fefb2b13b6c98cc469481ed8e0c309258134042f3bf389ec788482cfb79413f6

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Size 2.0MB
Sample260925-xtdhdavx5k
SHA256 fefb2b13b6c98cc469481ed8e0c309258134042f3bf389ec788482cfb79413f6
MD5 d57f929f0ba74a5cc8a884e22034dcb4
SHA1 76f5740bcd32bce2d4edca7ec133c5079134434d
SHA512 5b78eee4a6c78a6ff619e9d21dc54ab56b820240b034a05dc7fd083628cb0a9184843ef06c7bd72abf2c699b62892d884a2ecc11674d2d9d12ec0878fbacccdd
SSDEEP 49152:hFx9+qVD2SouuFOnYIsE5JIMzHRX4+Dmg27RnWGj:Xx9LuFOnYHEXRD527BWG
TLSH
T16DA56C117BE95A29F1F72B31AE7852644A7B7C619F31C7CF13801A5E2934AC09936B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
26	1544	Process not Found

Executes dropped EXE 13 IoCs

pid	Process
4592	elevation_service.exe
2548	elevation_service.exe
4872	maintenanceservice.exe
5044	OSE.EXE
1800	PerceptionSimulationService.exe
5888	perfhost.exe
2088	ReFsDedupSvc.exe
964	SensorDataService.exe
5200	ssh-agent.exe
2636	AgentService.exe
3496	SearchIndexer.exe
1240	Reader_sl.exe
2784	RdrServicesUpdater2_x86.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe

Enumerates connected drives 3 TTPs 51 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
	\??\F:\	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe

Drops file in System32 directory 58 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\191affbd9600bb.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_108687\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_108687\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RdrServicesUpdater2_x86.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RdrServicesUpdater2_x86.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrServicesUpdater2_x86.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000383c6b49214ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008b453348214ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d8837f8a214ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ad96528b214ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ff5efd47214ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c0b18647214ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006ce5c147214ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000079eb1748214ddd01	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Reader_sl.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
4636	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4636	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4636	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4636	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4636	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4636	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4636	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4636	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4636	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4636	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4636	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4636	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4636	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4636	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4636	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4636	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4636	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4636	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4636	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4636	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4636	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4636	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4636	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4636	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4636	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4636	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4636	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4636	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2784	RdrServicesUpdater2_x86.exe
2784	RdrServicesUpdater2_x86.exe
2784	RdrServicesUpdater2_x86.exe
2784	RdrServicesUpdater2_x86.exe
2784	RdrServicesUpdater2_x86.exe
2784	RdrServicesUpdater2_x86.exe
2784	RdrServicesUpdater2_x86.exe
2784	RdrServicesUpdater2_x86.exe
2784	RdrServicesUpdater2_x86.exe
2784	RdrServicesUpdater2_x86.exe
2784	RdrServicesUpdater2_x86.exe
2784	RdrServicesUpdater2_x86.exe
2784	RdrServicesUpdater2_x86.exe
2784	RdrServicesUpdater2_x86.exe
2784	RdrServicesUpdater2_x86.exe
2784	RdrServicesUpdater2_x86.exe
4592	elevation_service.exe
4592	elevation_service.exe
4592	elevation_service.exe
4592	elevation_service.exe
4592	elevation_service.exe
4592	elevation_service.exe
4592	elevation_service.exe
2548	elevation_service.exe
2548	elevation_service.exe
2548	elevation_service.exe
2548	elevation_service.exe
2548	elevation_service.exe
2548	elevation_service.exe
2548	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4636	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeBackupPrivilege	2088	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2088	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2088	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2088	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2088	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2088	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2088	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2088	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2088	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2088	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2636	AgentService.exe
Token: 33	3496	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3496	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3496	SearchIndexer.exe
Token: SeDebugPrivilege	4636	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	4636	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	4636	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	4636	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	4592	elevation_service.exe
Token: SeDebugPrivilege	2548	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4636	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4636	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 1248	3496	SearchIndexer.exe	102
PID 3496 wrote to memory of 5960	3496	SearchIndexer.exe	103
PID 3496 wrote to memory of 2796	3496	SearchIndexer.exe	104
PID 3496 wrote to memory of 5816	3496	SearchIndexer.exe	105
PID 4636 wrote to memory of 1240	4636	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe	106
PID 4636 wrote to memory of 2784	4636	2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe	108
PID 3496 wrote to memory of 4432	3496	SearchIndexer.exe	109
PID 3496 wrote to memory of 5840	3496	SearchIndexer.exe	110
PID 3496 wrote to memory of 2252	3496	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-25_d57f929f0ba74a5cc8a884e22034dcb4_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:1240
- C:\Program Files (x86)\Common Files\Adobe\ARM\Execute\8523\RdrServicesUpdater2_x86.exe
  "C:\Program Files (x86)\Common Files\Adobe\ARM\Execute\8523\RdrServicesUpdater2_x86.exe" R32
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2784

