6745a7e6c0bdb4a402d4af36b4e60119bc0424974e08bdc64969a595c42e0687

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Size 4.3MB
Sample261014-cbf6bsw1ev
SHA256 6745a7e6c0bdb4a402d4af36b4e60119bc0424974e08bdc64969a595c42e0687
MD5 ef07425d182a880cb0f0a594d9b092d5
SHA1 4c147bf93d6e64967048c071776682d53f94773d
SHA512 fe395a1f8b959caf780a5d3058b3b946620bdf095698397b604c51d09886a48a90cec797b1be6c5e64b91b720c87d8c5e2fa837f2ce20773af041baaaf584d61
SSDEEP 98304:hdEHEa1c7hP164hzvJny9Nctze3GFLOAkGkzdnEVomFHKnP60D527BWG:hd0EF1pDGNctze3GFLOyomFHKnPRVQBx
TLSH
T15726C0113D4C0076D11B1AB14AE9F77CF22EBE7C173610A76290B66DBDFA7814A2E427
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution spyware stealer

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
3220	elevation_service.exe
992	elevation_service.exe
5456	maintenanceservice.exe
5036	OSE.EXE
3792	PerceptionSimulationService.exe
4772	perfhost.exe
5544	ReFsDedupSvc.exe
1856	SensorDataService.exe
4040	ssh-agent.exe
1968	AgentService.exe
2212	SearchIndexer.exe
2976	YoudaoDictUninstallTemp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f29e13153a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\javaw.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
988	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	YoudaoDictUninstallTemp.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	YoudaoDictUninstallTemp.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YoudaoDictUninstallTemp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000004ec0fe87e5bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005c80a2eb7e5bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000435d2e97e5bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009f47dfe87e5bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000577896e97e5bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b354d32c7f5bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000033edf3e97e5bdd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3220	elevation_service.exe
3220	elevation_service.exe
3220	elevation_service.exe
3220	elevation_service.exe
3220	elevation_service.exe
3220	elevation_service.exe
3220	elevation_service.exe
992	elevation_service.exe
992	elevation_service.exe
992	elevation_service.exe
992	elevation_service.exe
992	elevation_service.exe
992	elevation_service.exe
992	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	716	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeBackupPrivilege	5544	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5544	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5544	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5544	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5544	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5544	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5544	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5544	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5544	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5544	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1968	AgentService.exe
Token: 33	2212	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2212	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2212	SearchIndexer.exe
Token: SeDebugPrivilege	3220	elevation_service.exe
Token: SeDebugPrivilege	992	elevation_service.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
716	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
2976	YoudaoDictUninstallTemp.exe
2976	YoudaoDictUninstallTemp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 6088	2212	SearchIndexer.exe	99
PID 2212 wrote to memory of 856	2212	SearchIndexer.exe	100
PID 716 wrote to memory of 988	716	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe	101
PID 988 wrote to memory of 2976	988	cmd.exe	103
PID 2212 wrote to memory of 5800	2212	SearchIndexer.exe	104
PID 2212 wrote to memory of 4448	2212	SearchIndexer.exe	105
PID 2212 wrote to memory of 2208	2212	SearchIndexer.exe	107
PID 2212 wrote to memory of 2464	2212	SearchIndexer.exe	108
PID 2212 wrote to memory of 2648	2212	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YouDaoDictUninstallTemp.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:988
- - C:\Users\Admin\AppData\Local\Temp\240758171\YoudaoDictUninstallTemp.exe
    "C:\Users\Admin\AppData\Local\Temp\240758171\YoudaoDictUninstallTemp.exe" -temp "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2976

