aa2a41d3380c9a7b6a87a87c2b37d813b19e93f787a3af2b79bbfe434a0a17c2

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 17:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Size 11.6MB
Sample260930-v3klyaeb24
SHA256 aa2a41d3380c9a7b6a87a87c2b37d813b19e93f787a3af2b79bbfe434a0a17c2
MD5 ad4dbf7acdf24abf9b1ad1d8088e3159
SHA1 b4593336a1c5e3309169fca95c7454421e80d9dc
SHA512 3ac420b398c802247d88204ee29a9195efb115a506b9f3dc94f5a965ffdc8926847eed59e02f17c9c6f8281649700c483b14de8ca0858cd90b2b626896ac7bbc
SSDEEP 196608:7HrB4gAtGisca+HNSSJcQGp90noYHwoQd9f2O2OKpxi8kzjTp7N0v:7HGTtfk+HMSJcQGp98i/2Di8kjR6
TLSH
T197C6D051BA02E0ABD19506784C179FAB9D3B3ED243109BC3ED9C7BED88625C612EF705
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1056	elevation_service.exe
4960	elevation_service.exe
1764	maintenanceservice.exe
4648	OSE.EXE
4676	PerceptionSimulationService.exe
4876	perfhost.exe
704	ReFsDedupSvc.exe
2352	SensorDataService.exe
3192	ssh-agent.exe
3444	AgentService.exe
3356	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9ec5852725f2ba71.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105218\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000782a0cc40151dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000d0d16880151dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000097fff870151dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c385c08b0151dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000811113c40151dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009efaa5c40151dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
4336	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
4336	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
1056	elevation_service.exe
1056	elevation_service.exe
1056	elevation_service.exe
1056	elevation_service.exe
1056	elevation_service.exe
1056	elevation_service.exe
1056	elevation_service.exe
4960	elevation_service.exe
4960	elevation_service.exe
4960	elevation_service.exe
4960	elevation_service.exe
4960	elevation_service.exe
4960	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4336	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Token: SeBackupPrivilege	704	ReFsDedupSvc.exe
Token: SeRestorePrivilege	704	ReFsDedupSvc.exe
Token: SeBackupPrivilege	704	ReFsDedupSvc.exe
Token: SeRestorePrivilege	704	ReFsDedupSvc.exe
Token: SeBackupPrivilege	704	ReFsDedupSvc.exe
Token: SeRestorePrivilege	704	ReFsDedupSvc.exe
Token: SeBackupPrivilege	704	ReFsDedupSvc.exe
Token: SeRestorePrivilege	704	ReFsDedupSvc.exe
Token: SeBackupPrivilege	704	ReFsDedupSvc.exe
Token: SeRestorePrivilege	704	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3444	AgentService.exe
Token: 33	3356	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3356	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3356	SearchIndexer.exe
Token: SeDebugPrivilege	1056	elevation_service.exe
Token: SeDebugPrivilege	4960	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3356 wrote to memory of 5904	3356	SearchIndexer.exe	102
PID 3356 wrote to memory of 5328	3356	SearchIndexer.exe	103
PID 3356 wrote to memory of 2396	3356	SearchIndexer.exe	105
PID 3356 wrote to memory of 3212	3356	SearchIndexer.exe	106
PID 3356 wrote to memory of 2604	3356	SearchIndexer.exe	107
PID 3356 wrote to memory of 360	3356	SearchIndexer.exe	108
PID 3356 wrote to memory of 996	3356	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4336