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4592

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2548

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4872

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5044

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1800

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5888

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2088

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:964

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5200

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2636

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1248
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-696679853-3915825385-3233721679-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-696679853-3915825385-3233721679-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5960
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2876 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2796
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5816
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4432
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5840
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2876 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
Size 611KB
SHA256 3cad6b0d44b877344b34bdfa70978518780cf13b42aa9565f8b330240d37d603
MD5 d20f76ed5445341a01bc2aa3497a8b5f
SHA1 92b7c86be68e0be8211a987d7a6fe488e6200358
SHA512 0343e5b7f3cc5153d883e914abaa53167b491e13b85e90ff1134e58b64a6d74ee74e12109f029fdd9d0c72189f7c65c9db170682016d13bd7335b78f638559e3
SSDEEP 12288:6FWZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:oWZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14ED4226B6B498793D82144B102E9E7BDA46BFD31DF1019D3AB5329BF9DB80C04A3512F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
Size 1.7MB
SHA256 428e7de5558bf60ff9c7344f36d392277a3785e43aee887d13025929b37a7234
MD5 1dbe9735069b665e1dafa7941db2a827
SHA1 923eab0d10f0dac7d14612de25136bf184f6fb39
SHA512 a35e77ce83121689f6bad80c02ea1287e8bbc7e0a67f7a39581aca3e3dcb955e337351beebd094f865a94139f1c5168edb4a5655ca42ba778e303f5403fd6fff
SSDEEP 49152:wSgouvAeFfenxyQ5XS7uQ0NIrDmg27RnWGj:wS1uxax1S7uID527BWG
TLSH
T16C855A1267F94129F1F37B71EEB993645A77BCB1AE39C50E5280125E09B0A90DE31B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
Size 973KB
SHA256 623927ccd3689cca0e4961b31c90eb9eb6f2dfc718d8c5f4c2e8afc659f9ac0b
MD5 c53b2f84419e04102617d0cac58ad1c1
SHA1 2397d3a5bd387bfb6c33c7fabfa47e23c755c1ed
SHA512 cc71a35df8001cb00e97a9b6189ffabdbf572a88d10ea0e76a103023c3ad422432c1402e8acb153688a6ace359c22a9a2b9a5a2764cbc847aecbf5882a50ddd2
SSDEEP 24576:RGTAbD+Ome9sqjnhMgeiCl7G0nehbGZpbD:QTAGOmehDmg27RnWGj
TLSH
T11225E11037D0C135F1B329768ABFE728542DBD715F6841CFA3881A6E5EB06E0AA3571B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdrServicesUpdater2_x86.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\Execute\8523\RdrServicesUpdater2_x86.exe
Size 846KB
SHA256 6a142c879a0676aef5c825d6fd6336800846167fab422d0f912096d286aa0070
MD5 a447c3cf3b7547e5a1e12dbb92d8c052
SHA1 d2b246eda6302534b21b2003719d9f911d0c77d3
SHA512 ce7446e337cc13a560a12b0b789813bfb5a96a6a9d25a8b3e2fc1ed884f0c4950f01937714614666befb9b92123d359b9597116e9ed9e8efd46b77a640d002ea
SSDEEP 24576:uSU4vrTQA/gK/c8DV5Wa1ZmPEKBLeiGA5nEJ:uP4j5gKU83W3FLeilVEJ
TLSH
T10C059E22EAD18073D563143102A66F368EBEB9310971D98FA3D41A4E5E705E1BB3F397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 06b4702ca5205f5c4f50ea62df5446c38741a1cb6d293c071b0fb781f42ebe74
MD5 93aa54ef0c142e352523a248df7c9c36
SHA1 64ef1f4362116003a314c558660bd727c132fcea
SHA512 ecf6c6de52ec29074bd24b8f282662e7d2043283d8a56b6bcb08bdb4a2b0524bcea1448cac29b0db9ee0ff481fd5a5b48bf029a71a4d698ae6d74ba2b8343b7c
SSDEEP 49152:ib+632BuPkFKRrdE6ohrstBhuXjfS4LWxnSDmg27RnWGj:E3q60jB5D527BWG
TLSH
T108D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 c602af51ed91886561c891bc2af46e5dd44f4e9598285012af37e3eb09dc4a9a
MD5 167644cf20b684db812b788689742bde
SHA1 90ff01284a2f7b5b6ee6f73926952843ce4c9173
SHA512 79b283af0126d3cac82dd89072328ebf2a15470c8c9b57e96b5059a780b26b3bef57f7780771a4a6e2ec22ec26eff249444da0716ed454626b42fc556fa5cadd
SSDEEP 24576:uXYfDtczAhsqjnhMgeiCl7G0nehbGZpbD:ttcMDmg27RnWGj
TLSH
T1F7050129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 e7f0c705e2ac047eb7c3b82b62eeb423c5ef68e0344edd8721c62148ecf283ef
MD5 c140c6bff2351160e5b59f95cb1012cb
SHA1 5c70e62e5693a6d3464fc6c353000c09ceb97b9d
SHA512 7e5224aec9b22dd4f14645ae2db77399dc1362fd2c8d6132a520de11702d2094f385f8e7a3618baf0b5fbdbc627d7bc319660eba5722d197c2aa2ef685ba1f62
SSDEEP 24576:W0Le5ji0hmxNrMmsqjnhMgeiCl7G0nehbGZpbD:WPji0A77Dmg27RnWGj
TLSH
T1B8359E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 da0f7695709950cf310b398c2f38d2f19e36f78063cc2a7c32ea62792c351a21
MD5 b3e9aa811623841f521f069b3119a8ee
SHA1 94a52b596c3d33243337bffdda8c0b3c68722e03
SHA512 0d716dc0b0523105f218515e70fdc7e4eb27f471f0c41e01e8c85aab2e8e01dca7e88d32dad7413acef563c7ca186837d5717285b77a8f5c0fe777c266c8d774
SSDEEP 24576:la7/ezSC6vUyD/aqgrvWr6q8wyuAsqjnhMgeiCl7G0nehbGZpbD:s/ezSC6vUzPviHjy3Dmg27RnWGj
TLSH
T1D6755C25F5788323D0B2D0BAC5D6BA9AFD7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 742399757d90512ad9ad86e4b0d044f380f6bcfc8a769a43cfb9ae798525901c
MD5 4df7affd8fc56445f4b2f64746784938
SHA1 4725654c2752b0ac18e4b631d52a291bb99d6876
SHA512 83ab2ea5764faf23b900212ae221a176d34bd6b02f163817b798425135fd33269e2fc73d0182aa651929107978729a7d3262cc4e260318a958e1abd70d46893c