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3220

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:992

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5456

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5036

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3792

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4772

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5544

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1856

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4040

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1968

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6088
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:856
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2956 2996 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5800
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2980 2984 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4448
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2208
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2980 2984 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2464
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2956 2996 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0b5e23763eb80288654ac03af6a8487f22254e5ccb3b357691784e898c8331e5
MD5 fa7f0ccb4f38c64d06bbaca21524452c
SHA1 21a4bc13ff780e0e786fb875024003519766d0de
SHA512 6d7fa750dd42a0e4e6b6633a95ce50a0a8929ebdde19f4109976e85952d6a6184e86a5817f024ab248331c9a51db302403940fd886763fe6e578d97d25178816
SSDEEP 49152:Bb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn2Dmg27RnWGj:H3q6HjBRD527BWG
TLSH
T1BAD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 f04e30576b0c44a797f5dc42e5302cca6c32e75ef244b551a8a1eb0bc02c1412
MD5 8f99f72f8f5681211804b0f2c372c38a
SHA1 b20a57529dc35a6bf829254cbe54605820d96b4a
SHA512 ba1ba556f37be7c38efa69669eddb1a1843db5c25e6f61d583294b6a33c129797fdb2c0897b8f312cc14bbfdfc2a7490f949789f1093f93a6ba4be685f722bae
SSDEEP 24576:bXYfDtczARsqjnhMgeiCl7G0nehbGZpbD:+tcMDmg27RnWGj
TLSH
T11F650129A3E408F9EC67817CC9A2C515EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.6MB
SHA256 6b20a8d703a6850d0a33e33da4202101fc0546f902ff80ebaee6f5aaaadd83a6
MD5 424268dd4488987a2ba1ba753a33c43a
SHA1 7e4c11d62ecf7b35285f03bcebe2656251c9c7b9
SHA512 7a36418cdbfaa4bffc3ba74b80b139d6f44b750f42d0bc17d0b7aa8d3169d267d71370dda02d7bc1151755825c2474cfa07e970945450b2fb991450073ec5dc2
SSDEEP 24576:y0Le5ji0hmx5rMKsqjnhMgeiCl7G0nehbGZpbD:yPji0AX3Dmg27RnWGj
TLSH
T1E8859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6b9c432dc8209fecfbc919fbc1caece81799a6ad1e13718d737eb1526e8f470e
MD5 bfbe75f8779834fc67d9452ada0fbe6d
SHA1 8b68accf72889dc00729f2ee7b39c461b451688f
SHA512 9fda054674d4bfed8ad7fe1bd482f3bfc7bca274ade8b5962b6f8b47032b6b2e4e254315f6310a9cdd7054423c0b568137a5b98453479f7f5ef820cd50296845
SSDEEP 24576:Ra7/ezSC6vUyD/aqgrvWE6q8wyugsqjnhMgeiCl7G0nehbGZpbD:Q/ezSC6vUzPvxHjyrDmg27RnWGj
TLSH
T1F6755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 07efc7c2d114ed085bf36358697ed40fbb3866e8018a9493f7cdd77d1225055b
MD5 125ef433757a50ed4d417b3cd2f02372
SHA1 7e1360d975bbd4e1c9b414f1dafb31eb9baf3d76
SHA512 cff144f652cd8baee41d3cf82249dd00e8f0258d4dc57876cdce225074516c806579db07832f281adf439cccc199309e05092eaff1ef110a761ad97b2110ff8f
SSDEEP 24576:yVbqPb88hv/l+69sqjnhMgeiCl7G0nehbGZpbD:yVO88hXl+CDmg27RnWGj
TLSH
T1DC559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.1MB
SHA256 6d2aec8a0efd241141700885d86297d473b7ca871ac1292d21a7a96bb9acf3ac
MD5 4b52e2e4f9c76434c350090987d19755
SHA1 5fcc112165c0f154536fb4ed776ea41be6963b6b
SHA512 45154524962b200833dcab85249d2c9bde2a035a7f5e68738ebc7481d51aac6efced87b57e658d78f30543b2e461313536737dbe6e557c2bb3ae5faff37c0ede
SSDEEP 12288:95WXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:95WsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D04523BE825C11CAEA7608B5C3E9F51DAC177D5698200C436AA37CFDE6F5468CB39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 2b2f75d6f8ed84db2fe3e75bb34cf8ad1f695a5a1d8bbdd78feaecfbf02aaca9
MD5 709c8295bf3810fd5e44126a599fe44f
SHA1 6dc76d5710d78f2f8d9c661e45b89283980085ed
SHA512 6e5b22157e428f06b32a27581ad64f2defa584263c88f2902dd591c15ee29bb156a2935554b59e17cc58a1671ab620deb86c89f02d307573576d63cb2cb2f6d0
SSDEEP 12288:aeBNUbTVO86UVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:aJIUVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16965CF7BEE28FCD2C27A8DB95791C600E76278314F21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e066185bf562acdcab5b73b15715e062dfe525e271f861b72da122258e9ca64c
MD5 2997d393595563b53abc7dcd5f90594e
SHA1 89ad150a64c09d9de2a38c879027068c3d7b734f
SHA512 8ae24e3f10deac131fc3f27aa6b96c0b05092c441a26e749aab116572ff3ae7fbc00530a24af8fd7979f9df1b0c776f8725be91cad8a7aba51d4dceaeb4fe277
SSDEEP 49152:KQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THs:KQvGAdlCEL8c/yRNw5CsD527BWG
TLSH
T1DD266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.4MB
SHA256 39575251a457ea7f40d79b71d56fe180eeaa3e1b637b38a2028eecfcdac8ca23
MD5 7b38b6c103aba12f95c16532aec75096
SHA1 406a7769d2020ee052c4254f6cd982f6fc774536