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1056

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4960

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1764

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4648

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4676

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4876

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:704

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2352

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3192

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3444

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3356
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5904
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2251218687-1689653882-3767565116-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2251218687-1689653882-3767565116-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5328
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 2996 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2396
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3212
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2604
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 2996 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:360
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9fcc8b7b17156a40e5612a653b788069974b2528f479a2ae457fa4bb960e7414
MD5 ce260783d999aaa20dad648b5e832207
SHA1 60eb18265b9e51ea64166634e830a5f4e56951a7
SHA512 8aed8070a62b57ed42c97fc0c5edc6c0fdd75201ae5a6817de2376197dd0d3adb098f22504b351279bb27f3a819c4edcb90110f447e640818fa28de1c6ee22c5
SSDEEP 49152:Db+632BuPkFKRrdE6ohvstBhuXjfS4LWxnM2LlOpbeZB7m:h3q6sjBlycv
TLSH
T156D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 b729807f1172b2c019cf0a164879fc3941a9e518b0bc71d9dd1f882ffbed8116
MD5 10b5353ec97bff068507765cde5388b2
SHA1 6456385cfa65ed2f1d19d4168419cd04ad74ffa1
SHA512 de76332272181d37e6072dc359f57bf0ab055a0e8a71e83c449ea96976cb7c832abd1ef8f7f71915834f7917bce6d196e1c2f9c1a1e9768a680ae0aae5344dd8
SSDEEP 24576:ZXYfDtczAJ22C9+bmOmbTk3reZCIT59z7m:ctcC2LlOpbeZB7m
TLSH
T1A875026467D408F9DC6B823CC9A28411E633BC9587A0E7DB03E489661F737D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 02e301a869bea629c6aab8ffe2de087e3d31d0f468e19270dfaa8828a1c02b79
MD5 dec9d496959d4e0cc5b5836db55d653c
SHA1 25b7ad3176eff874dc1079e39b124d14235ecb66
SHA512 570c2248165099b97214c94638853ca8efd420eac540ca680d4febc119e8573a790da50e1fdd1728a8162089cc04e67126e5029ca2c35df8afc6e9a4f0ef8519
SSDEEP 24576:b0Le5ji0hmxxrM022C9+bmOmbTk3reZCIT59z7m:bPji0Ajr2LlOpbeZB7m
TLSH
T13495AE56F6748371D073C0B9C5D2A69EE97130865B308ACB4286C77C3E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 eadc3f10b2b94c1b8de909c4996ba6c7c8c1e14703e95af1cdf0a8a29a625909
MD5 5016f0cd90ec76e851b7ff4c46ba6417
SHA1 38611dcca4fed6993c79c5af7402df93f4d7818a
SHA512 94603856c73fb88f4a037c4e968f5a392b3af0c808e9a92a172e26a3f7afe96f9022a28e5831a06ff2f349d23e8e9e2eb0b272744f9587a218fc187eb3cc0404
SSDEEP 24576:Qa7/ezSC6vUyD/aqgrvWn6q8wyuy22C9+bmOmbTk3reZCIT59z7m:H/ezSC6vUzPveHjyf2LlOpbeZB7m
TLSH
T199755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9bc25915544ec1056639961be7e2ed256b73b5b013d31770b09e1e61de5e4176
MD5 4ff6665f6b26532fda1289c78c81ea3d
SHA1 4385cb6b618275c152faa22304d9a52a22e1187b
SHA512 970e32aee0ad8b760673471c91e935a67bc387e2d3df7bc700f01151eced4c8bf83852bcfb1cb92672657b2c68505b879aae5c4bbb23849667befa782366a418
SSDEEP 24576:1VbqPb88hv/l+YV22C9+bmOmbTk3reZCIT59z7m:1VO88hXl+K2LlOpbeZB7m
TLSH
T1AA559E66F6B48331D073C0B9C5D2AA9AEE3234415B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 778b2ffd773888f05f67cc105d7ecef8034386609f6e0b621ec6aab11c92d773
MD5 4347fea8f23a6530428c23b2cf966d72
SHA1 20458288fcdbd95cb3500f35e97674436ed4010e
SHA512 dd9631bb8cd682928da6bc35b6767660e7b64b5461f79d9b1a39fce3f677337a5a2020778c4b9342e666bddd1b362d31757203efc55afde9f077a0613bc128b9
SSDEEP 12288:lLw22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:lLw22C9+bmOmbTk3reZCIT59z7m
TLSH
T1065523C18FD9C4FAC27F1230569164E56635EED8DDC6B15B82891ECF18F5AF8D04A20B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 51220c44a2a4d2daebbf430a36fee8d9c0ed0e81d1f3a0843898c294662a2a38
MD5 4a2ebfade659fdb87b03af82c1af5690
SHA1 56bcfc1c997b5b3500230c5acf5ef721ac51dbcb
SHA512 53ee379ce201f0bbac864bc2b575dc19165360b838282bbc9f016b0d070a2f251244f8cac0b0ed6144cb5a334659a9dd2837333332d1dc58ac90603159f00f78
SSDEEP 12288:GeBNUbTVO86Ud22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:GJIUd22C9+bmOmbTk3reZCIT59z7m
TLSH
T10675CF7BEE28FCE2C27E4D7857918640E772B8708F52A3CBD165820E9E235E05D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8ff4866b47470826927621cae8c502e67241b6390fcf72c17da9dcd13f9c091d
MD5 104cae6888ab36680c0013637ca18584
SHA1 e29a1137ee16e18d285736b4515a9d309b7f5ff0
SHA512 8d28188ab247ad729124f285e40253b08c0dc09430908b97b488937c65122d168321cd0c783bb3145efcacf024abf951af6089283f0fcc508c1178ebaef45078
SSDEEP 49152:ZQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH7:ZQvGAdlCEL8c/DRNw5Ciycv
TLSH
T1CD266C656BF880F5E0A7E134897AC5B2F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 7698c7832ca20ed65965459672d18539cae8b01808db231951aa50111f82486a
MD5 7e0decdb08d5b007b633549c485e5bd3
SHA1 55731b499d7a01e0cdec04dfa6ccfb7dfa8bfa3b
SHA512 9f60f90225ea7bf37584685e18dd5ad56ae283208fea46c0099847877fce51034b98fef17f313943f439a1d87810590a787c4ccb10ffb746a8b25f6a106c14ed