SSDEEP 24576:BVbqPb88hv/l+b1sqjnhMgeiCl7G0nehbGZpbD:BVO88hXl+9Dmg27RnWGj
TLSH
T1D9559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 43a47f4086dbefb6989ddca996c2850a8c75dd702f3aab59a5aab9bd9098e2b7
MD5 aa5cb584689d4b47704ec91812abc655
SHA1 1c1ccdf7eab1bebea1c567f108b7d5ba3ad47b33
SHA512 c73ef964eb27e474124f6d1aeaafc757e51693aead5eda3016c1ad4d3f5c32096c52a8d84effaaf84ee676c461fcf3e1babd5d3f7cb417aeaa0b2cdf5b1efa26
SSDEEP 12288:3jaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3jasqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B0C423BF834C11CAEA7609B5C3E9F15EAC177E6698200C5269637CFEE6B5454CB38123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 48767e0d6395af7352b9773655553dcce6a09c6e8f1d517762c3123581211c51
MD5 4d9f72bf2bd10a30844b171c5a861017
SHA1 f0a406504d385da194ac6388d634c45d6cf06d94
SHA512 29cfa14c54eb8d44ca51d15eb3204e27de1b3bdcf31781d29e30deb55e8a0c476d1e3980f0e2eda1b5df604442e36aae2430935693f74b4056dd0f48d08c7327
SSDEEP 12288:peBNUbTVO86UdXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:pJIUdsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F505CF7BEE28FCD2C27A8DB95791C600E76278314F21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 73d2e0508307df640247058de0f1c709c89a87284707ed64d7c1e3c0121b3fa9
MD5 6e52128058bd0f0a3acf2ae26583cef1
SHA1 9989e88c9a0d47cc37facc91472a120e905ab3c2
SHA512 026ae20a690272e05b4cd2973a042b98771aa2b512753d916296831bef75dfab26e6d1f1087317f1f757b3dcb5989e3b1a14561c26324575d3cec9464ba0b41f
SSDEEP 49152:vQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3TH0:vQvGAdlCEL8c/RRNw5CsD527BWG
TLSH
T172266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 e88b3d75cac16c7faa02edc33cef9d1a9c92c940ef00cc9aef57e7cb42b12eb9
MD5 3b8e22c795ed039925aa6a0b0d18adaa
SHA1 b0e229fc41a648dfe406c7e42c3d990d81fcd34b
SHA512 2787389ab98a8f729dc59ec90385b993566bf41c2a1c630462cf8843c619165dab1396decaef7c74de083e9d7023e3151ba99799877f1b8bf1f05fc675cb7a9f
SSDEEP 12288:DAwSfxL/2Dc3DDLLmt0LDQewsAjXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:8SewsAjXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18115E031FA74E036C77B0DB20B76D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 de1e3fcf5157840a6b742f4978e312f35a48da311f8be624f054b0e424d3ef20
MD5 33f1d08817336bdaa1d9f729426b3e37
SHA1 4a8bcb79aaf9485c1a8d781c1662a2d3acfa1cc1
SHA512 90db6aa78865f735331ec9a2f353135187cdc53265dc40c1b6ce5472d0ae56780ae77597c990b9802050f0e58ebf678e0d7fc18d1e570a7bd7ddba7837e5a0eb
SSDEEP 196608:TUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHTVQBWG:TUEtQevvqc2W1cpV2RI32KB
TLSH
T1BD474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7fb421d5c2f86284c81a92e7548cc73e51534c70ccaf935f2b090eef66ecc328
MD5 0e138873860889225fecfdc336011ba9
SHA1 ff463fdc66e572a9aa0049c9505c2e4b98be528a
SHA512 35e2c0d12f74362d21b25fd6b5f4b625c39fcc2490bfb32dece4228607c48b8f1294814ce65308b2a663be5373f28870cf8d86b748fdf92398f89605cf6970e2
SSDEEP 49152:6CbRquA/m2yL5zQfFiV+XenmE3/zLDmg27RnWGj:PoqtVjnmID527BWG
TLSH
T108D58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1e579137f68c9fed0c76e9a1c813b9d07bc610e31773aea08b1d6c03c02fd7be
MD5 c35bf31f9a3cce81460455f547e29e68
SHA1 d2adefdb0564d05d26e68bfbcf369c3d454fb72a
SHA512 b5458450f73782c698eaf098143497a64ff0fa9d7cb58949116f99764732181c5795161f0be4b877f0cd87cf85ae7a411e520e892fb5486a6ea9a1f140bfda66
SSDEEP 24576:NAhGL2IFoiwtA5l7S538sqjnhMgeiCl7G0nehbGZpbD:NAM1Foiq54Dmg27RnWGj
TLSH
T15E359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 9fc089290852383280a4925924d34f187a5ac96aa6604f86655805ef29594379
MD5 9088a2b195af3253b12b226de12d6cdf
SHA1 88f159742dfd96f58a6983b566c2162c0b74c0ab
SHA512 83ba1ac45e53adcc732c2cf36af260176e0c8dfb41c9d562726b3ff22b6cb7232052293835c8903ced5374d9721c5326a446c3030396475f901a0476cf04174c
SSDEEP 12288:2mw5HEjsChNSBFgl0WDm+CgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:vwuXOWTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14A05F14A72A80CF9E9674539C697D136F7B3BC122A20DB1F1760C65B6F37250AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 477ff59a552e2a3b9466b04a79377dca80cae29125ef09cd407911589095f0c2
MD5 e9c12ece425802bc1de87b143afba9eb
SHA1 046a5bd35a91b5d6e2f422e352a8703f9304dcfe
SHA512 7a881b33420ba68b8919cac532c4127d0a9de0591b7dd592541b160264a698f92f740b914029b0ba615d9e4dc303cfc103fffd3a03a01841adcf9acd0d4f9687
SSDEEP 12288:F/Z1IyHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NZuusqjnhMgeiCl7G0nehbGZpbD
TLSH
T117E412AE239820FAE167417CC5E5D609E7337C62673003CF166656AA6F739C44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 38fae9f02aa7df6d50ce8b826b59dad5f92944473f4380962b470fc167774a14
MD5 9855dc2903a3f54880ec2dbfe4d5c303
SHA1 85883d194af371dc8ccde042f0d8c241ff3c2025
SHA512 8e20f9dbec113ae4a40dee7d6935796d8db85bbbd773c5f625bb3eccf745ab58edca63af2e8b97bc9bdbd7db0190b5ec3ff9533f75a0b7ff263c0c35afe87b16
SSDEEP 98304:oQRQyi36YOcPhLvw2gAf+PN3tD527BWG:/QyiKahX+PN9VQBWG
TLSH
T136667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 39d393b5748b3a7289bffb5d333359f996d922efff68a39f789e79894e64036e
MD5 bbb234bea2f96bb335fdf608fbb5a032
SHA1 30569328eb0a85422b39cedba6ef003328ac8541
SHA512 3d475ed4e051cd54a948e46a1487b4050e422a5b97a0eed7f52b4372ec3595c7f960d56608e22d184ab7eeec5b46c142916fadb2b25123affe1c8cc35e5e8bf8
SSDEEP 98304:1QRQyi36YOcPhLvw2gAf+PN3tD527BWG:MQyiKahX+PN9VQBWG
TLSH
T174667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a8c1802a553826cd4465fb99c4f359265a3d69ecf5dc1599709249af0db4b4ef