SHA512 6dfa8469456b9ad8a60517eb0c8b05da2f3b9cd8c74020cf3c3c182f160ce6edeaa7c6499db65bbc03d4ef423face910683ac892e1f6fe542fe6065562b4aa18
SSDEEP 12288:KAwSfxL/2Dc3XDLLmt0LDQewsAjDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:fmewsAjDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10865E031FA74E036C77B0DB20B76D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f7040db6c5fd407ac695cb13e34428f955cf9ac0d05e27183049e146691e3c7f
MD5 37bae128c9b3ea05cd5140640600f2e9
SHA1 77c2e9906ce5af255264dda416dc56d54d97c225
SHA512 b9e4fd93c9f91db3c510e5514a49e650067f3efb2f9017b2eb22eb4328b8d70f19d03ae484b705e9308ded808f54a4235649b562e7aa03db9dd06bcddaab8872
SSDEEP 196608:6UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHfVQBWG:6UEtQevvqc2W1cpV2EI32WB
TLSH
T109474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 bf948f6ebe3cf744399025c5965cf47d525ebf25a995d6d98ea370a3a1781099
MD5 33ba6bebfcca1a1097a7b94ce05095d6
SHA1 6ea2b6be8d48ad83778b28a9625cfc7f5cea5fa5
SHA512 6e053499e4afad9b00b3f78824b5f8c9d8ea2190339f46c2c36b5d3016fb9e3ca96cccdfba9ac98616024a3e30b1f5ad828a625a296add6e21053e04e606284e
SSDEEP 49152:BCbRquA/m2yL5zQfFiV+XenmE3/znDmg27RnWGj:uoqtVjnmwD527BWG
TLSH
T139D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 fd8bda12d40d905f64954c6ee641a9a48035aa1ca442fc3c78e63b0ba07627e8
MD5 53bace4b8ab03fef2bf10bef1b88e393
SHA1 f7da9fb074e529681cd772397ad4a726d22548a3
SHA512 d9a3ea8cfc8173b3abdbc037d5545b47885e3cd2737500f6297842a1674e1037aa5db6f9edf13644d562abfd903a2cf862cbce043d778da2722bffc1e44f5a9a
SSDEEP 24576:cAhGLJIFoiwtA5l7S530sqjnhMgeiCl7G0nehbGZpbD:cAMyFoiq5ADmg27RnWGj
TLSH
T109359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.3MB
SHA256 48cb929d030735d219a623ded9e0a1ab6ed0d9fb772ef6496d3c3dbf5762838b
MD5 1a7cb6f6b84c7fc9b5e2159e9e0995dc
SHA1 c97019434d07075ff2374c8fb03ebd82a643c832
SHA512 7c2de92cc895d0ad16b5d7b0ed7abea39077f24ee1dcda87b996da5485f0a6d9a11ac17acfaaea358df76039542ab845e70d42cc3fdb89a3eb4936419aca88a3
SSDEEP 12288:Mmw5HEjsChN8BFgl0WDm+CAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:pwuxOW3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T19A55F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 d7c378cc33ee1c9774a90968a4aceb60db18f03c9a872f9a5a5daf6f1ef8660b
MD5 d7db73ea3350108a8f9a3ee3854b006f
SHA1 e4186e2651c7c6e6c9396b379b604adf66469e59
SHA512 132236ceee4c2286c2f211add9ee2b3d04b63a2f9426641ce5adf5642b7d052248df99eec2c889811a6270f89ce41a78f461d20d877f8ee48c2fc7a330467201
SSDEEP 12288:0ZZ1IyTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KZuCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1854512AE239820FAE5634178C6E5D609E7333C63673003CF166656AA6F739D44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e7ccff3ec697b551d8dc7091ea27df7b2540e37e95b9821dee41ab5be16ee358
MD5 c2863d7756a98f2cb70c99ff254b3461
SHA1 c9fb17c50c056da4834a8d3f5342483264dd6660
SHA512 933179d613623c5fe06b8a08c8b303542f571a4036887dc21e0ee94f9b49480e822eaebab87736ef1c169f7e7817c9b0bb5050f99990d1db652c8de87e68b73c
SSDEEP 98304:/QRQyi36YOcPQLvw2gAf+PN3ND527BWG:OQyiKayX+PN9VQBWG
TLSH
T15B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c5e0dff7f070902a0415f0b9f27fd3b5c6e80796837db3689d4f032ee571e9ce
MD5 c6edbc56efda937effa70f80807c9cbf
SHA1 c0947061476c25dd23b5e35ddea8a65a3fee87c1
SHA512 43175bdd420e1ceb7be5751186f5e72aa1fe3c781c4f77d5df5bc9173f7dc77da75aa53c5a4ac01480c69848bd849067867b0a7ce0368bdff1f493b2e0950b66
SSDEEP 98304:fQRQyi36YOcPQLvw2gAf+PN3ND527BWG:uQyiKayX+PN9VQBWG
TLSH
T197667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f6af9ea6c1d03b4142230f4ad83e3b68d4310e58349fe3d8bbd68d5d24a72bba
MD5 6f195cb04fa887d086032cde97330617
SHA1 c9131ab2216f02a92093153e1d47693827cece0f
SHA512 d7e3b72bd54e7ba15f691e25a2c700ba8ce51640a24e7d0b6fffbd6df11b75f032b49488318b66fff932014fe411a148735d16384e987c1408263845a611b4f7
SSDEEP 24576:MwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0ysqjnhMgeiCl7Ge:y68Qg55nhheWu7PNU3/3Dmg27RnWGj
TLSH
T1A8B55933B2F60099C44DE1769F4A973196D27C718FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 fc0b2b0d9c99e2aa0b412b9256d579ad0d7aa00856c9a1c65b389526d7ecafad
MD5 0fb9883b9537accc191eecd17bc7f778
SHA1 428e5db4bb63ee85b9895397c2f9d61eac63b156
SHA512 497e04a72d76cdf1a1e66aef4b22706e040a284c4f71da39f8b9011578d5e52d8e0f7dac761f8b1ff93270891621b19c5b170a311c04653aa3771512c2707ad4
SSDEEP 98304:By5112gYy5azzVvL69nLKnhZaD527BWG:cLIHmWhoVQBWG
TLSH
T181167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a37149356523bb8c555f8b1777a290df684230409922f7a1baeeaecfb4c996c2
MD5 b0be0320dde9200bbf8cde1b0cc74ab4
SHA1 b535b0615fa79678a4ae154e0dde47baba8e01f6
SHA512 0f8069653db51f44152935b597e1609ac930972ec0a8b38599c9b20e28f1c16fcda8ebd79afaa98baaef60e0e83a19ce102e83e677b4edbcc66b85e96781883e
SSDEEP 49152:wB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glVDmg27RnWGj:qu6JmVxd2dVD527BWG
TLSH
T1BFD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 12717a59561f0ac3f27d673c5107fef73d07c5b0f2b7e8f5fbe1c431f0739ced
MD5 737e54810918dcade0e17d7fba196083
SHA1 3a410b015a80ad9786543ff4e6171946fa8af136
SHA512 31e703cd895852c01bf5592d667ba44d4622f08ef1debc2da2dbf2eee5a3fae10c8cb2dc2b71c6669ba2d106e25e6b447f05c899271ecf2dc97a1e38c3461d7b
