a8626a58700079a037030
SSDEEP 24576:9VbqPb88hv/l+bTsqjnhMgeiCl7G0nehbGZpbD:9VO88hXl+7Dmg27RnWGj
TLSH
T129559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 5ade251272177d3da9d7bf943fa129fb1ed86820fe4d54a2e950841f3dd436c1
MD5 5eb38acb0f704ddbb512f2324d83529e
SHA1 fcf16e47a08358af8db2a65b8066df74094679f8
SHA512 b33919e585e2a5e4e830cd6f70ae65ba94cd2ddb77c8b98a3c0c40d9d6239f2b2a39835ac6b4753023d3c0d1f3673c992d63356afcdea908ae2225605e139b29
SSDEEP 12288:UjcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UjcsqjnhMgeiCl7G0nehbGZpbD
TLSH
T187C423BE834C10CAEA7B48B5C3E9F15EAC177D5698200C526A637DFEE5B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 4cccc9053c79c9c628b5c4137250311e37c2af381d901a13e16c378f2e9600b6
MD5 fe250d47a490d1b7caea3cc70c5cec49
SHA1 0a30341e51b750b88042229d444ddbfb7f454ae1
SHA512 22b4e18a7e2a1d17b19a2da1d3bee9f941ba96bdcd8d844076458918a187abbf57f58fdecd24b774e80e6d27d8e39fbe3c9b74f6a0d9f451944c0cb993919f21
SSDEEP 12288:HeBNUbTVO86U7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:HJIU7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F805CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 bc5f5116cef5ed4a7f5e5bf0b27e3f17dca4169dc493236cb86222a86a997632
MD5 dc3265ef3773bcaec8b6e3ca5e19d7c3
SHA1 adffce91ba1637253a7ef843a710fff61aa8fef0
SHA512 60c9d5b7017f52f30ec31223a1ae85e99a858f364451ae5f39098ea48c226edecd4e01ae6bb0bf044c5caecfb99ad06584721e178d200cd6e515576a409fb698
SSDEEP 49152:IQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THW:IQvGAdlCEL8c/RRNw5CWD527BWG
TLSH
T141266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 40ea74090f821606c5353d29a1ea438f80ef901e8e3af4a2603bf2143590d88a
MD5 a547a5878dcf5dc9216e07aa22f8882e
SHA1 174b0c0705d5b8e0a25dac37b0b738c90727b496
SHA512 6ba98318235f68f518a145c415d30c0d359e57def0a7bbc2767deb8f833f619dfddcdd1ab80128d3fc1518daae40983dc87eb31bc1922d51af5e6bb7d81fc7f6
SSDEEP 12288:6AwSfxL/2Dc3DDLLmt0LDQewsAj1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:PSewsAj1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D815E031FA74E036C77B0DB20B76D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e3671ab4267c185fdb52619a56c3e4faa229c0b0f2604fda8c78886cd0b6298e
MD5 330a5a22ee1979d9c6882e340bfd7431
SHA1 1007fd5ed7dc70cbc4f56ae3e21ff7437b722917
SHA512 a235a3e24f6af9143189ff85f763841416ddfb83e0f33c3b040b0698108b4d8a2ee23e9640e1eea957b057452462fc5802c7cd5d953a11dd5e181fe5a02a1ecb
SSDEEP 196608:4UEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHxVQBWG:4UEtQevvqc2W1cpV2RI328B
TLSH
T1BD474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 3b98654432e958c3e560d8bf114334d2ae47b2d0348e5bbb64e8ba1713a8e205
MD5 266a55b1fd1d929fcccfaa29717a61b3
SHA1 08711c3186e47fdc51e2c500ceaeffd770b1cb19
SHA512 73b6bb2ce186f8de6d0756009d717606a09e5b8e75a9ca0fb03960a6f673ecefc5b682668aec8612d6a670e9c6e0388af64e3d79dcdae4a98c2b37fb3324905a
SSDEEP 49152:cCbRquA/m2yL5zQfFiV+XenmE3/zJDmg27RnWGj:VoqtVjnmCD527BWG
TLSH
T145D58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0de566fc67d8312c59e33966f86b61442b05b9d282fd655363f9c71625bc2bf7
MD5 088faecb8af1ea803f4abfd256a0e751
SHA1 3df9305701fa303bc008f0657861ee1b181c0fbb
SHA512 6a6b08754910e0ed07ff622c10324958e9ed3c8f941e56142b069ffb002a52e9b5b744cbc30bf546d383b53c6910368524f7b0219df04371a74235fd24628075
SSDEEP 24576:SAhGL2IFoiwtA5l7S53OsqjnhMgeiCl7G0nehbGZpbD:SAM1Foiq5yDmg27RnWGj
TLSH
T1E7359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 0dea1ee2c518a71f009f1669b54ee46c5e18f67a0a9fc9920d0b456be00aa286
MD5 da20b3c1f2b523e4d854efd4d5cb84ac
SHA1 9199da0d186e2165ab88b31fd042ef1192809a8b
SHA512 71d89fa14786af2845bda69427db44559d300e574212fd7f763920bff59ff374c91ae06f89eac2c0ab3c2a5ad016786ea56faa6bc3aec00fda42d8c671172a54
SSDEEP 12288:Wmw5HEjsChNSBFgl0WDm+CCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:PwuXOWxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DD05F15A72A80CF9E9674539C697D136F7B3BC122A20DB1F1760C65B6F33250AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 5b17f7715a4160363f2d4be9e952f20748fd555b0afebbc142a9fd714c4fa33b
MD5 c4b1c8d29bbbd296e9822651960968b3
SHA1 9a869b7583b592086c88bb45c82287574a8aa64d
SHA512 014113c869e67b69aab0ef2460fea582cb26a0699afd5477034100c49546d4271bf41aa7d25cf691d5f785c5fdbf03a9bf1bd398f76f40a1310abd39be9959f9
SSDEEP 12288:w/Z1IylXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0ZuAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CEE412AE239820FAE167417CC6E5D609E7333C62673043CF166656AA6F739C44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ad85d90ef2db46096d21eb59d614fe0030f6e80933ea85fc1e3c686096c410f6
MD5 6d53baa3a4a2aa1ca8cfbfa652d48c6c
SHA1 5af4bd50d682aa96a157fafc56d3732babf55cba
SHA512 2c8d822f8d93ca2ed1e7a813d49c8684bb81bd55e5aef107e03acaf395186734b2948659516f516fdba8cd0e048351e490ff02e26e7349cf2fb97fc86e2114a1
SSDEEP 98304:pQRQyi36YOcPhLvw2gAf+PN3rD527BWG:AQyiKahX+PN7VQBWG
TLSH
T10F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2c410d1ca82595bb707594caec09f2e2fdec3019e90c9956328571b5acf1f9c9
MD5 979422a4ffd2e55235aeb2b8747ac41d
SHA1 593a69a0e629adf7621fa40c5508910d3008d41b
SHA512 400a13303c85d9b02a0f1c8bb22ba5cede9c61478a50515b97f1af197ae00b0b75e396c08e2ecd582e0e35de8ad738206a9b9ae8d7c1701157282ea6c2807d7e
SSDEEP 98304:AQRQyi36YOcPhLvw2gAf+PN3rD527BWG:XQyiKahX+PN7VQBWG
TLSH
T102667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d39ecce45dcc15172aca77cc5a560274e1d690e68c5e168ac6f6957088f6d634
MD5 dec6b28440fd738854c75a3c1ff0c748
SHA1 b4be8d65e49f24ba06f5f50ebb0366c56e41ad31
SHA512 717cdb381c573478fb065a81027b11b0b48d07d5e1e8c31a181b698b8655e9d6707ac1ce2173e246524b7dfbc59da84e0d828c54620cef9127462a65c248d0fb
SSDEEP 24576:bwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0QsqjnhMgeiCl7Ge:T68Qg55nhceWu7PNU3/5Dmg27RnWGj
TLSH
T11FB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 462e028563a8017b532b34ddf90a348cfad85542fd31624725a403274ecf5258
MD5 35041cde52c4881c7004677b658ce508
SHA1 624a86e64ca27c574fd1dbf1cb886cb7fffb148c
SHA512 0b323b60ae9156a13ba2552827b40f24f08a7e76ad094397aec2ca32091614ef9ac0205608d408147f2d24ff5199fef530b1486aa58294814f0e0edd9a9cd266
SSDEEP 98304:fy5112gYy5azzVva69nLKnhZID527BWG:SLIHjWhqVQBWG
TLSH
T109167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b1bb6d60876190337ae3c1e227ad7aa2a0b2daf1f623b97031126bdb2bfef1f1
MD5 ebae27abe65cd1d47762d48574a2d4dc
SHA1 9aed34ed8b3a368b336feb6586a2c125155b644c
SHA512 e184eabe91409c87ac91a3c79a497a8ced1a37c1053efe7d5ca5a6c3c6754abf37149415856d9bf73901f5066978892de62ccdda1a5d8b17a44cc2ba4f522470
SSDEEP 49152:0B+taZ3usBWOBr4tEG20bqx0z+n217aau1gljDmg27RnWGj:uu6JmUxd2djD527BWG
TLSH
T11BD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 dd2dfc141b4e28c1a15e07e7e53acef0a7476cdef2c943bbb148ce18effd0d6d
MD5 3e09a981b710f17715e0b3e92c307618
SHA1 b7d56b9cdf8a1d17e5fd67f1ecf33ac364ca23cb
SHA512 df58ed3ae59e218ab033fd9d504fd8a4fe94b13296f88f012cd616d968d77b61e14026af81d0ddcaf1f42cce819ede6ec08e5ba6efc1ed38c3a835c98193a82b