MD5 900246a74c2ee79179f0d464befcb5f5
SHA1 e96a1aaba3f2588f7bb781fe43654f1f277269b5
SHA512 0b1887bcee2707946757f9c58c58b340685649e35c3d0fbeeab9d435e21afc129306e5459070aaaf7ae7579c88cf63b7432f1aee001434ab4d907ad3dccb52d6
SSDEEP 24576:3wvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0+sqjnhMgeiCl7Ge:/68Qg55nhceWu7PNU3/7Dmg27RnWGj
TLSH
T129B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 9cddba7e064f72c2d4d27717c90e8cce3f0f2f0ceab5a2295b007c21d123bf24
MD5 bdd921de3155188c8e0d552db1eb7a15
SHA1 7a32f4040a0e99c2bb5974317a7cd7b43bb2c206
SHA512 be9cf834718f3aab60c09c411a9c0aaac4149b311c52ffec1a29c07a6dc16796408e01360f46868b36512bb8544d7053513e93693445fcf14bcddc7bedd337a3
SSDEEP 98304:Ky5112gYy5azzVva69nLKnhZuD527BWG:zLIHjWhwVQBWG
TLSH
T104167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 42514076a4ea5ecaa1a0d7af0b035b12a1ec0248295bf747b334ee723c2c877f
MD5 41f540f480cd10a0c511afab495d17ea
SHA1 499d3d4b5b24910fa1d42fa575be20d51ef254ea
SHA512 dd9aae0e8689015ab1fabecd3b28e0005e46acecc733b4ddd599b8298656afb08af56de0b7592c3066c120fcab7eff18aefb06d9ba2f4e09b75f9cc18c755fbd
SSDEEP 49152:8B+taZ3usBWOBr4tEG20bqx0z+n217aau1glFDmg27RnWGj:Wu6JmUxd2dFD527BWG
TLSH
T1A0D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9a2e0a91cd6375f7983e01298b5af495b433cc6ffa940c3b22dd4e11869d6dc1
MD5 ab8fad41f6fa733b11fe4ab07d5ff619
SHA1 ccd0bc4fa88871a35b4cd4948fe89db4821af2f8
SHA512 f1ded5a0f6ff531cb2ea17027c9d8db51b0f90f08d2f9d36a1e42afc22c3bdc9f515984fe1033ea1edcfaf12c9f7349d26330a4fd45bb6afb044be26cf0bd26d
SSDEEP 49152:X1hpsNoJpF1A6BU44CwH7R4xhDmg27RnWGj:XmifPkRID527BWG
TLSH
T1D3B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 97d14280e729edddcb33590b9aeb1687ecf10edf7d2f43bf115578b85d460413
MD5 fe754e1a29ab3848ae09ee44a89d7994
SHA1 2cdcca07f014c4a9c4a5806621a47d0ea6dd9878
SHA512 fd643cd5ab7b1011ef2a0a11b59d5232c04688fb5f1b6af8a7375285da14fb7412abcc39f3b6a4a90b98a03de00bd60540d14dc71aa1efd0807732bfba2c05a3
SSDEEP 49152:FSuZQIY0Be2KNRVtOnks6NMHqCDmg27RnWGj:L5dKvi61CD527BWG
TLSH
T196C5BE13F2E900E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 eaec932a2738f1e8382ff7d759a2922d37dfd3ad2b5bb65848a419d52cd5f554
MD5 73a81f9c4e5c38882326f22ba5ca0034
SHA1 61d0865826d734ae7e8fe539fe468e6780753e4a
SHA512 3e18748c70aec256c86e5078f13f153633b76c2700f8cbcc4ee2c7808b15125c472d657ce9d698524c27b086f1c993266547a8e1f0408a8a3341c4d29bf757bd
SSDEEP 49152:XhtSn8EApI0figXgiDn0AP5w1Dmg27RnWGj:GX2iyphUD527BWG
TLSH
T12A95BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 3b5911e6afbd1c56d4016461cc1fe93cc44a2224e76978111de5b6158baccfd4
MD5 2b17fcfb896a2e62472f1f8bf9f78ee2
SHA1 a350a96adbf1c2071b7ac118b5c47d8a03d5970d
SHA512 cc24749f5690ef658b3a8e68a9cfa58bb1d9b473064c08bd575c70977d1a82b1ca37badc760c2baf55438c7fb442e4029642cd6c2fca01328ed125c45eb9c4a3
SSDEEP 12288:RiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RisqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C6C423BE964C01CBE52649B5C3E5F14DAC073E5BE92004937A9B78BEF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 c898046282463939c582c28acd5e76d36ccd506f6ebb9a5fca5e7bcf00df136d
MD5 e5cc1c4b539c5516065f4b35bbbb362f
SHA1 d60e0b406a33e0b42654d05177a57f1372a274cd
SHA512 79f4a0d3dcddea58734f6f28fe95bbd5c84a9854b86900e15a9c7a1aacf53aee0a7190e9de87a3054c043e9dc08db75466bfb52e370187ace5ea25803795ea7f
SSDEEP 12288:SLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:SLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T166C423BE964C01CBE52645B5C3E5F14DAC073E6BE92004937A9B78BEF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 709245b52c5637fd7af219a3676edf16d6b40e163b2ff71da68d42a4762abc16
MD5 e10299d28bc73d0dce589a4e11a70074
SHA1 2a875ff9c6db2aa20999dc91e4013719783acf2f
SHA512 bc4e996fdb26016c6651225b03114330fc70d254c07028acfafad71e41894a520e170486d2b1820ba2685ed2d976213d3ea01424446d3e6be40c0b3e58f52fb6
SSDEEP 12288:YFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T145C423BE924C01CBE52649B5C3E5F14DAC073E5BE9200493BA9B78BEF7B14584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 9e38d3de4a1918ae20733abce841e6ef4d7f591ad89325fc8310b79de470c9fc
MD5 76a1b841b405addcada77e4072f16c14
SHA1 57c87050bfa86a42e6f95a2297d59fc28a91f194
SHA512 cc73fdef158003b2b414473903f54c66350aa6520ab4d6623d22de18673bf87d61f73f8aeadfca635ae7e56136449758105e65b4ae2467416f0f5fc9c561d130
SSDEEP 12288:4VcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T10FD4236A535C00CAD83685B4C2F5E11DE8277DA6DB3005DB6B532CBE6FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 a8084b87d14365495de33b2449c9da20d34942ccff25aa0f40a5059d3e1cdc7e
MD5 570f0f467e14f408caeb3fac8ca5e0bf
SHA1 d742dbd396a90af729d8cbf71dd246a70700eb60
SHA512 35e791f4795cc6c4e757c026a7e5d175df5ac07dd159b189f183138523c9cf2d65d9e08a7f72c983fc4e59e2922ca527eeac3e0f785acbbffa4aef4257016bbb
SSDEEP 12288:e0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:e0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C6C423BE924C01CBE52649B5C3E5F14DAC073E5BE9200493BA9B78BEF7B14584B3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 d17e816dcac495256bf08b33787f35175f5473fd0e271a6bf6155f6ba675fac2
MD5 cde5743dfd4cbed8e90baf58909cfd8a
SHA1 710596d4dff4cba806fa5331c861458c0350d624
SHA512 89c493b5f035304330d2e86f5f5dd298bb52adb086f307f913b0dc462f13c643698c9480f76abcc8ec5a256f0ae1fc8137dddf55acdeae732bc512afb137e2f1