SSDEEP 49152:m1hpsNoJpF1A6UU44CwH7R4xpDmg27RnWGj:mmifPbRwD527BWG
TLSH
T1B9B5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 323d24b93d0f27fac36388d72dd0146bc33405d413b13d02308b3434a2909eda
MD5 2649b39db3ba879630227d3287fd408b
SHA1 abce29fae2a6861a61e9eeb81f27ca02b0c4c886
SHA512 f855ee9b3b506b6de2762fca4726834058c6498fc038f3fb790eb871066595853d55b8efa15197171209db4c5f4a5c7e7c0aad097fe70d2caf49d42394edfa93
SSDEEP 49152:XSuZQIY0Be2KRRVtOnks6NMHqGDmg27RnWGj:N5dKTi61GD527BWG
TLSH
T193C5BE13F2E900E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0b32938a877462ab89f3fa49df57b5e1f8394e057ff5d76493df03db11a7d51e
MD5 0c9bc11e6d7c764f0f7044aaef3c0e71
SHA1 d61998d0aaa9c68f28cfbac0b5bdfbc527d8ad71
SHA512 68eaf9726fef381c1884e629837d62088da5175a8d86307a05c979781b6f672ef4c1ac71bd292f2d52a3bcb1115a80dcb6d6418207983c4946d2e49f51f6beef
SSDEEP 49152:OhtSn8EApI0figngiDn0AP5wlDmg27RnWGj:PX2iyphkD527BWG
TLSH
T13095BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.1MB
SHA256 c77a8f113ba2c7b01c790f703da7baa66ead151b8f9355c69e2e3e22fcba8635
MD5 d5966e00ea78594852d5535826d4993b
SHA1 4318faf2fdf11a23a9d688c309bcfea9f44a3544
SHA512 9cd561f1565e033263bc86e5399bdec7bfd1b0c760782f2c5dbf81b9a8a96e50f60cc196f101f3ec6cedcabba6bd2b6e9a2973cc003e78e3fb3f701207cda882
SSDEEP 12288:ZuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZusqjnhMgeiCl7G0nehbGZpbD
TLSH
T1014523BE915C01CBE92248B5C3E5F15DAC173E57E92004837B9778BAF7F24A84B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.1MB
SHA256 8e4a0d946288e89752ad38d5fd947500e4f2ef91a62cbc86f07e60de6ff3ab0a
MD5 4409778276a19a7be67ffc564e38feda
SHA1 805a6068d7e32cd05ebe2cbc26dd6a08366f4ad1
SHA512 0535f850426c2798703436e012a0b7e78605e9db65b9fa33fe8a046a51228221cea21243ea232ca2b0bea6585eeeab601ed0445a99a84f261823c781cbd1ba4b
SSDEEP 12288:5/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C44523BE915C01CBE92244B5C3E5F15DAC173E57E92004837A97B8BAF7F24A84B39427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.1MB
SHA256 6bed13f484aafcc87eb6810cd25841292f78d13cf678c4b7b08187cc84618406
MD5 23219e91bf24a21b9543d1008cc255f2
SHA1 470dae97a4c0fe2c75596195cb262ecdd207abf8
SHA512 e69078c7e9fb9ec8eb3a5b83caeee8c119a3e9825583ed57d36ea6e10d1e4c6fc4225963750d81a5b433b65308f98468b48f2061a9017394192295c18d4c8a5c
SSDEEP 12288:btXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:btsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1294523BE915C01CBE92248B5C3E5F15DAC173E57E9200483BA9778BDF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.1MB
SHA256 35cd97efc36066098c5a8207b2bbfce0f66dc17e88f0cfefccc0532b878e2a48
MD5 ab91ea5aaa0ec96d5a07d45a489037c5
SHA1 62a2aecb371054f3e18eeb6dc0615673797d9042
SHA512 d0e9c6b4b5ca0a8c691ce73458a304bc12c478d6b7870c738462b0af474fae8236418c1a8fe34945a8ae801124ce07c8211a98bd04ead9649a7c8e4eba0bffab
SSDEEP 12288:/VUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EB45236E535C01C6D83285B5C3E5E11DE8277D56EB3005CB6B532CBEAFB26944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.1MB
SHA256 f0d40ebbd95a15921bba26c88fe47fa1e4dc10c9177636ebd38f092dc1014e2f
MD5 96723957a69c607e4fa01d6e6d30d1fb
SHA1 cc177f03ef8b11a2d1037e1aa2c2f9f1c5678d60
SHA512 f4c217fec6bf88b63f5d1e3d0bd4d4be26a33fbdaf91fb7ee8429a4910faff8baa037ff66e4d9ace9f733b0836bd52c3c20a08cd9da694142656493c25caf114
SSDEEP 12288:OcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OcsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1164523BE915C01CBE92608B5C3E5F15DAC173E57E9200483BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.1MB
SHA256 452109e8207aa7c566bc949fb5d9145363e1446238c46a4c94188aca2160537c
MD5 19120f33bbf8e719529a381a01b69cfe
SHA1 89c48be06843bdf0c52e367b4b08dfdd806da6cf
SHA512 64fe52339e0a68a0d7a3744b1a0eeb32c698b026b2c316b5db7968446710c1032b31b672edbc712175159b4caefc2e3e3e25a89501d39ed00b9fdebddf1a2d62
SSDEEP 12288:27Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:27sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A24523BE915C01CBE92644B5C3E5F15DAC173E57E92004837A97B8BAF7F24684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.1MB
SHA256 58ebc7acf599e63b5b9b52a2c26e5ffb4131ea47913c124fbc2500ba931c327e
MD5 8ed988a23371b7bf1a6626c2187d9de0
SHA1 1fe168fcb64e7cbc59926c6493c7f15a3049e5cf
SHA512 dfbdbafb7a7c9f9b2a6f6a1c1832b78776b201db0051eea80f8322e0e3e661edfbc1f5c7e092e1aeb0bb244334dc2cde0de3eee7d7e2ce05e8a6ef0c8329cbe0
SSDEEP 12288:jnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1874523BE915C01CBE92644B5C3E5F15DAC173E5BE9200483BA57B8BAF7F24684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 f0873ecd1f0a683a146e1af90de1b9a56018169095d3d1a4574f137931644224
MD5 6ca4e29f8036e1e5b04ad137667b009b
SHA1 12f5738d08ff9017037c8a0ebb6c88dde8c0191c
SHA512 0005da12a122f28b9376c0557371d3636c28907d400f503506948e5220f1e918ebf50f8b1175787bcf89ecb966d25c4c0aedc66209de4704c0f734154f187cad
SSDEEP 24576:wZMhzFVSOfsqjnhMgeiCl7G0nehbGZpbD:wZMhzf/Dmg27RnWGj
TLSH
T13F6501A9B35418F8EC63813EC965D90AD5B37C1A0B70C61F13A5366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.1MB
SHA256 f8856d9a2947e5e8b0232c747bec2c04e3bc3396f7d8ea6e55dfcfec74d6373c
MD5 96268e8aeb72efbd6921587c3b20c75a
SHA1 60a7c1a5ba806b9ae51fefcd5674c746d94cbd81