SSDEEP 49152:D1hpsNoJpF1A6BU44CwH7R4xPDmg27RnWGj:DmifPkRCD527BWG
TLSH
T1E9B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 698907ece6140d142b2f1c01baeee81eee529e5ac9eb90e72ac1163a229decf5
MD5 a68875daebb956191a1dbb09f8376587
SHA1 b3fa6d7567dad196f5284e72870dbcc04e43fd5c
SHA512 4810bfd61130e535572d8fa621b8b809132375ce70e63c89e7bfa0baa8934d3519497ba56baf1ae0ddb85c46462e7881b968aae8a9b852888b55b68cc11bafbc
SSDEEP 49152:TSuZQIY0Be2KNRVtOnks6NMHq8Dmg27RnWGj:R5dKvi618D527BWG
TLSH
T1E6C5BE13F2E900E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3ea2f0c70ac79706306749b95aeb7005777db897d4f95eedf5240fba23404754
MD5 e235c089c4ed46f530935b3ad35ac688
SHA1 f1f5e9402f9bf60fe7abe9437966a2af8cbad188
SHA512 29209e903ac4550bd90df7056711c5d14f5e49b82c6503e013df46c5d658ebe29769b4769a25dfc66bfbf60bb9f7b60e361047cfc772b9d9f97200c89604af80
SSDEEP 49152:OhtSn8EApI0figXgiDn0AP5wTDmg27RnWGj:PX2iyph+D527BWG
TLSH
T1C795BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 073af4f6fdbda501f87c74b875c8b4ef1c0c895d7aa1974c316d37aa019ff237
MD5 46a4ff3a41055bde6fec4f65b153ca35
SHA1 d61873e64dce4358f4040d34dd9b09a83c889ccf
SHA512 443065a766039921a0c71ba07d1b9304d670e7a19b4aef5a9ab0a99510a040746a8833cad16cf1e1d7f78c7adac7db7380bad7ea2701963512e7aba686604b9e
SSDEEP 12288:MkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A2C423BE964C01CBE52649B5C3E5F14DAC073E57E92004937A9B78BEF7B24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 0573212a631cd916505db2dc240c85239c0bdd78ddbae27b043cec71166db4a4
MD5 4c096f7df30df4d1b251d974acef2007
SHA1 43ca371de17acf8a9d13525530b06dc61e7177fb
SHA512 c4edde131afe2c7c70139dc8c6af4acef0452a29f35ddc38b2c8bea2475dbf1c659d3987e2dad0e1130b0d5a557b050f7f314641f375f0cce66860f122f4cf00
SSDEEP 12288:EJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:EJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11EC423BE964C01CBE52648B5C3E5F14DAC073E57E92004937A9B78BEF7B18584B39427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 dd2a26828c40f71a42503fd5db17d0343db435b5b9c1df9d50dad244c1fd27d3
MD5 3cc6cd6860f4552f2e8a62ee5ef45596
SHA1 0cef4895a48c0dd2d3df2b933737382bc7d0ebb6
SHA512 db2dcbfaaa0ac1ba0e5edc2e25641686fd3f996f15713d24ac7d6eac266e0d15fe0e4cb6e4745dd270c6dcd23326f8a26a24c34166e4c5f4188ac73702978ca9
SSDEEP 12288:YjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BBC423BE964C01CBE52648B5C3E5F14DEC073E57E9200493BA9B78BEF7B18584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 b65c6c74ba0c9fe94912f2ba8e1a899390e272de1c007c1d13b9a46bc492075f
MD5 0f82ee9fdd6cc57322dba3af383a75fd
SHA1 f806da768c2042497f60b3138fd7ed5abfd30879
SHA512 d8bf3eddae97b87427c7d5824951ed7ad6bf6b0ac36b8c3eae686d89b85b3d12b1cdda46c83fe3ef9a82dd7456bafe8fe90e93707198666091f40af27ddb0124
SSDEEP 12288:aVuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:psqjnhMgeiCl7G0nehbGZpbD
TLSH
T185D4236E535C00CAD83685B4C2F5E11DE8277D56EB3005DBAB532CBE6FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 2aadfcfd4f32285297c4c59bf78b93fd531dd5b7ba3a0f536717894060ce9fea
MD5 f26691923df6d4bcbb3b76a150e22a1f
SHA1 328ad5fdf7da56e62b4759657ad46c865966692f
SHA512 a09528499584e03c767cc2e9201dcdfa0601d5cbf2365df2cd9d392da5d9c1daff4917ffe177421622fb195e151c6af8e24ac2185ce2376e8f0fe97bb1af3297
SSDEEP 12288:OGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11AC423BE924C01CBE52648B5C3E5F15DEC073E5BE9200493BA9B78BDF7B18584B38462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 b84135cbba736e28a804116077f0af9098fb741ed6b276e944035b9d27b5b3c3
MD5 62c726d6095cdacdcb63c221efeaaf79
SHA1 99abc0d5101a5ea9295a9c7c98da18402899332f
SHA512 33622b64d5073f42dd023b4ed2a80d66d6450e1fd59156e9317f893a97b8714c475025d0896071121f94311aa2c6604d23280458dd8dac20b3b65aeb3ace6d81
SSDEEP 12288:Y9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Y9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T182C423BE964C01CBE52649B5C3E5F14DAC073E6BE92004937A9778BEF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 bf1427f9a80eed363de9883a9a65c6b3bcbc36a50d95d656be1f5079f5ce1ce5
MD5 9fe22f696282f67c62c9c192dd4e8cd1
SHA1 222eaf8000304e38f133f22392dd03d1933ea2fd
SHA512 009aa1186d38ea797bcbe1b65335d3801629e14044f6e1c46e98612796616fe947ce82f1c5d65ff25d9071706aeca9ca13d06528b1ec96aac7dbb30b80b98c7b
SSDEEP 12288:ZBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13BC423BE964C01CBE52644B5C3E9F15DAC073E6BE9200493BA5B78BEF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 72def637865292a94a9486ea88098608ba055e2059a1806afb24380270c67a6a
MD5 9ed0a2611c1f0ee67dd1dc3457155104
SHA1 35071fc7b874316769ca98ca8bcae1fb7ffc16d3
SHA512 c322ce3cc888cc82748b1be0c7838e5e60d1a374c0b9840f45356994a38e62fbfa2b68ad3822099c8c9ef3672f5af8ff060e152c89083a0d486adc9fe462583f
SSDEEP 24576:dZMMzFVSOpsqjnhMgeiCl7G0nehbGZpbD:dZMMzfRDmg27RnWGj
TLSH
T1C10502A9B39018F8EC67813EC965D90AD5B27C1A0B70C61F13A5366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 3aeeb4c9f2a489af93fb3792b94e823666b2e88dc4ceb23075e08ffb32d06602
MD5 89914f46e5e2e3063cbd602457a68ff1
SHA1 821e468d5c913561502596d3517777d6dd22378b
SHA512 e8e3620d44e2a91dccf49da3f85e48398ed1c14af4bf9757d9340c07e26afdd66093441080ecea1365ce34a916524fc5104d9cb41fd9d7790ad818cb096cc4b5
SSDEEP 12288:PwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T138C423BE924C01CBE52648B5C3E5F15DAC073E5BE9200493BA5B78BEF7B18584B3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 aed16922a7010f1733dd8a40fa24515ba0429e61153954ec4ddc4e6b8de53cc2
MD5 446a8a4d0fc316983990eca20a39fdf1
SHA1 abb3d12506c77fd1b467c6061cdee7ce7e4abc6a
SHA512 20338dbc66fe451517d7697bbf5f413ca3b88c62d68acde6668357791c74b5d5a29d3fca88324c899e63334c9fbf690d9e54db85222dfb17a2671d2144af82b2
SSDEEP 12288:jMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T176C423BE924C01CBE52645B5C3E5F15DAC073E6BE9200493BA5B78BEF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 92958505ee0e696879710b4b471442d2044c080f4c3c7fe16f9646bbfe9de77c
MD5 2cb53805fa9178cb3dec2e3c4e47e354
SHA1 98ec230f16968a2c509dbbbfca30c96da023caf6
SHA512 1428a9ce89458ee03c9da29d33618d869a24c4a25e047bc421b5c55d80195010e25866f66b774d6431bb83bfa4a69a642a47d500d0b7ce7e35dc924718b20437
SSDEEP 24576:CcP4mcvIjkGOxhKP2l71nNKbrh/8KBIsqjnhMgeiCl7G0nehbGZpbD:tP4m4IpOO67W8KWDmg27RnWGj
TLSH
T16F65BE2DABDC0096D0BB917886658A49FAB1742A1F3286CB1160933D7F77EE44F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 6a1995002619464974b00a1125c3a2ad7f86d631f50cb030efbd6b4d23d88c7f
MD5 9dbfa9399c7b7d56684528c958bd7930
SHA1 4926b336c073270b608f4824773f379e36891bff
SHA512 b591d6f5ed20fd138ac69a68aaf6192d1e1a9f8ba2d5f8f7f6fe1a14713711d7b61695b7581cd9add83ed9029f2fb4676de58f905e05f316ec9303345923f8ae
SSDEEP 12288:2GsfAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:aAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E2E4015AD29802D8C06E6179C396D605F7233C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdrManifest2.msi

Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
Size 18KB
SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
MD5 f5d4c05bc8ea0d4fc4d277abda7369d9
SHA1 f67e793b159bd1e75ed4dec0de352ea1b6583708
SHA512 359a966c4dc8d62a570b428dfb3e666a63efd6bfff7c5b5ace3bc97ea09ba701d9fa524f439bf9902746c2ecac9c1f76c90868b0152eb825b2a09a9474fdbb34
SSDEEP 384:MrUq75oUFtb0F+o5nfy9jdIYigYws0i9Db9Ey8RbmL4A8UiINyGNB:MrUq75oUFtb0F+o5nfy9uYigY9K5ALdH
TLSH
T19D820BA2B4408C11CD868F3EA4C1D726D672BC813D8591C27565F219CFB23869A9F7EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdrServicesUpdater2_x86.exe

Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_x86.exe
Size 846KB
SHA256 6a142c879a0676aef5c825d6fd6336800846167fab422d0f912096d286aa0070
MD5 a447c3cf3b7547e5a1e12dbb92d8c052
SHA1 d2b246eda6302534b21b2003719d9f911d0c77d3
SHA512 ce7446e337cc13a560a12b0b789813bfb5a96a6a9d25a8b3e2fc1ed884f0c4950f01937714614666befb9b92123d359b9597116e9ed9e8efd46b77a640d002ea
SSDEEP 24576:uSU4vrTQA/gK/c8DV5Wa1ZmPEKBLeiGA5nEJ:uP4j5gKU83W3FLeilVEJ
TLSH
T10C059E22EAD18073D563143102A66F368EBEB9310971D98FA3D41A4E5E705E1BB3F397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Rdr8464.txt