SSDEEP 12288:HfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T101C423BE924C01CBE52645B5C3E5F14DAC073E6BE92004937A9B78BEF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 ec21b6f21fa505a9478d10bdcf6908473bb09ad69bb35303d32ac977528e06dc
MD5 6ca1b3a528dc387c037e36a250efb2dd
SHA1 38af81c48a542fc7cd6ad46033d648b0b5fa1bb7
SHA512 e92bd313fb3adf9e9097600f95d7b677a0de90385fd15b9afdc98b5edd19c692b1e09598330bc4f589ce1c9056bcbd1c89ba2d6bd7553fde0e7ecdc676b95163
SSDEEP 12288:ujXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ujsqjnhMgeiCl7G0nehbGZpbD
TLSH
T104C423BE924C01CBE52645B5C3E5F15DAC073E6BE9200493BA9B78FAF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 898edff309068a50e4a2dc0c4ebf83d5faf4ff614c4cf10697d7d190d1ac90fa
MD5 50ff3702011536ff70edb54677fbe933
SHA1 d4f43c7eb246a7f16829a54e81b4739f62c3547a
SHA512 78a91f1ce2bee90cc992381ba532f8876255b39e34d1bdcf42bb7711fd1d02ff5d2f4f776cf0f864409f6e12b7a9a3b56e69bce9f49664c8d17674bcc9bba932
SSDEEP 24576:nZMMzFVSOrsqjnhMgeiCl7G0nehbGZpbD:nZMMzfzDmg27RnWGj
TLSH
T15D0501A9B39018F8EC67813EC965D90AD5B27C1A0B70C61F13A5366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 33b8d4c1f7f8a2cdd21ba87d78f53aeb15db08e379a36f6edc7bd1e64cb22bd0
MD5 bfc25584136cc9120f5e3ca68b156364
SHA1 ba1bc9cb0f5ba579b62a49aa53e97d9c8a22a199
SHA512 713562a09f1edef39eac6b7f72e0ea3573f9e933e907d802e5c0a4c61190b4addf280b77276f50c1a7d7f9942463c743eb80097bad9953c19ea489b9416dc421
SSDEEP 12288:SeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:SesqjnhMgeiCl7G0nehbGZpbD
TLSH
T145C423BE924C01CBE52645B5C3E5F15DAC073E5BE9200493BA9B78BEF7B14584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 f9dc4eda09fba494b86fc6af42869e0266a8cc5a9cfae189af75d96c8aa9907b
MD5 446f00929823a51c203e6f32f1aef461
SHA1 404ce8b33faa9017c35abe7ce6a8f61b9033392f
SHA512 5c39f7ccbb25bdeaad48540574b86c44082fa62ec08cf98e11e03ef4edeb309472d5c2416ea1bdd15a62c69e46a75e8a6afd4c1926a1824ebf01b1c54d048d60
SSDEEP 12288:EKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:EKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A9C423BE924C01CBE92645B5C3E5F15DAC073E6BE9200493BA5B78BEF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 a831b484009389350b90aad99c86a46bf3cebdab7eedfebfe9d7c115d0758013
MD5 8aa372dd51cff5f5f954bd322ba19b9a
SHA1 f2c23a7445cee9336910136fe4be7d17adc1acc5
SHA512 5c5b87264207b74cb7d1c9c03faecbc17b832443f8c6cef595ae04bf953adcae299a43973a0bcc5e9276f76ef23b84d9545cf7a6281312134f31caaa8b9fa2a4
SSDEEP 12288:dyPz5L8HXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UzyHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D2F4025B73A530F9D1378138C5A29A06F7327C3647204AAF17A516BA6F736904E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 db1e2a40304c393ba443bc6017311aaa8cf0be914051fb2f4a71ea647019389f
MD5 c2031bd37874367c177747a32d586bbb
SHA1 d090a4c85f77c10cbdfae8177a58ce311afe2d12
SHA512 9280b4f3938d50c7b1b6313e802e3acfb58949f5057a090b108e3a5496387a8b12bf5670c08a84d8f9c03c7b725d93606a4d9bca249c7c8d00078520b99b84a0
SSDEEP 12288:6eXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6esqjnhMgeiCl7G0nehbGZpbD
TLSH
T19DC423BE924C01CBE52649B5C3E5F15DAC073E5BE9200493BA9B78BEF7B14584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 081f324354b92499bef48020584a5e32e8f992c503ef66e8eb4cc751acb24ec2
MD5 837b87990cdcff6bc8d630028bade2fc
SHA1 7984f0a3832ccd2161062bcb313b88c762bd3930
SHA512 204ea6c81819fab616d699a7d93cd6d7b9d6f5fe543a6123391bbd251f07ab15eb109de75d499a55980fb5270a4ca7204e11abac918c276065ee84a7d1ae21af
SSDEEP 12288:meXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mesqjnhMgeiCl7G0nehbGZpbD
TLSH
T123C423BE924C01CBE52645B5C3E5F15DAC073E5BE9200493BA5B78BEF7B14584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 b48cd5fe3bbde9f5ed1ef2f2f4f89d8efa99fb7c2ed017e5829702686cf29c80
MD5 ff69da34a42ebcf4ddd6f792697e3991
SHA1 3e5f19b26b90b61caa965968d2c76069f8088e25
SHA512 ebb889e946ebd9e84f02c459cb797af0a64e34e154b62f6c98cbbc3b0712f4713b48caf9f1e5ccf50aaa6d4b721fa3ef38755edfee7a240a26392908173d81c8
SSDEEP 12288:FyPz5L8HXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MzyHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18AF4025B73A530F9D1378138C5A29A06F7327C3647204AAF17A516BA6F736904E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 92454f873c39d1471925f4f64f4d0a6f68394a07bf50cd0833e9f1adf6010a00
MD5 2f9803c3a39cda8c8c8b93080a40f62b
SHA1 b877b27555578b625cf039767c2e50727599707f
SHA512 d5a9bc39ae8a6474763b9a1c7a27e7d7c606a51afd8962b8a6d77cd67f3584c1dfba1eb295437b93fb27e5ca1e7f6e732355c3b7b8b670af42b034d3bcf74e1c
SSDEEP 24576:/T9aLl3z0zDVsqjnhMgeiCl7G0nehbGZpbD:/TQLlj8Dmg27RnWGj
TLSH
T1C20501A9B39018F8EC67813EC965D90AD5B27C5A0B70C61F13A5366B5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 8ea58c58a8ba621b2b399a9b8f103d9c439a19955d6efce7ce4a623affa37f72
MD5 3d92f4d4a1cd5f8fabd976335af78a6e
SHA1 cb1d535051d0b74916814339509497a93ad8342e
SHA512 ac63ec6aa72c7b499b2dfb27ae5a3dd2f968babc8ba903d419f09d67d917460115444970da7bb79efe4d0b271aeabd225b1e3698fe9562f7e62b35c751226af3
SSDEEP 24576:o3td9CHKy7GZJsqjnhMgeiCl7G0nehbGZpbD:ytd9CHKyazDmg27RnWGj
TLSH
T1B125CF90F3E810E8F0B79A35C9769511D9767C5A5B30DE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 ec4c2de38a6b40a9ea3cc8365c05e19d96cbba55aa7508e01728657c9fc0f2ae
MD5 dd7bbe8de30229d426806937e43cfe55
SHA1 2b48e820e5a763c75b7bb56340b5d99c078242fe
SHA512 b50f5610f8e14caf0b4d9919a2e3015a7977990127eaa2701a75a7484ccb24f7173e66716471ee0f924c7f75d23d764f59899c81040ef468f616ac03e6a87312