SSDEEP 24576:H0ewsAjb22C9+bmOmbTk3reZCIT59z7m:Uljb2LlOpbeZB7m
TLSH
T19D85E071FE74D436C2BF0DB11B26D716143DBA604F922AC3E3A84E8E59702D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 618143119de8e2a2d1a298ab40c7e5c4dbf1705e070491970d56c123665652a9
MD5 0f13c51692c525d93f00394657d6e3f1
SHA1 08786593a911425d0ee4b66ae9a0dd5666b4622a
SHA512 1fcbfb960ccab484b2a3120c74a5f7017e58f5161a5cbef5899e9f1bdb738e2f3456d5988fde764262b15b3f1071112ac0de484ea6d80879362bac824cc5e305
SSDEEP 196608:zUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHFv:zUEtQevvqc2W1cpV2tI32F
TLSH
T1BB474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 70260bacbf5078c97c930c0a1effea0a9b5e1f841eea083c9e6caca2dd414b49
MD5 7b8f210299a2e92c4b2fcc5705912a64
SHA1 80b7a3187d1022a0f3a0279d6f9dab0a09306f24
SHA512 77a620359388bf768436e98f9cd53bea4e7ff9774e7077122f053682c6859df2d7d28151662e524104cd908d1fd69a5ae534251566946a5e9375992ce3e389f4
SSDEEP 49152:QCbRquA/m2yL5zTfFiV+XenmE3/z72LlOpbeZB7m:5oquVjnmGycv
TLSH
T127D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3c3a6f2085b648c165128b90295e0a0b0eef9ddcfc9c791eb647593f02e6b9fc
MD5 da8deed05ebea6353469294ea4664808
SHA1 ee6a05cc90f97266003ba66f6cd514356c76c541
SHA512 a278141b15e63eb7c9efda803e826a4753a27a4c5ad2d2d5fe1767803e6fc253de567506a151d264d4d9c22273d3cc492a16f711ee5bb7880d3a00680817f39f
SSDEEP 24576:WAhGL3IFoiwtA5l7S53m22C9+bmOmbTk3reZCIT59z7m:WAMUFoiq522LlOpbeZB7m
TLSH
T11B35AD81EBF945D4F5B7AA7899B69170EA76BCAA5E31C20F2150C10F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 eff42314e8aac59cb4b47d9b1fd9ce5d566c58a0896314c45229741e5e8789d6
MD5 856b47ce4fef599a7ebc0b808cae61f6
SHA1 524d96738fe2e69ae58a8755cb2ffa4525a280c6
SHA512 3963f564ff7e9723f45517d9f2b0f8e4376d48f27852871e55edcbc24620a8481f6f6a24e11fc7706b966b5ad59f2714bd51932e62671dbb8d6ac6d793b20c01
SSDEEP 12288:gmw5HEjsChNVBFgl0WDm+CS22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+114:9wu4OW/22C9+bmOmbTk3reZCIT59z7m
TLSH
T1C475F18677E90CF9E96B823885578136F7B2BC152A61D71F0360CA5B2F73361AD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 5fab3dcc1ef58dbb0da62c3cd8745c5fb374ef7f855fa5e8fa546591ca9b7d72
MD5 83dfc3cfcfb59434d100f2915a63d543
SHA1 4146e2fe34aceae261ef5f9b1c92e55a1282ff7f
SHA512 a21d55a5e7ab5647edc586ae8466eecd636b5e7ad65ac8f58ef532055ad6d0e55d30147e62c043496f6ce7cbadcd82ee92f97821239eafaf2ca427e6c9cee0b8
SSDEEP 12288:peZ1IyL22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:MZu822C9+bmOmbTk3reZCIT59z7m
TLSH
T16B6512C627E860F9C1BB4238C9E15545E372B8A5ABB253CF02540A9A1F73FD59D39323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f2fe8200f47f9ae11d32ecb39c82f64f87cf9c00380c5492986ec5d69617b34a
MD5 757eff2964cc50b179104b7d0a2e8c26
SHA1 b14283b051ba59791b9da515d44b56d8b1ccc35b
SHA512 a98f645ffe3bf19878d2785710d5d05945129fabcef849515ddf728925ba8c3fb036cf7a381978cb46292c62fa26f10c0768c256baf96a711f2794ab3a4a6abe
SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Un:WQRQyi36YOcPbLvw2gAf+PN3Rycv
TLSH
T1E6667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 bd05f0e6932af71249e36441438dee43585630466ca968dd32a8352a246d3d0a
MD5 a69c9440ada90a0a7e08f8bef10fbad7
SHA1 d6e1f6acd9fd5a8dbf56e2e6db1ace11fe4cb553
SHA512 ecc1d6a54a48e13c7f161566f73da6d30dd112f9f2542a0681f05344ac880ef1d3b4d525cf4d2f8917980cf3290dccdfcd3fda4c242791febd9e0d2b292b6d41
SSDEEP 49152:zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Un:iQRQyi36YOcPbLvw2gAf+PN3Rycv
TLSH
T10B667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 bf3e02dd94dc259721fbf49d4c70fefab13d29770765d759748d1ca0e9aea9e3
MD5 ff87eab4158d06f8934fd878cad92b8c
SHA1 661c121002d867d1c49f3511c6895492eb5798f4
SHA512 67e1302c2d952f2848566c78ae753d99ca11fc6dba0bb7b821046f48768880441e9dbd2c5f454edc7882405d3401fbd8735106d32bd89c5e48d46d1b27d82f56
SSDEEP 24576:uwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0M22C9+bmOmbTk3p:Y68Qg55nhceWu7PNU3/r2LlOpbeZB7m
TLSH
T18FB54933B2F600A9C44DE1769F46973196D27C758FE1E3DB8105720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f1effc7455e58bc28581b2c047a9598d809b024f9a23f846dd82dd78479a70b9
MD5 530da9fbef7c3b8d8ad8398da1e67dad
SHA1 ffeb0298687498a4e45b752ddeabb0f7a0c8f100
SHA512 ff4c15142eab82a1c4f78594a7f17ac3efb7a788cf2595cb88c07544e2fc130522c1763a458f16e05dfc3c0ffc6e09bd2c615096f3497650573374fb277c485c
SSDEEP 49152:73aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99p:ey5112gYy5azzVvt69nLKnhZwycv
TLSH
T1D8167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 620c599577cefbf9dc84e4ffa42e7add9badab3d4c3f707fe100e32a7d7f54cd
MD5 8187f783da072fa77e8aac1b3a97d7c6
SHA1 39230e30fe7fe97f969761de2f438109861eeb98
SHA512 a62fcb05c456cb103b095da66bfdbcb2a42bdcae8d3f6778b9e16199c4f797cbb1953c6ab47db964ae82f8be173d57d21c917bbac7100d51771df199331e6220
SSDEEP 49152:aB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glZ2LlOpbeZB7m:Iu6Jmdxd2dZycv
TLSH
T17FD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 fdac73523f549f5dadacf79f4d07209be64fa1d1f231f2a472ce3e30f0a659e4
MD5 bcfa344797b17f97a61dc816ed38eabf
SHA1 bd5fe6d2ce013dffa15c5110372dbcf7207f955f
SHA512 a7a2c947aeb8fa7a3d9219157f261112b4cf51d4ff8fc00056c3368799ac579a899ba32ac443485e784e0e2ea4fd897f260d64568a0d9150684393c0b2243691
SSDEEP 49152:+1hpsNoJpF1A63U44CwH7R4x92LlOpbeZB7m:+mifPWRGycv
TLSH
T1CFB5BE13F2D900E8D06ED17887569232EA62BC460B35B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 73aeb1c56aa3c835129dcc01df98c3a617eb79356f3815b8eb07b3861b9e5113