Path C:\Users\Admin\AppData\Local\Temp\Rdr8464.txt
Size 13B
SHA256 b633a587c652d02386c4f16f8c6f6aab7352d97f16367c3c40576214372dd628
MD5 c83301425b2ad1d496473a5ff3d9ecca
SHA1 941efb7368e46b27b937d34b07fc4d41da01b002
SHA512 83bafe4c888008afdd1b72c028c7f50dee651ca9e7d8e1b332e0bf3aa1315884155a1458a304f6e5c5627e714bf5a855a8b8d7db3f4eb2bb2789fe2f8f6a1d83
MD5 SHA1 SHA512

Submit Download

ReportOwner8464.txt

Path C:\Users\Admin\AppData\Local\Temp\ReportOwner8464.txt
Size 4B
SHA256 69bf0bc46f51b33377c4f3d92caf876714f6bbbe99e7544487327920873f9820
MD5 455831477b82574f6bf871193f2f761d
SHA1 f44217a81173869e08671753c52553646ff5d95b
SHA512 cbc0ee58e447428bdcf72fc8b03c8cfb086edbb14205b918e75ebeff1d85ff1dd254e9dcb387afbd3fa766c803937c306e0a2a79870c0d87abcb7ab93661cf85
MD5 SHA1 SHA512