SSDEEP 12288:plXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:plsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19BC423BE924C01CBE52649B5C3E5F14DAC073E5BE9200493BA9B78BEF7B14584B3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 eda4307ba33dbfc4a02d88cc9b03b7ab8171a49253c196d84a51e2750565431a
MD5 dc39a35058367f88ff0d7b70b571f021
SHA1 f9b9c9efdbf880a27053a81db8ab8c56ca5a17ab
SHA512 5241f33c65349701dc2fc415427551d80d315c864f32be130f061eb16eb319cbff03bdf75bc0d5258329ce5cf1fdf45bd6fbde25dc9fb4769e50163c783e1e46
SSDEEP 12288:xnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CFC423BE925C01CBE52644F5C3E9F14DAC073E5BE92004937A9B78BAF7B58584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 ae553ec2721ba327b4866095c74d6949f88fed7c84783a6e5c84aa4ac0ae399e
MD5 788eb2f85a1e1cdbbb4ad80771e8a5dc
SHA1 b2ce2c54a3616e65121bcb4d731892187f43a30a
SHA512 fa6dd4a268a810d9a0a5e765da87899f2fdd2752e41ae5a26304247dbe67c9e58e0e0ba08882cdd55cbee548e767c18624d6eb53317d92db37219e4bea2674ff
SSDEEP 12288:jYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T114C423BE924C01CBE52645B5C3E5F15DAC073E5BE9200493BA9B78BEF7B18584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 88d159df6710e0d80b26ad10b90821c047093adcc687a9473472488f4f138df3
MD5 596ef9bc0f567135d976eed0b591f014
SHA1 1b1521c2c54183208c46ffdf146b4863ba848bba
SHA512 1516370806e39c46ea3e8d86522356e032b7245c85e089e2c9fb827fe5df7c08a6346c9851a5665e674eb5df0c55df68dfd403156ea7b000e1db87801d3cf6ef
SSDEEP 12288:neXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BDC423BE924C01CBE52649B5C3E5F15DAC073E5BE9200493BA9B78BEF7B14584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 a0ce47fc3620ea2f9b55caefcab94033b927a6664fb5ecc454ab1da3e3239965
MD5 e9aad9fc0b445ec6e07ed53595c718dd
SHA1 b17b010266c68605e43ed2151aa04107cd47a595
SHA512 4ac75c6fbb4fae64e68506e8c6283b9db0cd2037720b0c4ad329e1fae82b4d89a011a6568019001c0ddc5e19b06e13be1e241a6caa0cc8480497cffe7f4c9ad5
SSDEEP 12288:zlXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zlsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C4C423BE924C01CBE52649B5C3E5F14DAC073E5BE9200493BA9B78BEF7B14584B3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 bedcb9e9773d96eca3119fe79137aa2e747d3c9dc695edcd25ddb29e8592000b
MD5 eec97ee10b63f82f3b8b9f12a7b3d949
SHA1 a8d6e044fee371c189461511511dad779b480ca7
SHA512 b25a1bdb47a84b4dd7e8f09584ef2f28fd65b8e58708ac7f9ca5619b5482cb6acc3d2f2635adf1f45b3796ee95b30d090c5398716904d707a36c0a2570a8a2f2
SSDEEP 24576:efwvok9RX6wkyAI6sqjnhMgeiCl7G0nehbGZpbD:KMnYIODmg27RnWGj
TLSH
T13E35DF29EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 a004fa42dbd8c1ccf092cd79d0e89ae53ee422e3433aaa76350e5fa023c682f8
MD5 53efa924aa3d1c576f8590786f1865e2
SHA1 4c731937766d3d979bc1e0b68fb3f96f664830d8
SHA512 70a1f758a29169fc6b878cb2cfc68c69900ab696062da6d101c33b83287701e298ba16186c6721a09f15f70a6d731bac77e1ab8f1685605265d6e4f759fc0794
SSDEEP 49152:TYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0VDmg27RnWGj:NySzPND527BWG
TLSH
T163066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 cde64922aabb496529200a606e173bd11c7d892ad70695f021bd2a15b2e4f237
MD5 c001370a3ccb25bda2f10520ec6f66bf
SHA1 c314056db0e4ffe89269e83946dc278c0122a9f7
SHA512 c8d22297c2982eb6c0cc72611a079bd0171df6f6bf43a6f466af2f8b6171bab57dedba347058fa03658737dd549b9fb513bdc7c3c063acec3c2ddee0725424cd
SSDEEP 24576:o47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYbsqjnhMgeiCl7G0nehbGZpbD:o47JUQj4irIhCnDHUPfF/FDmg27RnWGj
TLSH
T16065AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 58ccca07f24f100993af5ac3ea610d50c87a10b2591a26fd9f86d4a42de2d8cb
MD5 3808516fcfe44e91988aab77f39c46b0
SHA1 806bce30a8d909d760a33e09672b35b7583dedfd
SHA512 de985c05f8aa55f24d00577e47b2f674f0f5a8a0bbe1c6e224a6587d71d46e6bf5d3a72c81393cc49b7f5dfa6290a517e7f0ed02ea324a7445da78a2df827298
SSDEEP 12288:YGsfuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IusqjnhMgeiCl7G0nehbGZpbD
TLSH
T192E4015AD29802D8C06E6179C396D605F7233C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 803373ec6c23a9c7041e3d9e257ec628c9efa7ad3065b9e5d96e371757388498
MD5 3e8695a76cca6f602a8094866fe2dfed
SHA1 972ea715fb7a4e57998a0170c90be1e23afa30e0
SHA512 96a386eda617be2f1dfbbd23c33d7568ed63a32816b37f94130cb1ae3f51c220b77b9a32796b86a74a6015e421c25e8ea8ed4b401b7e4ef0d065e2ea68f3752a
SSDEEP 12288:vdgqkFU3fD1YaEJ/K2PIZnRM/YjJ536pX5GRp:vdgqsUPREJC2AZnRMgj/36pX5G
TLSH
T1053529107626DB4FC6A940322E36C6CCA7707D42FE499B0772C9873FC476659BAF5282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 5408917c11897f14485def7d7005128648065c2e5169d063d95c2b88c5b765a1
MD5 0b868dc5651679861dcebef72b7e7264
SHA1 4ae645bdbac2d1a2d43875e9752e4b978ee7c63b
SHA512 aef85c67ba220023341c745d114a09ff5ac51edcc545ef2e1098e2316ece028cc4b5bba798a6828ff938f343d66fa511ba2dad0c7029b98dbf356cca21a73c6f
SSDEEP 12288:vgPSmy94/ZE5ERr7AA0tH4k1W1RfyxMv/bIhshdEEnhJ6TUiA5kAedC1vNuosATj:vgPSmyuBGGXJy4k1W1VAUddM4T67uv
TLSH
T153753A019573EB4FC9BA50375336868CABB4AC02B7493F067385883EC86795EB5E53D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ipmUpdaterStart[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CF6EWZMM\ipmUpdaterStart[1].htm
Size 13B
SHA256 b633a587c652d02386c4f16f8c6f6aab7352d97f16367c3c40576214372dd628
MD5 c83301425b2ad1d496473a5ff3d9ecca
SHA1 941efb7368e46b27b937d34b07fc4d41da01b002
SHA512 83bafe4c888008afdd1b72c028c7f50dee651ca9e7d8e1b332e0bf3aa1315884155a1458a304f6e5c5627e714bf5a855a8b8d7db3f4eb2bb2789fe2f8f6a1d83
MD5 SHA1 SHA512