MD5 423d42ecc1d0f45ee6e3ca0c46d7bb1a
SHA1 b75733216f445400550441d580ccdb8f78029781
SHA512 88a4867d65e5866d8315d12e392f4d9210cbc00b69e5c386f3ebabedda55fc3b04dc1db3657bef12854ed2a4bec466e97bb02dc58ee91ae184cf0d8fbad4fe2a
SSDEEP 49152:nSuZQIY0Be2KcRVtOnks6NMHq82LlOpbeZB7m:95dKii618ycv
TLSH
T11AC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a5794fcd2b70e64abfb5696d08dbb9aa116f50e37f6f0561e7b3281db9343573
MD5 a4d3f253333c4b1ed945a62ac5a88c3b
SHA1 b4a97458b77387d12e3723e6634e45013d241185
SHA512 4d8238e8a6c0069d11acd3690d6beed5ef2c49b0340db43be4edb04273c3ff63c037f6e2d2adf5bc721a0f3d8cbc0454020047a92d6673fc5c52a4a317d68d58
SSDEEP 49152:ohtSn8EApI0fig3giDn0AP5wJ2LlOpbeZB7m:5X2imph6ycv
TLSH
T12E95BE13F2D900E8D06ED178C7568632EA62BC150B35B6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 ac831bcf412e0b42f1fcc118bdc0c126bb9868ca96876ee967ea857b9c5960f7
MD5 faef11ccd3622f9403f390a2a4691e77
SHA1 0200e89dcc4957f865cf8b57be9757e3337c4ff5
SHA512 654378de7ed2fee37bf973cc83cdfd634a739dcd41f6d5f5a636e621e11b61076aa16493d2284f66d8fafa21b7ab048f24e2bfdfd70fb40611f3e5fb17d832e2
SSDEEP 12288:VY22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:VY22C9+bmOmbTk3reZCIT59z7m
TLSH
T1495523C18FDEC9FAC13E5230865120E56529EEDDFEC7619B428D0D4B2AF1BF8A04914E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 a9b02476575ea02db8d2bca2e56604b3e69ab24a5cc310cfe5a7771153739cdd
MD5 5f5e04baf69cd5223a2cb2cb6b47c495
SHA1 0a8494652225a50e0a18aaea3a5efc98ad2a0863
SHA512 1c3f30e69ebc0d9368fdb1614c81818a7d50788a6c0bc2385034464ffeac05c536012f3212f7c97e8c9d8cfa4c3ced66e913a304626023d95ee72111687eb59e
SSDEEP 12288:l322qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:l322C9+bmOmbTk3reZCIT59z7m
TLSH
T16B5523C18FDEC9FAC13E5230465120E56529EEDDFEC7619B828D0C4B2AF1BF8A40954E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 dac5cb16f56504e5bb9ca439bc6efc4dbfc58c180a61a5823cd319fea2e4cb00
MD5 d61fc5a6255977be4bd5743a75729cf6
SHA1 e2fd44847083ebd48568ebdf78b974cb8e567fe7
SHA512 7282de50903afce46d13fcf5169e91ebd034cd02d1d669fefc082599d0c39e70195c078325c4333ef884d98dfd372c5002a68312779d578db0122ecda13b6da0
SSDEEP 12288:Gl22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:Gl22C9+bmOmbTk3reZCIT59z7m
TLSH
T1955523C18FDEC9FAC17E5230465120E56529EEDDFEC7619B828E0C4B2AF1BF8944914E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 9bc543ad1d784f556bc9c436a89155b45970a13e6efce97a0025316972a42fa7
MD5 4d8e65cf735bdc36e5492bbeef9f035b
SHA1 c8c4e15190710c20a1b676e4a58b2c6140155127
SHA512 e83f0974547d04ee7ce95b17e3a0900703eb82ddfcf77dfc29740152caafa775ece72ed6e4487dbf4617cfb408ebd5262221ba960a9b2eb68e36f8da0abb1940
SSDEEP 12288:jVG22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:022C9+bmOmbTk3reZCIT59z7m
TLSH
T14B5523C15FEA80F6C47E9234C56150A1A275FDD8EFE362DF82450D4B1EF17E4A828B4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 6c2430c3fe04510f617a860353d622378bd6101bff026cb846d98602b27d69f3
MD5 1bce8542965f088a9303326ae6da985d
SHA1 2bad453a855c55537672b304d2c040c35a514119
SHA512 4ab45a0033b47946b9579321e2aeed7b41b6bcd0ff06515f2b940474696ad07d532876d51145644168bbe0abe847a915c6fa455eb5f25e347125ff0697f166d3
SSDEEP 12288:se22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:se22C9+bmOmbTk3reZCIT59z7m
TLSH
T12C5523C18FDEC5FAC17E5230465120E56529EEDDFEC7619B828E0C4B2AF1BF8944914E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 3cb81c764a62af7656cc5df0737e935b659266dc57b95768ce803d115695ac80
MD5 9afcdb002194629d64cf74061c2564fb
SHA1 09678ca5235462d4ea1eaaadce67242f49bc66df
SHA512 fb8edb9930916bf0ee706ce8238ed054fa54e84fbaae02107d4e5bc94dc56289256c397376ed0d3833a355f3c8132095d6c9404d7098eb5275bc0907a51524d4
SSDEEP 12288:6j22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:6j22C9+bmOmbTk3reZCIT59z7m
TLSH
T1545523C18FDEC9FAC13E5230465120E56529EEDDFEC7619B828E0D4B26F1BF8A40954E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 73c09c4b204d0489a81188f07eca7b7b530eb4677f51762693032d8951b5277e
MD5 f315a7ab5000a9c363af018f5072afe7
SHA1 21832a4b963522805bb5a123b7c77f5fbb678ccc
SHA512 7b525af2fdf205fb0a633c8d335456697aac10b97a152c9717620f051e19939e0fcbb6e9c77ad2edf01c46d01bb29fc89d936c228f74dc23ca765af0cc717422
SSDEEP 12288:3P22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:3P22C9+bmOmbTk3reZCIT59z7m
TLSH
T1B65523C18FDEC9FAC13E4230465160F56529EEDDEEC7619B828E0D4B26F1BF8A40954E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 ae93713a255e5b9ff8076b8810e1f90ab5f73b4cc2ec37552d400f2bcd65a0dc
MD5 2609e8a5a9b996a218dba0591b8b5170
SHA1 5b1226a9a8a3ff7565d1104122e17e36cc758cd5
SHA512 e955ac0b9a119557a1a92447e3371d423eb2e43e353da3b9bea3a50a09bd22990e8d6638bdebc2ac12d30bcc569614c19275182835261ff14c3049d0ef1b5b6e
SSDEEP 24576:TZMRzFVSOX22C9+bmOmbTk3reZCIT59z7m:TZMRzfT2LlOpbeZB7m
TLSH
T1997502D5B39008F8DC7B813DC9514855D6B2BC594BA0C65F03E83A6B1F733A15C2EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 5d0b00104ffcbd546d0d8cc095f0491f5be8bff797c7b96785a8195a28653281
MD5 34c1dc804eb6b07dc49b758386ddd65b
SHA1 bcde8f9a39bf3b2354909440bc88efaa9e4facb5
SHA512 ec0aa3e38f38a8aa634f66d01db512733c733e906df66545ed366cffbde306f9adb8f06798e4ca5e92f404e0e1659ed4036dd7245aa7f074c34bff21e93b864b
SSDEEP 12288:+s22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:+s22C9+bmOmbTk3reZCIT59z7m
TLSH
T12D5523C18FDEC9FAC17E0234465160E56529EEDDFEC7619B828E0D4B2AF1BF8940914E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 6dd1af113be2d65555b4bb9687fda9e9054cc6945425e21cc2d79d2250db3bd3