SHA512 6612066520c669126bfbbf58c159f40166a682bb3cce10dae2acc674a82c93c4965951db08453687d742d41542facb80aaa4738ae50b71063914c6719c2c04cf
SSDEEP 12288:TSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1254523BE915C01CAE92604B5C3E5F15DAC173E5BE9200483BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.1MB
SHA256 ce6a104cd8c28d2ab40740984a37397e60e67e97e8e03fe5af3bde4a2c5de66e
MD5 4e862632b2bf6bfb4fe60d7773995656
SHA1 cef04939971733865480d73390b1db373fcc1ef7
SHA512 2e4452ac4fea1788649f7a223366226d7f701ec033557154d6825303a0604a164150074627a53ca43187abf55a838ac8293fed88cdcee9b57fba3195663c34ad
SSDEEP 12288:KmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15A4523BE915C01CAE92604B5C3E5F15DAC173E5BE9200483BA5BB8B9F7F24684B39427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.2MB
SHA256 5053dd713bf371bc014010237599251cf123de389a1b9a4499a5792807efa972
MD5 1b7bed3f003d5cb5728841cd56cf0956
SHA1 cb35826d0b700bef09f0a1858ef1eaac7e2de160
SHA512 909c1a753260979f033bf09093f111e8dc03cf121096f2ad8ca384b1bbfb81421ade701f98fd5ccc733b2fa311d3cdc6150169d439b3aabdeea75816d98a5799
SSDEEP 12288:yyPz5L8TXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vzyTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17655125B73A530F9D1368178C5A29A06F7337C3647204A9F17A116BA6F736D08E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.1MB
SHA256 c3021375c3cdb6dbcc5a172438e68502f0abb68b18574a96ad3c8be191ccd555
MD5 952fd07e6311c018e5420f81ebd1e8a9
SHA1 ec83885604ccf96c96a8a7b8ac0357496478b5c9
SHA512 92b045f9a06d60a53c14acbf9b2a982de70fa2e5729943abd77697f6dc6489e9e26f528def2955f432d3c02af1efca16ac9fe9c4edf764c21e09a13d0d77a0d9
SSDEEP 12288:CSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F74523BF915C01CAE92604B5C3E5F15DAC173E5BE9200483BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.1MB
SHA256 cd88c28c2d7371dcac0ff5f58c3cbc95e4f649858cb296652a9a69cf770392a1
MD5 bb23d5362b879687a7719b586b814511
SHA1 87e4512a666930eece4e4db0ed1e4cd0ce811119
SHA512 aa40ca6ff558a7dc4e2bed8d24ba6846056f6831a01fff1c3bda5a7b4be029b6b48c69148ba3ce1691dfcc202d84f25210732b6bb77ac856ef680b2a33a58ac8
SSDEEP 12288:PSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1054523BE915C01CBE92604B5C3E5F15DAC173E5BE9200483BA5B78BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.2MB
SHA256 0ace183daa317dfd933d2c092e3c3aa3111a521874d2e21ce1ee7f246e862183
MD5 857eb833645e3dade05c14ce15c4f5f3
SHA1 62b5d63e814df21749544aa73b732a0f878ac78e
SHA512 0945d293e430cae84bac3f18569bb889f51d7171928ae0ed9bffd9f2874c70e6bb904540e3cbc18d1a87d3e52a87ab1fe0c5d3a721ebd9b8828dbe9c32b19ce8
SSDEEP 12288:XyPz5L8TXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:azyTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E255125B73A530F9D1368138C5A29A06F7337C3247204A9F17A516BA6F736D08E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 a1a6b484420fb8376aef21e42f9d27a8d27ce926fe3af70d3975a50042c12e09
MD5 5211b5e6eef6058c0eba0ff2070b000c
SHA1 0c5b98c33dc728d5868099785943e50e1faa91c6
SHA512 b9bf7b99cfa5ca305b8e0b107f01212cdc9434dffad461b8e498125651fe4ea38cbb5d13db08c884948ff15f7a423c98c384a68fd9f74e593abd39e17b34849e
SSDEEP 24576:8TCaLl3z0zDdsqjnhMgeiCl7G0nehbGZpbD:8TZLljcDmg27RnWGj
TLSH
T1626501A9B35018F8EC67813EC965D90AD5B37C1A0B70CA1F13A5366A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.5MB
SHA256 e33a4aad4287c4475c40166496e9ca1fdfb533c7db6367f04646d602c28b7b20
MD5 f1f08933e1a8d85955d2633bf434dd46
SHA1 75bfbf274c43599c87dbcdd007c19c0d64d0cfcb
SHA512 2b90706fda1f2ec716cddc3e6b06b649bef5f13d32c0e892b26ee053f3a90706f04a03c483d34c832bde297825c4c69e27ce71cbf0edffb4338068d2479b61c1
SSDEEP 24576:Y3jd9CHKy7GZpsqjnhMgeiCl7G0nehbGZpbD:ijd9CHKya/Dmg27RnWGj
TLSH
T10375CF90F3E810E8F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.1MB
SHA256 a427cf0d95a23be06831ec426e8c18cfab783ac77985b4f83785c7e6192042f9
MD5 f5456b73bad919e5013cd55535879547
SHA1 f3eb97c523ebec994d4bbe94dcf0b5d8e36ef298
SHA512 42c427ca17aab398f782b22090e8fdb66f54445f2d447a15220fceecd207eece8c38b9ac6407a6e8ba770ae8de63d30bb6bbe4bfcc926169572ca3d5483fda4f
SSDEEP 12288:aNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:aNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FC4523BE915C01CBE92608B5C3E5F15DAC173E57E9200483BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.1MB
SHA256 ee6cbd3d5272132e4dedc6e1e70d0cffc29771e8ecf52b4f398aea2dc0c4746a
MD5 3559c89d8aa0d7b3f8a31820fedbb41e
SHA1 c1b26bdd0008c833c6d6e0fcd88c31aeaa2e11ba
SHA512 fc6415a496020155c62c13a8812675141477a66b248d62c9c44ffa2e7128867d5a68b43c97fd0e4ef73a964ee55a720061868fbf8319f4e2ac3925d080865e5f
SSDEEP 12288:7zXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7zsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F74523BE925C01CBE92644F5C3E5E11DAC173E57E92008837B9778BAE7F24684B39427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.1MB
SHA256 c6cb80cb9ee05ae826183f18ed9538ba124a9085f4d1b3180d29742b970ecd77
MD5 169dac762c2dd780a988f4654940de02
SHA1 108e6846695bd5d55ea202fe8bbb2ae30606a0f4
SHA512 f1054ddd613d04197b5cb1e5cda9cc8906615fd47ab8a2b9ace50c4ae2a17d183383c041a39cb06fd5af3bd26d98824020704f9ff55d971f4cafca2d914cd4a5