Submit Download

Tmp1227.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp1227.tmp
Size 5KB
SHA256 a86ac1b119a6653e0c3fc24c2c40e44a7bfdc435fd81c4442af9d5526ef64e85
MD5 5bc2d1f7a5fd950dd51547ead6afdabd
SHA1 90f4e48ac87f4eb9dd10f1a80d46a7063f06a7d2
SHA512 45f18bf24c7f1102c17dd30aa205498f27336259ac3869c1d6129609a40385e68d9a2f353e3b13f18f40e7d1d32c4fb31d10f7b2fa204e24e4411183bb749f55
SSDEEP 96:7sX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yQRlOelNMQtU:gULc8pq8RuwdmL4pUQrNyYlOefM/
TLSH
T13DC12AA388D46C05AD17BC04B4C49A23FEB2B2855EC1D1D36258C1A58B913973ADE6ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpBB96.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpBB96.tmp
Size 5KB
SHA256 b2e41f3d236f5418f702111b610f382663c8893d82d5284462d2133f0e0c0fdf
MD5 38c0245547bc1440fb56c7308c2bb222
SHA1 8ccf6f27b9644fad1c8f13d98e9d680154c8d572
SHA512 78da2e84d0ebb47faec6999320198da63e02f8653a0b0609a16675592ff26b2ecc8de6a3210c31e28b72d6ee340dcdd792207cba96e1ae92b72c07d1d9fec897
SSDEEP 96:HX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yJF46R:3ULc8pq8RuwdmL4pUQrNyH4o
TLSH
T14FC13BA388946C45EC27ED00B4C89A23EDF576591DC0D1C33248C2A58B923973BDE2EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpD673.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpD673.tmp
Size 5KB
SHA256 512146b59d21f56f01882290e8b1e93e0553b85435b4d31e4c51d3d9ccd14df5
MD5 8de699a7d8a071e752e129d70525fcc8
SHA1 da6fcbafb68dd579195ff775afcf64f4209ef52a
SHA512 43697eaa55d5b7ca68036110d2bd12e01f6fc45fc7e3d4baf99b1de506170707a4eb801d6460dfcdf491fd58bafa3c93b8aeb5e2b36435e5249a2d7fe6a30be5
SSDEEP 96:PX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yh54pD3D:fULc8pq8RuwdmL4pUQrNyh54pzD
TLSH
T1F8C12CA349907C45ED17ED00B4D8A923FDF2B6952DC1D0C36258C5A58B823973BDE5EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpDD3A.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpDD3A.tmp
Size 5KB
SHA256 e6bcbcb70401d63ff0746fcbcc63230269058736f7644151393edfdcec8b8765
MD5 1b7ade3253fc67477dea69ef2147603d
SHA1 b71e8e749a3461c9b37ff2c3d099b1911d9cc6a0
SHA512 0edd5eb1635b1599e50b368cb254c94bf1588acf1d063e89f45fcfd6fa625e33d2c7764d9d00afd53dec2dfb342e9cfe199d256edcff8430ae183d357d4382da
SSDEEP 96:7NLX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yGtDwwBq:RULc8pq8RuwdmL4pUQrNyGewBq
TLSH
T16CC12AB388D06C41AD5BBD11B4C89933ADB272992DC1D0D33258C6A58B913873BDE2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 05d139cf238f8e133ab407627455d81d03c28faa6e85392e28bea7d1a469ee62
MD5 578b3e5398641601c00ace07f3a2b60e
SHA1 6396d89d0d7ddbf64ba833340775780b0bea7c17
SHA512 43230a3d33795f4ebb70cd7a61dd2ae2c5733010333a25ca982cac89bb22b5617bcb4fd763e56c5931c38f9d28c9ec742d2235983857fa3b39a15a2defe8bb88
SSDEEP 12288:ZM7GXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:yGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11ED4237A934C118AF93A55B482EAE12D780B7E669F1044C3B94778FEF6B18C48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 ee2d4f4cbeeb9c0c695570b35a8c256be39c72abde8dced2b7719c541204194b
MD5 a0d8e6dceaa64ca24906e13866681bfd
SHA1 3bc055e3ee4ccbed5077fb853a6ac27bd8e48db1
SHA512 8ef52ece721e989542f4ae38c1955cd66dd4e9fd3da89d1745c96e485787c8e4ef27a5b657d067b0b583d9ef2bca29279d8e73c2b203fcabc9adf1e17bd4bb40
SSDEEP 24576:mgb6bmBIi49WNNFpg1rSvFv7bYAsqjnhMgeiCl7G0nehbGZpbD:mgb4mBIBhGFPDmg27RnWGj
TLSH
T1F4659E1E22EC02E5E0FAD2B8CDAA4417D6B278161731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 026a9d33568554c7502cc8ce41daa67c1de7c854518065685aba2251d9c41641
MD5 e823c8bcf49558179c0762e38fdd771e
SHA1 485bfa8b92d912111eaa51a582b32fb0b2c73571
SHA512 84cd5f38fb34b57d4128c1c984c30f5916bbaa58a142aab6d3280b1bbd13bf120ec101e2e0166b81bbbd208835319c28d3fc0389e6bd05328fc4cb0fb40334b0
SSDEEP 24576:jG88u8FpJqH1Wzria7/mrsqjnhMgeiCl7G0nehbGZpbD:S7ZFPqVha7/kDmg27RnWGj
TLSH
T12E35F16577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 232b2d393c5d1b28657b9ab8a3fbc36727b04e8b27b1dbff35d427abac9ea185
MD5 31f78d34b7fb0db4deb3ee165abee5a8
SHA1 95b85cea7ad7b495082a4d0a63b92f8f181eb780
SHA512 a509fbd40f930700d5b6361432be4bdcce45498c06b2fee6d14fa5421303271f9637f5176c8e066e805c2f166e5b483b5120e9380b209ba6adb90cfafc90f4db
SSDEEP 49152:0BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjDDmg27RnWGj:XG05lO43bWD527BWG
TLSH
T188D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 48b330bf42af26b67f32b350e48ef88012c6cc0821738d449b5f5f684222cf77
MD5 856d2866997510110b9f93f583c1689e
SHA1 0dabd00f5efbc9daf814d5e688488e5761b548a0
SHA512 a7362fb6346086559c700ba46f11e8e3480b2d7f3b8ddf084babdc3f617d8edc916434949d617248e52e7e045198433126e34c2ba579d9bba6722e2fa449fea0
SSDEEP 24576:sfa5POZ3dpqWVM50JicR2hG0lasx2+47eidnBsqjnhMgeiCl7G0nehbGZpbD:0a5POZ39Jt2pasx2+m7Dmg27RnWGj
TLSH
T1C865BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 af84614b354d65a1273cffa9fc24a093ae9ee4c7c0d89966ae3403d3dd822716
MD5 4cc31016b8855f8f6fd90089b733ccd6
SHA1 30b1e51b0e851c0c2b7147b4656572b5b355a5b3
SHA512 c5f726a42f81200d896bc8c550b76674cd36fab83308d38adce8b09a6f10525efb4ac36f6dcbfe294ab7b7c3d663c8f43a51545eca3a5b8c3da2f4f3683bcb85
SSDEEP 24576:PNcwHdjbyQ4nLC18lb/EOjowL7FkzsqjnhMgeiCl7G0nehbGZpbD:PNc/zEOVHFEDmg27RnWGj
TLSH
T127857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 914B
SHA256 4526cba1d2424fbbc51568407bb3db45d8a37f2a91e049951700a4b88f38371d
MD5 204418faaacbe05ed45e01a24aabf59e
SHA1 60dd43b71365cf05d1d92b0c0b75a9bd0e5db5f1
SHA512 46577a21b3eeab82697a6bd36c526664167d1a79056f651b39efb31e3dbd6e7bc86bb7019cf8f12abeebc2917c667731cead44695455562bd9bc2cfc9d9581fb
TLSH
T1AF11794B22E54204F0B31F62EBFD80B353333C95AD19817D80D4030A49E1A06A473BB3
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 1KB
SHA256 2aa772897ccaa5678880d29466fe9fed070e1e09056fb67366c1d1ad20906bd1
MD5 f60df6721919b019b62f438cb42d0504
SHA1 214e09b9ad60e52d0579b42950555d1755d29d2e
SHA512 ce350b48211f02d80517aa4d6fffd3484b83d0bb0367b8547ffd2e6fc70c1292443ebf081d7412e5c814a12c25c3b333df6ea67a98f1404035231a129b3943b8
TLSH
T1AB118B832AE91024F4B35F92DBFD84B257337CE21D2DC86D80E4020E4AE0A85A5727B7
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 1KB
SHA256 f136b87cc45d7d5d41939213f21b2470ebf6cf41251380ea0ff8e192df475399