MD5 0ceb592485c66a80cc37c323839a67ab
SHA1 25b754e34a08cfe528e5fe7b6748c0c7421d07b8
SHA512 07195ed992162ea0ecab25ee3d207aae9b4df08a25acad3b5a974820861333826f79f9c42ef39692667cbbb7d0f44825d7012843d04e62d31f755194d41de8b1
SSDEEP 12288:zg22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:zg22C9+bmOmbTk3reZCIT59z7m
TLSH
T17D5523C18FDEC9FAC13E4230465120E56529EEDDFEC7619B828E0D4B26F1BF8A40954E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 3b1a06a6271f728b1e030e2760b61e847c061a1699d622cf81a4a974a4ea73ec
MD5 557ee9acd5f4f54cd37cd7015f4b1a59
SHA1 2e41f1b86570f1f594acfacb930a249c71f26cc1
SHA512 80b6d929ef5c14845840692217479582dde751923adc432c778e15b3ea3a890a81e0bcda3f4ea53c353cbff698112359f36412dd26330cae9a77c7f5bd696ef2
SSDEEP 12288:jyPz5L8L22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:OzyL22C9+bmOmbTk3reZCIT59z7m
TLSH
T1C865128367A520F9C13B8234C9921951F375F8758B619AAF03940A7B2F737E09D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 f2e5612cffa2583de6a9b38dc20c365f7db819f6e3d8042ae2ef5bd9e17ee670
MD5 af4b7a1216a9822181402402cd732d0d
SHA1 ba3aaa976b7ac57dd668a2f96aec61e1171d608b
SHA512 a46a4470c5f0f33cfd67a205bea10f0c20c0de72b33f89861e77a8e97f17a233e023e6ab385c4a3fd118e0004f52319d08aa28959a9fd1137d31671cb91787e3
SSDEEP 12288:Xs22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:Xs22C9+bmOmbTk3reZCIT59z7m
TLSH
T1985523C18FDEC8FAC17E0234465120E56529EEDDFEC7619B828E0D4B2AF1BF8940914E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 22bc7ea4f3c4b507eea139bb5974468fd24dc2e6709796754ecc2f6fa73f2ea1
MD5 707b20b2ce17aecd27fd4f103d5b6f48
SHA1 8b6210c854a5807f15a32e2b40674f047dffbeca
SHA512 eeb02c7463e2d1a29ed7a1e00b8ef29dda0c90393ea1cc27b6598e093680af4ad726039dd8c92940244854bb6ec256fb7b07fa2cb178680610bda3637109ee76
SSDEEP 12288:hs22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:hs22C9+bmOmbTk3reZCIT59z7m
TLSH
T11E5523C18FDEC9FAC17E1234465120E56529EEDDFEC7619B828E0D4B2AF1BF8940914E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 b218a49a0eef6660a42f58d01f182bf7849c8a6faf4d057c9213d0ece7375219
MD5 43bcc9d383947c5aca468edd430b51fe
SHA1 5c6253b65ae0ab705b34d3278baf2746662dd0d8
SHA512 c39c8967287c7d6ed1a9e7c9c2df3ce7bbf8dc8f3ae477851b8afec463c4145121f32f79335117f226c31d8ef37c455318d14589b45c9d6df3d6239dffbf829b
SSDEEP 12288:fyPz5L8L22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:SzyL22C9+bmOmbTk3reZCIT59z7m
TLSH
T12265128377A520F9C13B8234C9521951F376B8758B619AAF03940A7B2F737E09D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 4751bb47993096ce26e74b894cd4f1b9a11ec36ac9ee8f933ecc0dfc9707b29c
MD5 2ce1ef2509d84d742e55ad0ecdd44703
SHA1 f245d5408915ec5276a726ecbc94fd3839b5bef3
SHA512 b53ee8b43ed820721ee16fe9adaf2a7e82995b9105f4a1000e7592ba61c0656ba022dd91ba8c3bf3ce449c66aef8a46b6253ddcda2db3fe5cefe04cfc4356824
SSDEEP 24576:JTDaLl3z0zD122C9+bmOmbTk3reZCIT59z7mO:JTuLljy2LlOpbeZB7m
TLSH
T1A77502D5B39058F8DC7B813DC9514856D2B2BC5A4BA0C65F03E83A6B1F733A05C2EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 a6ca71bac06066f98627826cddc9fccd4ae9172cd47c28baeba9bf18a6c4c683
MD5 9ca30396b1a489009858188bf4f873c5
SHA1 a9e302e91f76acff262c85a1813dcdc30718832a
SHA512 f25b9b78633da87808f134984f2baa2b86d1904877434030712ab3f9d0ba588e6fdd26436e532547552b14092f8b2c87d1c7ed87ca40e0b8c7d6dd9ee68dbc9b
SSDEEP 24576:A3vd9CHKy7GZx22C9+bmOmbTk3reZCIT59z7m:Kvd9CHKyaT2LlOpbeZB7m
TLSH
T1CB85CF90F3E414E8F0B79A34C9725511DA76BC995B71DA8F03A8261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 a554bf1fad18d0a60d310646d28d5203c0bcd45cf782f4f8eac34c0dc8eec2f5
MD5 1cdd204c6e9c387cf56f6bb2998dd09c
SHA1 174f7b422f45ffff8aac47c0c2d6af45a651c51a
SHA512 9c8cea0cba90af2704b9b1b1db93168f2f026f39a05a302c87395056eaf5616a90cde1353009b61ab1866fec51c895b1298c31bdc59d9f6c742d85ef6892b611
SSDEEP 12288:pF22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:pF22C9+bmOmbTk3reZCIT59z7m
TLSH
T1FF5523C18FDEC9FAC17E5230465120E56529EEDDFEC7619B828E0C4B2AF1BF8940954E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 bb76acb372e8bfaa6a999aae560e2468bdf998daf54bf21c8157005d47e3a9d9
MD5 4ce1bb1d2c0bcf96a981641130424efd
SHA1 9782d9522258622807cb98f96a612303e8677ba2
SHA512 fadf0027ad8e984edcc71a28a08ccc5e24e2e08b2af9eb721c370a63621100fdc3342bbacda4268e6b24bed03f9a6f62b7f5c9b36d55764095e4978985c89ac7
SSDEEP 12288:nr22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:nr22C9+bmOmbTk3reZCIT59z7m
TLSH
T1D05523C14FEEC9FAC07E5230469160E56529EEDDEED7619B828E0C4B1AF1BF8940914F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 414ea739f368ef58e6212d390de69d436b97de0b15364aa3a9bb008fdc03a46f
MD5 9f377ffc1b10101da7b55c8f052b835d
SHA1 9e4819062cd5311a5c13329b41329dd60f84bdff
SHA512 75bd14a627c7ad424b1db48f9a7e66f5048fcb7275c71848cc83f65a53806e0a2f318a13837d18a842deede62dde75c51f93f9c398251e20e53a303d2bd43223
SSDEEP 12288:nq22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:nq22C9+bmOmbTk3reZCIT59z7m
TLSH
T1AB5523C18FDEC9FAC17E4234464120E56529EEDDFEC7619B828E0D4B2AF1BF8940914E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 a0644c27bf67927e647d15cb009d4f0f658b8d098df2204a20aa1b4bd0866d6a
MD5 3aaf225a5d4649675f0a5a8560483968
SHA1 829335ab4607c235f57d58a3f834a0a02e971e67
SHA512 993743692e0f3a5411f5242c7d411dcadc1d8ee79487769e292e0718b3c15182d78fcb3268c1388b1434159af8786f902930b9c5140e0b7fd3b143c0620eb7bc
SSDEEP 12288:6s22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:6s22C9+bmOmbTk3reZCIT59z7m