Submit Download

Tmp3A.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp3A.tmp
Size 5KB
SHA256 a86ac1b119a6653e0c3fc24c2c40e44a7bfdc435fd81c4442af9d5526ef64e85
MD5 5bc2d1f7a5fd950dd51547ead6afdabd
SHA1 90f4e48ac87f4eb9dd10f1a80d46a7063f06a7d2
SHA512 45f18bf24c7f1102c17dd30aa205498f27336259ac3869c1d6129609a40385e68d9a2f353e3b13f18f40e7d1d32c4fb31d10f7b2fa204e24e4411183bb749f55
SSDEEP 96:7sX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yQRlOelNMQtU:gULc8pq8RuwdmL4pUQrNyYlOefM/
TLSH
T13DC12AA388D46C05AD17BC04B4C49A23FEB2B2855EC1D1D36258C1A58B913973ADE6ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp9EFA.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp9EFA.tmp
Size 5KB
SHA256 b2e41f3d236f5418f702111b610f382663c8893d82d5284462d2133f0e0c0fdf
MD5 38c0245547bc1440fb56c7308c2bb222
SHA1 8ccf6f27b9644fad1c8f13d98e9d680154c8d572
SHA512 78da2e84d0ebb47faec6999320198da63e02f8653a0b0609a16675592ff26b2ecc8de6a3210c31e28b72d6ee340dcdd792207cba96e1ae92b72c07d1d9fec897
SSDEEP 96:HX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yJF46R:3ULc8pq8RuwdmL4pUQrNyH4o
TLSH
T14FC13BA388946C45EC27ED00B4C89A23EDF576591DC0D1C33248C2A58B923973BDE2EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpC89C.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpC89C.tmp
Size 5KB
SHA256 512146b59d21f56f01882290e8b1e93e0553b85435b4d31e4c51d3d9ccd14df5
MD5 8de699a7d8a071e752e129d70525fcc8
SHA1 da6fcbafb68dd579195ff775afcf64f4209ef52a
SHA512 43697eaa55d5b7ca68036110d2bd12e01f6fc45fc7e3d4baf99b1de506170707a4eb801d6460dfcdf491fd58bafa3c93b8aeb5e2b36435e5249a2d7fe6a30be5
SSDEEP 96:PX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yh54pD3D:fULc8pq8RuwdmL4pUQrNyh54pzD
TLSH
T1F8C12CA349907C45ED17ED00B4D8A923FDF2B6952DC1D0C36258C5A58B823973BDE5EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpD30D.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpD30D.tmp
Size 5KB
SHA256 e6bcbcb70401d63ff0746fcbcc63230269058736f7644151393edfdcec8b8765
MD5 1b7ade3253fc67477dea69ef2147603d
SHA1 b71e8e749a3461c9b37ff2c3d099b1911d9cc6a0
SHA512 0edd5eb1635b1599e50b368cb254c94bf1588acf1d063e89f45fcfd6fa625e33d2c7764d9d00afd53dec2dfb342e9cfe199d256edcff8430ae183d357d4382da
SSDEEP 96:7NLX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yGtDwwBq:RULc8pq8RuwdmL4pUQrNyGewBq
TLSH
T16CC12AB388D06C41AD5BBD11B4C89933ADB272992DC1D0D33258C6A58B913873BDE2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 52335e19ba75a8b8237fc42fd1c58b0df3d07fe4a8d7ed07f7e5cea57f4a42de
MD5 643310360571b778ca1c55c8d78dcc14
SHA1 2142ff518b6902e357e6ee8b970322d089b806ce
SHA512 546a5019dd31d5a2ca74f67329f7ab80dc9a4d6616e88f571b0544734b9b925d1fd2b3eec5948cbee47896a67a9a823c0d15f7414e3b88f188b6abbbf310e380
SSDEEP 12288:agXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:agsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A6D4237FD34C018BE57A59B082E9E12D781B3E769E204483B94778FDB6B18948F38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 fec6890c88f2b286585bdeb8e6b881c4d79acdfb6346510c9a817b700623a821
MD5 11470594a2a355bb8056816b42044b18
SHA1 d387e4e9ee69cab73891c04e9ca62c39f7069549
SHA512 e1fe727560a1f97b57a7ca156aee33f616146d83f48b0eda3546b115d6a77f4f6f094984ac891078abed2ed6d4472e65c06582bb75117a333a594e247e75c960
SSDEEP 49152:wa0h2GEkuAe73q3pp46zwwQKDmg27RnWGj:wa0hNYG4JwxD527BWG
TLSH
T13685AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 3873a7f54927b136d6ea190794f3ca21c3080a6424223da9a283bde0ac84b3c3
MD5 14942ed12808b455fff141340acb9053
SHA1 dceb17972d8f7e7e377f3052e70ecd2ed68ad040
SHA512 6cdc3c14673083ebf493d2cf96699b418403f1dda61df5801aae361c81e6a55bcfff3565594791f4487332d0aad4d7797009034c6de3473fa639dc589dba44da
SSDEEP 12288:qhbHjfXZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qhbHjPZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DBE4127E12AC20C9E572A1BD8295D10AD632BC261B2053EF27D281BE5F37DE44D39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 252be007d8fdc94ebaf6aa0e871642dbc2c892584d2c85d5f03ecdbd8a7b47bd
MD5 265ae14c8efb07c4eded67b74c651326
SHA1 0193b7fbfd8f65743ea2016834de09a26ae2911c
SHA512 5b1a08d75e48152cc6438da632cbf74e546314d117aa7f61eac6886a04c7bf0707d990962cd1286c846ef8410be57f1366fdff67ddad6dceb90b4f3266d8a1a4
SSDEEP 24576:K3YgnJcRTk4yti+R5dBR/xsqjnhMgeiCl7G0nehbGZpbD:KIgnaTk46pBR/FDmg27RnWGj
TLSH
T18745BF2EF2B910B9D8AAD136450147B5FB71782D1F209AC70170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 7f2359ad648ce42f6eadbf5dadedff8f5df2130a648ef96ddfde10217f0c4d98
MD5 267e47c3bb9fc5cf09d633f12075fb56
SHA1 d4e91582979ca488a0c990b9c7173c5d36accc77
SHA512 30db05678497183bff0d7fb60dc5bd661b3d46542565475a3e5793020e552245734084d71007bd299536ee044a68312b0465958785516c4f716a4815ae9c2e84
SSDEEP 12288:r8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:r8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T193C423BE924C11CBD93649B583E5E11DA8073E669B2004D379A778FEF7B18D84B38523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 7b40ebe9c7e511d3887321c89981baad10a1152a8842c190c221609a68d90e2f
MD5 550b8553a2411bf0a21f08dab8e58476
SHA1 c3e7422655a1f4b17de336e2ae90cb09d7568f95
SHA512 17536572dcccf52d27c77914d84a8df7011bb232ca5d46ab5cbfd48223841d0b9ba92e25a6c7f75af1486fdcd3ecd48ba6c9a0e64e4db1032f0056f621c63d23