MD5 3690260f57fd532c6040517f05479ecb
SHA1 479247b2a47265eb6fbfa49491c0765ce8a3471b
SHA512 0318bab22ecd658aefed70a1657234c6d4ffea04022d02b77fc3f2c6171930a720e995e58301a7fab03948772bd9ccb37207aee3c3016d59e6220827d2a9278d
TLSH
T17331AE872AE90160F4B35F55EEBC94B25B323CE21D19D46C80D4124E4EF1B85E5B27B7
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Windows\Temp\ArmUI.ini
Size 233KB
SHA256 76362509a8ca3e4a9fdc854c56674083ef77ca2c53628ce0acf4bb4c42d73894
MD5 b0df20baa9dee27bdbc3285c7d6d4c57
SHA1 443fe739e4c5a2ab4ece3eaff0179e7b1deba639
SHA512 0da5976d3096f598d0bec4a2c4e64f708d02a6376bd87e460744f5054d2b6e1b710e655831c287d7e672f73a3db846b19ff054270c3ce41fa02b61ecb5e31fab
SSDEEP 3072:03IJ8zcVOWmxltum8PMkufNWwhEIrKNCpNugYW+lCIr0YxbFKRWSp4Vf37FbAjG/:ByJvW
TLSH
T132342A5667FD1209F6F37F41EEB852944B7B7DA2BE3AC14D1680014E08B5A90DA72B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d78b21cb259036228a5c7079b6aa556a9b7687bab3ca5234dfb1e0347d4a7d28
MD5 53f8845170009524090b2a9d4852b28e
SHA1 837c3d9e752f2f469b2f48c6d5b13f9e94df4cdf
SHA512 3893a2e605f7a7a12b089be85bc669f37b0b0b7ae4c0519524c259f1d9b4d957042066b18372803ebeac46498a15b4f479de06261930ea052b7398760fd020dc
SSDEEP 24576:GtkNvNnaFeYhJNtmZBmNsqjnhMgeiCl7G0nehbGZpbD:GtMwBtOmxDmg27RnWGj
TLSH
T1A155AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 65f1bbd07471b97e461dfe4512ec7da1f169579c19c9075213bc95032f197343
MD5 1be9c5c67b3e490ce9a0a52b570f4f12
SHA1 ea53a52a6fbd4d940f18b6487ac653d43fe85b20
SHA512 296c231beb676aed3d41fa94626c370f11718612c0c2ab007a9a20349040a2b29ccd3a0cffdd1d2fca13280ba4dafbad93bb973e5014e3806b9e96c7d93ded36
SSDEEP 12288:rHvUrBFrEjwaQPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:rPUr+NQPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15C05F12F62AC18E5E676E17D8682C70DF6727862071192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 09d368270358c174cc6bd45c9918d4d28e0c8f635b61a69c64bcd887f239044c
MD5 5377a73b4fca018d3d5bf2d26624884d
SHA1 29b3d825027c43de7a4f55aa0607036b4f97e248
SHA512 3f043bdbac8b74334259a4f45c0ad09f989482042855e47549bed5ea3aad1611bdfe0fcbcb4ca1cee30b2843d7b7b18d51635eb03c9955a5c158402774cde6db
SSDEEP 24576:KD3FHshBIYQgACsqjnhMgeiCl7G0nehbGZpbD:KDVHeBIAAGDmg27RnWGj
TLSH
T12225E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/964-397-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/964-393-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/964-190-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/964-183-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/964-395-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/964-184-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1240-696-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/1240-544-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/1240-588-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/1800-374-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1800-147-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1800-149-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1800-155-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2088-170-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2088-585-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2088-177-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2088-587-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2088-171-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2088-392-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2548-224-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2548-110-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2548-118-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2548-109-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2636-219-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2636-217-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2636-215-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2636-208-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2636-209-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3496-226-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3496-225-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3496-232-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3496-398-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4592-103-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4592-97-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4592-96-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4592-182-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4592-104-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4636-6-0x0000000002660000-0x00000000026C7000-memory.dmp

Download

memory/4636-1-0x0000000002660000-0x00000000026C7000-memory.dmp

Download

memory/4636-169-0x0000000000400000-0x000000000060F000-memory.dmp

Download

memory/4636-7-0x0000000002660000-0x00000000026C7000-memory.dmp

Download

memory/4636-0-0x0000000000400000-0x000000000060F000-memory.dmp

Download

memory/4636-644-0x0000000000400000-0x000000000060F000-memory.dmp

Download

memory/4872-133-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4872-131-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4872-128-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4872-121-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4872-122-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5044-137-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5044-136-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5044-143-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5044-355-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5200-394-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5200-202-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5200-203-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/5200-196-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/5888-390-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5888-159-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5888-165-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/5888-160-0x00000000008B0000-0x0000000000917000-memory.dmp

Download