TLSH
T1C15523C18FDEC9FAC17E4234465120E56529EEDDFEC7619B828E0D4B2AF1BF8940914E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 9c84f2bfc11d5ffa729ed36c573c4a33803997531ac785e46fff47c6a7f0daaf
MD5 6abcf663a7ebf0158aa49a4d6519ccb3
SHA1 1106e0b6a023a2f898a2369918e161d98f2624da
SHA512 64e2a5d5937f4983beff7d8d947474bce95891bd01ce0390cada7e004dea2625888e171107d48acf5be6e0ebfd2bbb93670968bb3d25ff9aceb2181c75bd5a9b
SSDEEP 12288:gF22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:gF22C9+bmOmbTk3reZCIT59z7m
TLSH
T1BC5523C18FDEC9FAC17E5230465120E56529EEDDFEC7619B828D0C4B2AF1BF8940954E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 219a9d210fff25313f9e36bff4cc7084822f2f951d34393026cd8a523f94a617
MD5 9acbb7ea61a70f447b718fb8a1551953
SHA1 2aadf09ad6480e4c163c01b2152830d98c15800a
SHA512 d757d6b5045438c1fc90d2820577c2e4376bca40709fadb77eddcf24d6733919dd37bdea84b8034ecc92df173beea563fa891a5eb18e11caec209933a7a22fce
SSDEEP 12288:SE22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:SE22C9+bmOmbTk3reZCIT59z7m
TLSH
T1C25523C18FDAC9FAC17E4230465120F56569EEDDFEC7619B828E0D4B2AF1BF8900954E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 1a8e357618b53c21e9f913e24597f4dd952c36731ea4fc6c724dbb6a0129a6af
MD5 40004e0a803719fca4f0bd4e04670c0b
SHA1 cda31fc7c5cc867cbf501e5d204af771e9f5b3b8
SHA512 24e26696c237c964412d2d1845166cc32a337c3a32e9140a0237039f60bd64ac9e4bd4ecb99813ae1d4ffc2c796ddb896aa29a283f5e2a9142fd5fd712f02081
SSDEEP 12288:Ae22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:Ae22C9+bmOmbTk3reZCIT59z7m
TLSH
T1D55523C18FDEC5FAC17E5230465120E56529EEDDFEC7619B828E0C4B2AF1BF8944914E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.3MB
SHA256 d1dfa1b0d5db84b3ddc8e27694f6b3e386cfc1b35fe8761b0b1f909e13a85409
MD5 8ca8daf865d1d99b46f8394583eab932
SHA1 afeb7ceb2dc41932f27c0c38dbbe520a471b3a4d
SHA512 a22d66db3b970a9c6b6f5a167692e6a4e589c4cbc8ad2094c379f91add9b25170ae29f2490a127a1ffeeb8d1539f2b9a76664a59dd4ac8fc607cc798285ed8a1
SSDEEP 12288:DN22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:DN22C9+bmOmbTk3reZCIT59z7m
TLSH
T1B15523C18FDAC9FAC13E5230465120F56569EEDDFEC7619B828E0D4B2AF1BF8900954E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.3MB
SHA256 b87a2a6b5c38a6e7880973f4f29108e5c52bff01ff6083f801b44eba5443622d
MD5 938a1a5491aae15b26dd5abace1e7d92
SHA1 0fd5c4077f0ffdd99762b34aedba1aa24505bc0c
SHA512 ad816fb1da54018be6ba0265b9e026e9915c3c4c7a55f13177d594f21dd7c289413499f3befd4ac2d4c54fa4e075397331f3992b4e30c45413b0d4fa73e11177
SSDEEP 12288:+e22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:+e22C9+bmOmbTk3reZCIT59z7m
TLSH
T1DC5523C18FDEC9FAC07E5230465120E56529EEDDFEC7619B828E0C4B2AF1BF8940954E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 bed1f72ebda3a1be797048172b098e2e4a812a43540edb2a18213b395c21cf3e
MD5 02255c4a29eec94507c3869468160b15
SHA1 cc6246d009aab8ab6c24ce485b6fe3dcd4c64d23
SHA512 f96d185abc7d7ed45f9c8ed59bcd96311ed370f11b0d772f42a1b4aefd7d6e39ab1721f909d82052df992a779576b0ca1bda113c62806a8e93da4ef3c4b66c58
SSDEEP 24576:OfwvUk9RX6wkyAIQ22C9+bmOmbTk3reZCIT59z7m:WMnYIQ2LlOpbeZB7m
TLSH
T1F185D029EBDC44E5E177923C89B3460AF6B1B8695B71C2CF029A53AE0E33ED45D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1824d4e8aa2d06d6ade1aeedf4735f0a02bee325e91ff128bca5d20b16eb13f3
MD5 ba903a7a71c4ed50c12ac87e9ae2ea0f
SHA1 78ba5f828c077ebf3c63f68aae26b61c3e6fe3bf
SHA512 05857eea4b7a259ca8dad74a2aa245383394021907a143526c60c20b147da0ef5d416d5f06bf466dba1e1143ce42485fd0b6b09e6a1493777818a48989ae5472
SSDEEP 49152:5YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0p2LlOpbeZB7m:UySzPxycv
TLSH
T12C066C96A1A841D5C1B9C1B98B0BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 68dbd4d2e08b57c247161375931b38d6777a306160c06a3eb15565604f0cc26c
MD5 cd99835c04647b61606d7e6fa3afba5c
SHA1 80588a6f8a17392ed472d64f0352e60c7566570d
SHA512 a944e8f52ffabb8925641782a37f62b70c80347756dab921db79fb47307ab1130463d65a5ef68f703ab2c007708536749319d9211910c72e2e9eb318136582e9
SSDEEP 24576:/47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYH22C9+bmOmbTk3reZCIT59z7m:/47JUQjTirIhCnDHUPfF/Z2LlOpbeZBi
TLSH
T19A65AE1EA3EC01E5E1BA823885154A5AEA71782D5F32CACF1270437D6F63ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 559e6cc9d6819399fb0b5b31d6b331590aba2a38e439be6f7fedaf126242de3c
MD5 4fe3248e6a0157db0e55d00631454756
SHA1 677674e7de138168bf8413564476dbc17063afa1
SHA512 99b9f503256cca5a2b6197ad9a0ebc7a91bb633f502fc05fc715b2f317ade864373b117791d7c064363b47b2b876cfffa9d8210d7ded1dbee6457f290c3c5df1
SSDEEP 12288:6bsf822qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:R822C9+bmOmbTk3reZCIT59z7m
TLSH
T1E265F185D79842E8C06E6234C7525581B333BC659BE2E3CB52C0F97E1F766A09DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 8e998e0ffe759974dc5ac77748caa22ff15389ca9ac361933bc6bd71ef435154
MD5 51c2dc6bae740caff969f89edfbf4c8a
SHA1 e1761721b4c84e83835af69984f1ef77267b0526
SHA512 bd8f7854bf7c8cc13be213cab0c83c12a8fd018792f7bf88510e62be9dd67c4ad00d8263bb97575f37ab64ca78336b28213ebc9091c5ee9f47a571a92986e2b2
SSDEEP 12288:CN2GwU3fdsghCdLx3L+aabeDhsw0g7xxPtcicR5Vg7l9pbICTYHydZxC:Y2vUPdstLN50g45eh9pECTYSrxC
TLSH
T18E3529117666DB4FC6A944325E33D2CCA7707D11EE086F0373C98B3F9576658BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 99c6a4ce7181732ce34d12d6e9688fe7afbc18f6fec2b9c36167fe42ab7c3c64
MD5 45b615d87de7c948ee30e24393f407de
SHA1 8e232113c77f344e0a21a945d3ac396ce3999ed0