SSDEEP 12288:rObvA4LWOsvAYFTvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:0rL3UTvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DE250159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 875ab06e9ce37cf36838acf199fa006102b531e9f3f964054c3a1171169ccde2
MD5 9989e8c3cf58ef563c66d4671f80a5f8
SHA1 8d69e0bdb2ec9f855d16142d148a0eb140f1f583
SHA512 c4020b3d212b287b12fe42c0798fa6fcb60d4e0a7ea54b1fb03d64e5db988d5941eba5dee19b66208b5c67c0f3d165904135a9a5e919a28def7fa586584d8024
SSDEEP 12288:qpFtYObXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pObsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BCE4026E33DC10E9E536A17C8692D20DD6327C660B2117DF06D180BE5FA3EF85D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 48a169f33ea6794bb424f061a3c462bd256f221fc319d84cdb8a9d9987c25555
MD5 d3d2557dd307507ec47e4c28d5a5d063
SHA1 4d7d7b7ed121db7eeeafd3c70df561f87518f061
SHA512 d196b37e427620c712fbfe64193d62b85cdcfe8779f53a712d25257a624e066e650b0202617da67c6c64bcbf6cbbffa7df0f79d8266dc20fcb6e40413c2205d6
SSDEEP 24576:x7NM9YqZqmWMUkPjZM48Mv6bEhswsqjnhMgeiCl7G0nehbGZpbD:x7cBWMpPjN8DbEh9Dmg27RnWGj
TLSH
T1C5659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACB1162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 d47d84428d3e7510b907444e328dae4dd94259ab43308e5e7a7ee29e38595825
MD5 a7fb6144e4754d486b0849b262f699cd
SHA1 da01ae4ee238adb7a1e4cb830796ad320d8d5e56
SHA512 d741c6ce7a649dd81720ef4e13838e5590e71c52def39febae52eff42a6b518f6fe1258216032eab157bbcc3f09b8f93c3d1be5b370db00b76ccbfe598d3b45a
SSDEEP 24576:HW6BApg2YuyuNDYTabvcdvNYf8km16sqjnhMgeiCl7G0nehbGZpbD:HF2YuHNETovAvNYf8kmMDmg27RnWGj
TLSH
T113857E6A27ED80A4E0BBD27D85B6D246F9B2B8511B3055CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 06bb6201553bc6efe18baa0daf08dffe3ca6b16a1c1103605a366ff8acad5814
MD5 4ef3d3f32b489331d5f621d81366bfef
SHA1 af79bd4c18280d1b43800e0179c819a33eaf1332
SHA512 ab136fc9f00bad8dbffaf099df06604a937fc6ef048547d285821ea8090c40a4bb11395979588628d51548b60e07ada0b6c44bff6ad13dd0c46e5a5e9bc91043
SSDEEP 24576:uAFs06+OmlfQNXEbTo3sqjnhMgeiCl7G0nehbGZpbD:nFs060lcXuqDmg27RnWGj
TLSH
T1B165AF3F62AC00D5D07ED17D8A97C91AF6B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 9b0169c2285c96548d95af978e1ff95e9f09b4fb8561a293b5c460198aee2e13
MD5 3ae00acb937efa132415a0c653e53e8c
SHA1 6c5516043c95f9cad67c324f0f5469a625c6d85f
SHA512 7bdbf670f7b29ff8ff16f688fd8ef268948531e3b3765747a04388338ddf1e485776dde8faeccaa2f93b7133d001a055635cf5bb683cae3b1024bd00e91d9fc9
SSDEEP 24576:DJnJ5D3WXmsqjnhMgeiCl7G0nehbGZpbD:DJnJ5DGXqDmg27RnWGj
TLSH
T16315E13DD2A810E8D4B7C2B4829A5756FE72383D2F2169C728B4D4357F12EE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 dcf28c08d6d9a9b5e39f5574ac871d42cabb0be20941d59527f5cc1308501ed5
MD5 c3665c0b69c33f5ce1ffa13ae1d4b1d9
SHA1 3e97185a748a252a2231b23359e241aa5f41170c
SHA512 244d087f30d736c803fc130a100d8457e201eb73afa1f4a926076dec215069b109cdd95e98123d061d42376c751d32657bfbcded200003ac86c0c3fc855362c8
SSDEEP 24576:1EPghm6/7IIXdwcXrif7qQncjlP65i3VuxsqjnhMgeiCl7G0nehbGZpbD:ig06DIKdwc+eQnSt65aVADmg27RnWGj
TLSH
T129955C15B7EA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 5068211da83ea72edae5c41fd09aacac44eaf7934b50eb16f075067328587e49
MD5 ac2eeee060bc6d24524d4d2c705679d8
SHA1 11dd686ad0532982d5d2525fc308129ea1acbeb4
SHA512 94e2c653c1276e945f3504c4e530d0f947432c50311e058334dcdb095ed4bad975ba13bea92e88d5d2a590780770ee4de0714e535ef8049c01356ac16a505cf4
SSDEEP 12288:AEP3RnCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bnCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D4E412AE679C60DAD536907D82A1C209D733F4716B2127EF5692C17E8F739E80E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 0b96b49518dfca20be294b4cfb7c0e722598f59070d3b7492be8f5131348c3d1
MD5 ec966129671d09a2c779f5f3b4b6f28f
SHA1 f62edae7e6804995d255928429c00d34617616d1
SHA512 2728b34c6a4294a7df2daf39cb7c154b5bd645b05247cb0290fe9f24ff093033280ebc23676ae5351cb9e22f78a2eb9ee43e3f5755cdabf788add70e89b9f101
SSDEEP 12288:qjkyJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qIyJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A5F42219638C50C9E9760578C6B3D1989C36BC319F2046DF6192FA3EAF72BD48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 c325789a416b311f11531739d3aaa35fc6d3007bfd586d49a8de6dcbe04bb0a6
MD5 0b9a2f6bf0cd9e5ffcf571276a54b4ba
SHA1 57138e112ba02fdb25baea8f82bc481bd2cbfef7
SHA512 e681185a3c53c87c1a56e5b21a98200b085b79f8314a374330eef81ca3e61c77ec20398507ef544f84506d3ecd735ea596ceb1e2981ebf8e5d5be140ae33702b
SSDEEP 12288:nyLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:yLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BED423BD525C20CEE93645B8C3E5E10DA8133D369B2018E775E7B8BDEBB24D44B39812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 0367a42a42af62857f0c4eba8abb2b0a395e42825ce4186aacff5e71c0927a43
MD5 8c3a76dedd998f8e26554edd7d311366
SHA1 bd5390cac61d52d71060172c36829359447ac0b9
SHA512 933038f37ab8823aa35f081defbac6fdd51baa3d7b2dbea998321a9e7d086d9fc5f0ac01d6f8f997dbb512b52c3876e261b2ca1ae14e22d9d4bdad7d6eb92be1
SSDEEP 24576:zQ9MxZKdcz9dw3YsqjnhMgeiCl7G0nehbGZpbD:zVKZEDmg27RnWGj
TLSH
T1FE558C2DABE9058AE177D27595A290C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 61d6a480bc485ea4c9d0e2bc47490ed6e25a307e94c23392c1a22e3e01dee485