SSDEEP 12288:kIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A04523BE915C01CAE92604B5C3E5F15DAC173E57E9200483BA9778BDFBF24684B39427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.1MB
SHA256 fbaf8db192008c6e8b3165cec56c376e5292326b4fcf06c4260449eac984d957
MD5 2f2e2a99589faaf5f413248a4f862e37
SHA1 c95dc48888fbd1a4ec12816690e1ccd95e5a4325
SHA512 7fac6729fad412fb72a040f6dbcffb4464d85f3730a2b3de3edf24494e65946e3e1c576a2bdc4f5bb71fd9b8dfd959289c425b590669e506c2692417ef5db38c
SSDEEP 12288:iSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:iSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BA4523BE915C01CAE92604B5C3E5F15DAC173E57E9200483BA9B78BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.1MB
SHA256 66a64d93cdddbaaf717545e2a55f64c83f93bee8cbc6cba5c6734632a3d8ff37
MD5 0d4fbd94c9376ae628a317ce0b288eca
SHA1 dfb1f361bdf2ecbe52e899cab8488591fde756f1
SHA512 3bfac4802a1c5de6e57e33972593178568596370891250d4462b6254c0a32fdc152310b1ebb26252b93a7633b9f437b57fb050b02a65e9f8429f28613479ad16
SSDEEP 12288:2NXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2NsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C54523BE915C01CBE92608B5C3E5F15DAC173E57E9200483BA9778BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.1MB
SHA256 fe031539c5d37d42b47ae7ac2a17e7be54c37d203ad0503d9e3c65c1e3bf3921
MD5 94af48ece50e8daa76a4390e5c50c7c3
SHA1 7f1a729d16674a3a95ba8401126b5b716f9aa8f8
SHA512 137b329687121b40d14fecb31c9e2ba419b1c73f9846d22654857ed736d8aefd91dd937ef19daf42415a46d8e83add5f3f7ceca5bd94b52cc9752c3a336e98ee
SSDEEP 12288:86Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:86sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1054523BE955C01CAE92248F5C3E5F11DAC073E57E9200483BA5778BEFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 176f2e801ab070bc641988e425b19ef03197e3debbdab4f2ab6fcc9c91677320
MD5 a00f5650863009ba0eb9e72a8387fc60
SHA1 66aab1438a8a2ce179b783c31dd91266ff36ca43
SHA512 bfbcd2c9adf3c3bf4f4194622dbb1aaad4a6c5cd75eced9bfa0523c4bc40e4abdf7c87fb5b14e622eb68784a35131fb87261ee4b7933607129cdba0561dedb18
SSDEEP 24576:QfwvFk9RX6wkyAI2sqjnhMgeiCl7G0nehbGZpbD:1MnYI6Dmg27RnWGj
TLSH
T13E75D029EBDC04E5E177913C89B7860AF6B278591B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 36a1510bca408f68f52d8115ea343a157e190736cc8da33485f104658d16a1d2
MD5 171b0d2a32520ccac2ee747614d0ad26
SHA1 303334b288e9ffcd7d9ef532da0a3a2c9fc7f2af
SHA512 85084ed12f6d1d18d1a0a2f362c541f54ecd36e7980a1e2ee1a0ab06a303e4cd8322c2da6a43860800f9465ce01ec9678a4ee81ccc178a6d7513d55a82a389ae
SSDEEP 49152:jYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0FDmg27RnWGj:nySzPtD527BWG
TLSH
T1FE066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c30a3e32cda4dd1d8702e853bde5f2f7762ca5cfe138653ac2e73658f4bd4c7c
MD5 1e927e528665274bd15c220e3f6e0045
SHA1 82fd308789516f602c7b0476553bc26f92e9a9a6
SHA512 63fd3f39d729ddc42940223d5aa0bd357853ccd3d75114d4bb5ba34e8940240c49b4373df45ee08f43c8a591ea0dfc0d67f5b13f8509c80723ef1af39d48271f
SSDEEP 24576:v47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYvsqjnhMgeiCl7G0nehbGZpbD:v47JUQj1irIhCnDHUPfF/VDmg27RnWGj
TLSH
T10B65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.2MB
SHA256 9f0974c3ee9fdb3e46170e2d2b070a05354b1cf37c8514b75ed794c329418ec8
MD5 bc97720a1e4720721cc619c4339831e4
SHA1 427870c3caefb874fdc418ec429c3d9d8c6b750a
SHA512 fd073bd532e5efba1b0390119bf0f55d13c7c0c078cb0368e6b833876f80a0b3f299ff1c24d6dd8747ee76b340649857bf38b8aa3553aece34f3b927496e1a74
SSDEEP 12288:1ysfCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/CsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B255015AD29802D8C06E5179C3969605F7333C2697E093CB67D1F87E1F766908EFAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 8bc219f072b1216b7b661394a92703cb1f3c21bfe21f29ff21124a9fd068b622
MD5 88b6da01caf9b995c312200c4a0bb26e
SHA1 59f737430e3f0995ceccb5e173f965e85c6596ce
SHA512 db0168ad715cc7d00f67cd402aae8237842ab1e1e412e8848d0bc5e2e99416352a9501b83dfd5026af66fe0ed92ffdb92c11f6579db03a8007589f741f485fb3
SSDEEP 12288:GcHzLBqu1sfKBlPJfTnLlm1v1/TlZjKZ5qiKc1:G0LpdXPBG1LlJc5qiKc1
TLSH
T12F5528107626CB4FC6AD80325E32D2CCAB707D41EE056F1773C9873F9576A59BAB2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 16KB
SHA256 499dabff31d2b37132d694c785fa1083aff375f8904c2b965b2084dcb32bbe15
MD5 feaaae0013fb199716ae16b3add940c7
SHA1 b14b20fad97a784dc51a71f232284404f7d365c7
SHA512 1a0fbe148d97bc0d7ccdbeaa1e1e101da9207b6374d99c1189189825d6a3e1a2c3c55617583b7e9ea71998431aafd7e06a381aedc3d9ed5ae00835768f4d8786
SSDEEP 384:t0WW0llallulTax0WW0llallqgx0WW0llall9:ttllallulTaxtllallqgxtllall9
TLSH
T143723EA5F624E763C4B78578CD8AEBEC133DFC092E940723B149138ECC98A954A9E4D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 7dabac1a6ad27207ef5bf31749fa546e178af223b0266b1ca1b628e3d98e723e
MD5 f87b106e2499be7a4ebde714907e6738
SHA1 12c3c4b2b18ae237f846e5c918c6d20e643d7422
SHA512 678c43e27e357d9cacd302b5a27c7e37087691060cdc3f62d4d3659d6f652a2ea4ce678602dfbecfa93d30e0b85d93e9ed5fd2612e121a2cf6ed64e2f8f853d8
SSDEEP 6144:oqqIfCIiymvaZXiKDeoHozW+iKDeoH24NrSu0wBXDl7246:wIfCIiymvaZX4zW+G4tr727
TLSH
T189650A416137E78FC1FB503207265B8DA7A4EC02B7496F26B3C9443AD86AB45B0F97C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YoudaoDictUninstallTemp.exe