SHA512 f561e72d14ad4a246be596ec5df6cd69b1adf6816b3560a4102cd80b28923dd2d8e9e8ff4389bccb423a9036923531806b2e0ee8a2c2934e07c475868c9d486f
SSDEEP 49152:OJlxdWYC/vrR0SwtfbHXbA1Fy/TIIf5nxjyfifb2:udp6
TLSH
T114750A416537E68FD1B76032032A9B4CBB64AC1777496F23B3C9453AD81BB81A0B97C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 cc9a94527c70fec6392aa999ba86f390711a3de7ff0259de67738a8eec1cac90
MD5 7976d72d65c7fb7c69a27397b09197e8
SHA1 fc4ee582dcd84d22658c70ba0b0c699c09d0eb57
SHA512 0691f86770e69cb6ecc8a38449700410cb4102d30fb482945e3979b825415b975d66b154651d479556c205d4fd50f1195b5a80ff898c129855af41a34a4e3bbc
SSDEEP 12288:u07U22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:XU22C9+bmOmbTk3reZCIT59z7m
TLSH
T1FE5523C18FDD88FAC47E523045556074722EFEA8DFC2A0DB91490E8B29B1AE4DD7960F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 cfe4aa30d9ab26ccbd2c71de10d1a40413b677096fc8b4e06a1fb620eb9136b2
MD5 9d68d9ca5ccb7a187e492f5db0ec711a
SHA1 368ba417fc8462ceb5c24a87aefff3a4fdb1d04a
SHA512 0a1626c257180824bd784af320d2b5eb0aced6011b4d5c12526b5556c2b911eed0db4fa48f3021d695c8da6a92bdc37dc4da02d136721082fdc9a796cd382477
SSDEEP 24576:sgb6bmBIi49WNNFpg1rSvFv7bYy22C9+bmOmbTk3reZCIT59z7m:sgb4mBIBhGFH2LlOpbeZB7m
TLSH
T18765AE1E22EC02F5E0FAD2B8CDA64417D6B278164732D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 228b94f95acd44107d4559bf091e889d0dbd5dd6c7e4d3436c036fff543c4de3
MD5 6464f5af9b525051d8bb0a5bcf9d7e10
SHA1 a1343a6f27683504c76331deb89f241a575f00fa
SHA512 aa4d3b6dd2431c2eb18e0b29a324b655a9d9c54ea91ba187f3311b93425a4f9414771bb64e175584391593b6a2f12a90494c924c31ce8e8fba1d10c522e18ddf
SSDEEP 24576:GG88u8FpJqH1bzria7/mX22C9+bmOmbTk3reZCIT59z7m:N7ZFPqVea7/K2LlOpbeZB7m
TLSH
T13E95F16167E101F1D47BD13889824663F6B2B8250364EBDF07AC8B561F23BE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 860dd2b1709581a8dac8ab7270ebe271c7c029a3f57e12fb1156c344c0fe2916
MD5 2a9dffee2a3f86c76f66251e79b04ab9
SHA1 708d6f3b9dbf61a8ae275da756e4828babe8268c
SHA512 26c88004da4b213ef305dc44f6a4c69fb723f775403463420312074edf606ae775b937863720b4042d4afca67f78691ec2b13658a52fcb398f9bab610da241f2
SSDEEP 24576:SPUr+NQT22C9+bmOmbTk3reZCIT59z7m:SJQT2LlOpbeZB7m
TLSH
T17575E15F26ED18E5E67AA13C85824619F771B8625752A2CF02D0817E0F73EE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a8de346e4d13de304e4864d4f9f8b030b3fee7664fbda42ff6293e85c056aad6
MD5 9240aee2ab7bf5a1f5639f7970c6b83f
SHA1 fcad4d62df50570a1eb387b14a4e220ce7b53e81
SHA512 f9430d15d6dd8b71b448237640c5a403d714ba63f9d7f517ab91d3276d5372c491050918bf7c14b81a893e82a578935f98c54aeef2a715596c7794b9bad0c47a
SSDEEP 49152:yBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjj2LlOpbeZB7m:9G05lO43bIycv
TLSH
T173D5C06A62EC11F9D0BBD17CDAC6460BEBB23815033556CF02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0252b4f613cadc5d91db1469aafac13ebee5419d2ad32440616e3bd93e2635c4
MD5 b9214d4d754afddd5e781044836dbad1
SHA1 2751b8a1a297418da98940c3320f7390bebfc1fc
SHA512 954940340017c90ad7849d745db1f2c188acadff9ef9458fdf61d2b6580a2e2a5393471b45b8cbb8af004020de618990c564252085d4fc5c4edde2919874b2a1
SSDEEP 24576:Lfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnp22C9+bmOmbTk3reZCIT59z7m:Ta5POZ3BJt2pasx2+mr2LlOpbeZB7m
TLSH
T13365AF5EA7FC01D5D1B9D17CC583861AF5B1742553329ACB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 be53736309918b4cd16e8d5a0bc7a334bd90efe9d410d5f19f351cb4572b0075
MD5 8fe50cb3920f98da271b2feab49bedb2
SHA1 4e4fde840680e29cd2081f432ecd1f69d73f57aa
SHA512 9405713d38baaacca2e343add3bc9ea94ccd7ed57c64ac59feda206759bce43bb79f82f67fe8847b0caba14c9bd21ff60844076377a0f7966ee2f98672224d2d
SSDEEP 24576:RNcwHdjbyQ4nLC18lb/EOjowL7Fkf22C9+bmOmbTk3reZCIT59z7m:RNc/zEOVHFq2LlOpbeZB7m
TLSH
T13C858C1623E901E4E1BBE1BE89779546FAB17869533086CF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 52b50a78295b7ce83c38899463f548235adf0547a0c19d1a66f88e4214881b75
MD5 b685da4a057cc81e781adffeadd38a9f
SHA1 1c2aeda3224feecea71a968d380726fe30a538e9
SHA512 8de70be75597e76d0ae7e0a7cc9706b99fa560347983238a2b593344ae44184b131f4b2d561d1bfeaf11a0faee7d72da4032fd4fd4a8b0cfb63f6046f903d160
SSDEEP 24576:VTkNvNnaFeYhJNtmZBmN22C9+bmOmbTk3reZCIT59z7m:VTMwBtOmN2LlOpbeZB7m
TLSH
T1DB55AF6EABF846E4D1FEC6748D238512E6727861073293CB5290C13F0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 60b25c15c85b62bb8cb910aa2143ba66e8ce5353c4f9215b103b28b5ff6ad2b0
MD5 4d9e8aeb7a69aa84788ca5a117bc0836
SHA1 2243c28dbf98eb977df320b93a62667570c20b02
SHA512 7e42a07e34f00f9f32491cf32759e48972015c5d54f462d42c66f583853c0c29233e09ffd8b6ca63b65170441016eeb236ae001b3797f5750ecadfd3a93989b0
SSDEEP 24576:yD3FHshBIYQgA422C9+bmOmbTk3reZCIT59z7m:yDVHeBIAA42LlOpbeZB7m
TLSH
T1CB85E17EEB9C04E4D47BD17CC6638906E77178A9076266CB02D481BA1F6BEE46D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/704-89-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/704-365-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/704-364-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/704-342-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/704-82-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/704-83-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1056-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1056-13-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1056-22-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1056-81-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1764-38-0x0000000140000000-0x0000000140256000-memory.dmp