MD5 ccd6257cd87c4948ffd819efec515ba9
SHA1 755a73dc3e9ada127fdf551bb35ec02ed5c576a8
SHA512 240a6e87553a8b8f34cc92aedc75d4a0750ad2d3eabf7d014e121d30e637b9ff4111f5ff9c67edd7eed965fd858a9041526cf12599366fb10d3409cd5c63441a
SSDEEP 12288:LyoKo2JRple9p1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:LyocDAp1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T155F4E05FB76D40E2E176813C8985C249E673B4305B2157CB6692C73D8F639E8BE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 901b9da8ffe040df30dacfb72d17f0f83fbca4b4b4c6ace5af27e0963242f423
MD5 b769d3978a523ee2b90a8e645c488f04
SHA1 7c3695bf766d93e6d4fd57411e2f98fb29a3f2f9
SHA512 ca074d888f7c79284007af67b1d18f31d0b30fda7f882021bfa604a342c78d4f5dbfb1ee726f64485f48b11e8a82b37e1122f11c4d0174a057a2f18545e8d0f8
SSDEEP 49152:PWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKpDmg27RnWGj:30zuNITD527BWG
TLSH
T187A57B3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 914B
SHA256 4526cba1d2424fbbc51568407bb3db45d8a37f2a91e049951700a4b88f38371d
MD5 204418faaacbe05ed45e01a24aabf59e
SHA1 60dd43b71365cf05d1d92b0c0b75a9bd0e5db5f1
SHA512 46577a21b3eeab82697a6bd36c526664167d1a79056f651b39efb31e3dbd6e7bc86bb7019cf8f12abeebc2917c667731cead44695455562bd9bc2cfc9d9581fb
TLSH
T1AF11794B22E54204F0B31F62EBFD80B353333C95AD19817D80D4030A49E1A06A473BB3
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 1KB
SHA256 2aa772897ccaa5678880d29466fe9fed070e1e09056fb67366c1d1ad20906bd1
MD5 f60df6721919b019b62f438cb42d0504
SHA1 214e09b9ad60e52d0579b42950555d1755d29d2e
SHA512 ce350b48211f02d80517aa4d6fffd3484b83d0bb0367b8547ffd2e6fc70c1292443ebf081d7412e5c814a12c25c3b333df6ea67a98f1404035231a129b3943b8
TLSH
T1AB118B832AE91024F4B35F92DBFD84B257337CE21D2DC86D80E4020E4AE0A85A5727B7
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 1KB
SHA256 c8c841976f299aab474e2219d3e18825879aa074b85e6d4ee7521838ec4321ae
MD5 01a35234a89be0314c347433fbb47d52
SHA1 9ab08fa66e9849e963de92eb3e9971d2f5dce215
SHA512 eb5461cdbd62d928660ef21f9920bd9c0a28cf423da644941d7bb292955127438567fed028e7917e2f4aa258dbd7aa350a498713f91503d6afd15f8ee9af4754
TLSH
T1F1319A872AE90124F4B35B95EBB994B25B333CE21D19C46C80E4020E4EF1B95A5727B7
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 1KB
SHA256 35af3ca96f266601c357ac7ccdf03ba998fa3ef8e413f0469260d51a135846bd
MD5 e8eba456fddc1074a1de10a28f7cabf4
SHA1 9f31c4ccd40f102e86e6f801d2b50e2d34c273a0
SHA512 36da169e237436f9c91ad78e608640d52d043574570e9b9db4465e9c8947f949a3a5b42f98a412271610e2fac197bd6e576c882aa74d2ea961875b67207c366d
TLSH
T16731AC872AE90160F4B35F95EEBC94B25B323CE21D19D46C80D4124E4EF1B85E5B27B7
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Windows\Temp\ArmUI.ini
Size 233KB
SHA256 76362509a8ca3e4a9fdc854c56674083ef77ca2c53628ce0acf4bb4c42d73894
MD5 b0df20baa9dee27bdbc3285c7d6d4c57
SHA1 443fe739e4c5a2ab4ece3eaff0179e7b1deba639
SHA512 0da5976d3096f598d0bec4a2c4e64f708d02a6376bd87e460744f5054d2b6e1b710e655831c287d7e672f73a3db846b19ff054270c3ce41fa02b61ecb5e31fab
SSDEEP 3072:03IJ8zcVOWmxltum8PMkufNWwhEIrKNCpNugYW+lCIr0YxbFKRWSp4Vf37FbAjG/:ByJvW
TLSH
T132342A5667FD1209F6F37F41EEB852944B7B7DA2BE3AC14D1680014E08B5A90DA72B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1a811b3a542ce31879f043cbbc0db7f7cc60376bb1ca77f9ea3c8c7f3a8a772a
MD5 18006fc8fc20847ef6210fd66de7cf85
SHA1 dba616f4f7476711511d6f1c23b92a535318d77d
SHA512 410421bfb3063276082e1397ddfa01b1c9a9ca478bcb15950672dd979cdbd3456284afd91ea007e0c9ff4610a6ffcda2032aa807152a307057704fda797e77cf
SSDEEP 24576:Q1QT7EcpfxR+N5AWAz3ooiYsjMqbCsqjnhMgeiCl7G0nehbGZpbD:tTDxR+N5YzTujMvDmg27RnWGj
TLSH
T15D55B02EA7F815E9D17E85798B23C506FA727821033193CB42A0C17E1F6B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 363bd41cbc36eec11a7a403fefedc5c00c7f694aa092d9499a9371ee7d5455b8
MD5 ecd66f2ec742a00066ba9dc0c2dc01ce
SHA1 196e217a19b55a1074f2ddb3fd20defd9ce7cddd
SHA512 c0d88b7a530525f562ddc67564ae4585bf7f34fe5f3e3a8c0438f56fba261090a95e451e1417f466e966cdb1001c6af6c2225a641cbde11e8d411d18cdda83dc
SSDEEP 24576:ETMdOz0FFS+hmSLusqjnhMgeiCl7G0nehbGZpbD:s0K+hmSLCDmg27RnWGj
TLSH
T13315E17EA3AD14E5E47BC17CC653D90AE9733862032166DB0691C0B93F97EE47A39B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 78cf3dfeb721ffc0efd2c27136ce55b2c90e61a983d9a2e1fbb5feb8058009e2
MD5 83821a4023388597ca0570411d26c6f0
SHA1 cd16f03c812fb0329eecc1550e44b8f49f6f3ee6
SHA512 16e99f73bc36247df4f4e2eecc1f7803db3feadd29c1a33dd1ef5ff12936dabb47a3c7777ab54d9da27d6ffbea849d8f0a0a3f7f326d58e269e9dbb00caac2f9
SSDEEP 12288:d4KvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5vsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B9D4126D63DC20C9E4329578C3B6D1199432BC36572019FF39E2D9BE9F729D48A38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/536-352-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1100-345-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1740-133-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1740-341-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1740-127-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1760-357-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1776-177-0x0000000000790000-0x00000000007F7000-memory.dmp