Path C:\Users\Admin\AppData\Local\Temp\240758171\YoudaoDictUninstallTemp.exe
Size 4.3MB
SHA256 6745a7e6c0bdb4a402d4af36b4e60119bc0424974e08bdc64969a595c42e0687
MD5 ef07425d182a880cb0f0a594d9b092d5
SHA1 4c147bf93d6e64967048c071776682d53f94773d
SHA512 fe395a1f8b959caf780a5d3058b3b946620bdf095698397b604c51d09886a48a90cec797b1be6c5e64b91b720c87d8c5e2fa837f2ce20773af041baaaf584d61
SSDEEP 98304:hdEHEa1c7hP164hzvJny9Nctze3GFLOAkGkzdnEVomFHKnP60D527BWG:hd0EF1pDGNctze3GFLOyomFHKnPRVQBx
TLSH
T15726C0113D4C0076D11B1AB14AE9F77CF22EBE7C173610A76290B66DBDFA7814A2E427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YouDaoDictUninstallTemp.bat

Path C:\Users\Admin\AppData\Local\Temp\YouDaoDictUninstallTemp.bat
Size 266B
SHA256 5d00096b6de649be620f8389ceae72a6ba07a84258f165effcfd61258c8d46d5
MD5 6ad3109640638e6fb5269b230c93e030
SHA1 2b12fa539569e55710e2a4a0b611ae83524328dd
SHA512 f8db385f398d6f1f054e2c9049f085393dfd78b07f385c7f8e0b30aa15d77d3e8e35561c29e2f40c9400921207fb40e845ae622c69d5648de6d90d62e3d69143
TLSH
T13FD01201D2DA8F2A1D54523B1AE2D74ED1B50C6D3A4977148B51C55D125344DFEE7313
MD5 SHA1 SHA512 TLSH