Download

memory/1764-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1764-52-0x0000000140000000-0x0000000140256000-memory.dmp

Download

memory/1764-47-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1764-40-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2352-95-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2352-101-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2352-345-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2352-343-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2352-94-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3192-108-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/3192-109-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3192-115-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3192-359-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/3356-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3356-137-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3356-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3356-360-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3444-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3444-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3444-131-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3444-121-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3444-127-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4336-219-0x0000000000400000-0x0000000000FAA000-memory.dmp

Download

memory/4336-77-0x0000000000400000-0x0000000000FAA000-memory.dmp

Download

memory/4336-6-0x0000000005B20000-0x0000000005B87000-memory.dmp

Download

memory/4336-7-0x0000000005B20000-0x0000000005B87000-memory.dmp

Download

memory/4336-4-0x0000000005B20000-0x0000000005B87000-memory.dmp

Download

memory/4336-0-0x0000000000400000-0x0000000000FAA000-memory.dmp

Download

memory/4648-61-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4648-56-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4648-54-0x0000000140000000-0x0000000140250000-memory.dmp

Download

memory/4648-184-0x0000000140000000-0x0000000140250000-memory.dmp

Download

memory/4676-67-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/4676-73-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/4676-217-0x0000000140000000-0x000000014024C000-memory.dmp

Download

memory/4676-65-0x0000000140000000-0x000000014024C000-memory.dmp

Download

memory/4876-325-0x0000000000400000-0x0000000000618000-memory.dmp

Download

memory/4876-78-0x0000000000400000-0x0000000000618000-memory.dmp

Download

memory/4960-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4960-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4960-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4960-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4960-106-0x0000000140000000-0x00000001402D4000-memory.dmp

Download