Download

memory/1776-182-0x0000000000790000-0x00000000007F7000-memory.dmp

Download

memory/1776-344-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1892-739-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/1892-667-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/1892-868-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/2572-172-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2572-166-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2572-343-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2640-522-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2640-430-0x000000000CE30000-0x000000000CE38000-memory.dmp

Download

memory/2640-356-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2640-232-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/2640-268-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/2640-248-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/3196-351-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/3268-349-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3268-199-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3268-193-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3532-432-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3532-95-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3928-154-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3928-342-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3928-160-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4088-354-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4164-217-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4332-348-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4592-0-0x0000000000400000-0x000000000060F000-memory.dmp

Download

memory/4592-1-0x00000000024C0000-0x0000000002527000-memory.dmp

Download

memory/4592-8-0x00000000024C0000-0x0000000002527000-memory.dmp

Download

memory/4592-415-0x0000000000400000-0x000000000060F000-memory.dmp

Download

memory/4592-820-0x0000000000400000-0x000000000060F000-memory.dmp

Download

memory/4768-114-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4768-120-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4768-514-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4768-123-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4772-350-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4772-210-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4772-204-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4820-355-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4852-353-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5076-99-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/5076-107-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/5076-108-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/5152-347-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5152-449-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5416-147-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5416-137-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5416-143-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5416-149-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5504-122-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5504-124-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5836-451-0x000001C868FA0000-0x000001C868FB0000-memory.dmp

Download

memory/5836-434-0x000001C868FA0000-0x000001C868FB0000-memory.dmp

Download

memory/5836-448-0x000001C868FA0000-0x000001C868FB0000-memory.dmp

Download

memory/5836-447-0x000001C868FA0000-0x000001C868FB0000-memory.dmp

Download

memory/5836-446-0x000001C868FA0000-0x000001C868FB0000-memory.dmp

Download

memory/5836-445-0x000001C868FA0000-0x000001C868FB0000-memory.dmp

Download

memory/5836-444-0x000001C868FA0000-0x000001C868FB0000-memory.dmp

Download

memory/5836-443-0x000001C868FA0000-0x000001C868FB0000-memory.dmp

Download

memory/5836-442-0x000001C868FA0000-0x000001C868FB0000-memory.dmp

Download

memory/5836-441-0x000001C868FA0000-0x000001C868FB0000-memory.dmp

Download

memory/5836-440-0x000001C868FA0000-0x000001C868FB0000-memory.dmp

Download

memory/5836-469-0x000001C868FA0000-0x000001C868FB0000-memory.dmp

Download

memory/5836-470-0x000001C868FA0000-0x000001C868FB0000-memory.dmp

Download

memory/5836-471-0x000001C868FA0000-0x000001C868FB0000-memory.dmp

Download

memory/5836-472-0x000001C868FA0000-0x000001C868FB0000-memory.dmp

Download

memory/5836-473-0x000001C868FA0000-0x000001C868FB0000-memory.dmp

Download

memory/5836-474-0x000001C868FA0000-0x000001C868FB0000-memory.dmp

Download

memory/5836-468-0x000001C868FA0000-0x000001C868FB0000-memory.dmp

Download

memory/5836-467-0x000001C868FA0000-0x000001C868FB0000-memory.dmp

Download

memory/5836-466-0x000001C868FA0000-0x000001C868FB0000-memory.dmp

Download

memory/5836-450-0x000001C868FA0000-0x000001C868FB0000-memory.dmp

Download

memory/5836-439-0x000001C868FA0000-0x000001C868FB0000-memory.dmp

Download

memory/5836-453-0x000001C868FA0000-0x000001C868FB0000-memory.dmp

Download

memory/5836-454-0x000001C868FA0000-0x000001C868FB0000-memory.dmp

Download

memory/5836-455-0x000001C868FA0000-0x000001C868FB0000-memory.dmp

Download

memory/5836-456-0x000001C868FA0000-0x000001C868FB0000-memory.dmp

Download

memory/5836-457-0x000001C868FA0000-0x000001C868FB0000-memory.dmp

Download

memory/5836-459-0x000001C868FA0000-0x000001C868FB0000-memory.dmp

Download

memory/5836-458-0x000001C868FA0000-0x000001C868FB0000-memory.dmp

Download

memory/5836-460-0x000001C868FA0000-0x000001C868FB0000-memory.dmp

Download

memory/5836-461-0x000001C868FA0000-0x000001C868FB0000-memory.dmp

Download

memory/5836-462-0x000001C868FA0000-0x000001C868FB0000-memory.dmp

Download

memory/5836-463-0x000001C868FA0000-0x000001C868FB0000-memory.dmp

Download

memory/5836-464-0x000001C868FA0000-0x000001C868FB0000-memory.dmp

Download

memory/5836-465-0x000001C868FA0000-0x000001C868FB0000-memory.dmp

Download

memory/5836-452-0x000001C868FA0000-0x000001C868FB0000-memory.dmp

Download

memory/5836-433-0x000001C868FA0000-0x000001C868FB0000-memory.dmp

Download

memory/5836-435-0x000001C868FA0000-0x000001C868FB0000-memory.dmp

Download

memory/5836-436-0x000001C868FA0000-0x000001C868FB0000-memory.dmp

Download

memory/5836-437-0x000001C868FA0000-0x000001C868FB0000-memory.dmp

Download

memory/5836-438-0x000001C868FA0000-0x000001C868FB0000-memory.dmp

Download