Submit Download

f29e13153a35217a.bin

Path C:\Users\Admin\AppData\Roaming\f29e13153a35217a.bin
Size 12KB
SHA256 e53de948ca88a796ce1c2347311535a0bfc4daa89a45310a6528e08e403a8536
MD5 b2222866bd3242a0f117ab57d7256a8b
SHA1 f3b579eea81a540fdbd7503b5ba79f7eefcc1869
SHA512 3d3b794cc68f0191bdeb943261553064dcfdcd924196b118a573fee7456e8abca0a31af6c4af9315a12f675ea92367ee7e06719108a754ced03cfbf78ecef124
SSDEEP 384:+KqLm9NEB1anpOmboDA/BMA9e+TnfXFCgM+Lur:AHBspOLAyAo+bfMgM+Y
TLSH
T15042AF0D6C604F7444B9719E9C41503A2869A30990DFF5CBAD87EA84F2CEBB8B7D2874
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.1MB
SHA256 2f50cf178367f877aac873d0c1430c2da24fbbf8135092977285336141fc7087
MD5 43bde4892febf83fe82cbe830eff30e5
SHA1 a4923b98e0672f42987984beb6cb4e327ad6f93d
SHA512 12b0249bafb0eb320936bfa489ec58f70e7781becb9077f4326497fdb5b67b2209f503981eb33defd84afb9045da075b389aa8a45a88112dd95f0801ef33ab0f
SSDEEP 12288:A07qXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5qsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16445237AD35C118AF83605B482EAE12D681B7E669F2004C3BA5778FDF6B18D48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 ca24f480a3b7775534a0336f6cf75ece250cb3f6406557201fff6a81a3750380
MD5 51ebaf0fbd9a4a4a27e50222d06a16e8
SHA1 085ab07a6778b1b52718bf3bd6e90a2a61c6d56a
SHA512 d31eb9cc54914f3ce3dee356f6a8d5acf34cf69e209450c1c2cecc42af0f42d73e9d57da25a836a13d703d13d22d60eda2c1ca88477917327b4967428bc3829b
SSDEEP 24576:Ngb6bmBIi49WNNFpg1rSvFv7bYgsqjnhMgeiCl7G0nehbGZpbD:Ngb4mBIBhGFTDmg27RnWGj
TLSH
T10B659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 0881416ab9b3f183e7b63fca46ea798f61e17d7fba264af5d9d79a34f01eb36b
MD5 63ebe4f352f52797388c6f0d3ec9b2f5
SHA1 a78baae0b273fa5b30fda00906ed45c1027eee74
SHA512 cba13fea34b06ec0419dd88551e5c2a87bfb26f5ebd5662c267edcaa7ac74ecea7090a02eeea82eba57ef19ab092be7642e7da8454d03fd399ff210a89ed86cb
SSDEEP 24576:4G88u8FpJqH1Wzria7/mfsqjnhMgeiCl7G0nehbGZpbD:77ZFPqVha7/UDmg27RnWGj
TLSH
T18885F16577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 81fd7b47726d5dca477623c901d064905a5a093861946920e4b6ed961e7e6843
MD5 2d335540b8513699b12c742714a1db51
SHA1 4efb47df1163137a9ebbfaae4bb483523eefed7e
SHA512 6bb47bc50fe92d052503de71755b8802b43c54ac36702e39ce13a53ccac601eecd5424bdccee395e0dc623ba27e960d11de396d17f68e6581d3e2fcf62f68e29
SSDEEP 49152:WBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjvDmg27RnWGj:5G05lO43bSD527BWG
TLSH
T1C1D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 268201e1700a5aad9d170027a16c63cd935a74451033d261e88b5883c7c8ee17
MD5 a9f5d2175cd8851c0f9587bb3f0bee6f
SHA1 31501542d0596ae0375da8b5bcabf16df9c681b8
SHA512 f0d5ff0b2939903abb570b9b1fcbeb1e075323ed0a5e8067541845b34b611057333060363ab670f5b3bd3556fc3c495a53d3ebb07596aec0fe6d58b6df309fa9
SSDEEP 24576:4fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnxsqjnhMgeiCl7G0nehbGZpbD:Aa5POZ3+Jt2pasx2+m3Dmg27RnWGj
TLSH
T18F65BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e615474275e93157411b4515f9ecd77a9f1c71e657a96d4bb60a7be5bff692b9
MD5 875b598ef53300bb0b6e0bfdc715694f
SHA1 4cc7b3549fe48f806111233af954b6b19138ca49
SHA512 01f6a2b85a2a372cdf0acbeea51a9293ed81b5dcf476fd5a8bd0a6922c8e5ebb8851dc712026b1988a4db9056a763fa82046f050577488305976106bd5462751
SSDEEP 24576:vNcwHdjbyQ4nLC18lb/EOjowL7FkXsqjnhMgeiCl7G0nehbGZpbD:vNc/zEOVHF0Dmg27RnWGj
TLSH
T17D857B2623E901E4E5BBE1BE89779546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 650e45d4a43446aa77afaff64a81d9db218c976783c304ec32c238ae24ba5b39
MD5 b1a15a8aad949c96475a28d92b012797
SHA1 c5f9c6245cc69181dcfd434cbd17c13143179b6e
SHA512 35d7a1ab57db2618933e1338b8dffc61f92d71a7cf95d8140da4e72f845390f987b535bd145d19589d57080f9060ac956e19c8c2aad6d8cd537ed2fc2f3cb754
SSDEEP 24576:Q8kNvNnaFeYhJNtmZBmlsqjnhMgeiCl7G0nehbGZpbD:Q8MwBtOmZDmg27RnWGj
TLSH
T1BC55AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 0198aef0ba52311d4093aeb09674a149a8306d9d22ecb36334b98e209880563e
MD5 e2941b97d7a279df3a606812539b003a
SHA1 2956f6a7a8549efb99da903f39547ba8193a7632
SHA512 01c2451937fb60588a7e355b62a46aecf3dabb04c8c7745bc36e2be6904c53675c2864e7713322a8af7b2d405daa199320ba1b9f13e95e265e8380e9f928fe99
SSDEEP 12288:CHvUrBFrEjwaQLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:CPUr+NQLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E555F12F22AC18E5E676A17DC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.5MB
SHA256 771e02abd6b43632a5d9ed6f66808bb2c39016ad70addcec45045932351b7693
MD5 a30fcc197e972a3d402273f5d3bf3572
SHA1 d48c6b32a0e384fb0d8c5cc1229096b7dc09f865
SHA512 9cad1db888327926987487ccaca7d0fbbe060fe14372d7d9b3d16c27027514b2b537fa948193b947cfac5c1ae990eaa11daa50e031dde12c41168c92aad42e17
SSDEEP 24576:OD3FHshBIYQgAOsqjnhMgeiCl7G0nehbGZpbD:ODVHeBIAAiDmg27RnWGj
TLSH
T11475E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/716-91-0x0000000000400000-0x000000000084B000-memory.dmp

Download

memory/716-1-0x0000000002610000-0x0000000002677000-memory.dmp

Download

memory/716-0-0x0000000000400000-0x000000000084B000-memory.dmp

Download

memory/716-8-0x0000000002610000-0x0000000002677000-memory.dmp

Download

memory/716-334-0x0000000000400000-0x000000000084B000-memory.dmp

Download

memory/992-146-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/992-26-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/992-25-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/992-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1856-320-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1856-384-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/1856-98-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1856-105-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/1856-385-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1856-99-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/1968-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1968-123-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1968-130-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1968-124-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1968-135-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2212-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2212-386-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2212-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2212-140-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2976-327-0x0000000000A50000-0x0000000000AB7000-memory.dmp

Download

memory/2976-395-0x0000000000400000-0x000000000084B000-memory.dmp

Download

memory/2976-321-0x0000000000400000-0x000000000084B000-memory.dmp

Download

memory/2976-322-0x0000000000A50000-0x0000000000AB7000-memory.dmp

Download

memory/3220-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3220-111-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3220-14-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3220-20-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3792-71-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3792-65-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3792-63-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/3792-293-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/4040-112-0x0000000140000000-0x00000001401C9000-memory.dmp

Download

memory/4040-119-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/4040-382-0x0000000140000000-0x00000001401C9000-memory.dmp

Download

memory/4040-113-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/4772-81-0x00000000009A0000-0x0000000000A07000-memory.dmp

Download

memory/4772-75-0x0000000000400000-0x0000000000522000-memory.dmp

Download

memory/4772-307-0x0000000000400000-0x0000000000522000-memory.dmp

Download

memory/4772-76-0x00000000009A0000-0x0000000000A07000-memory.dmp

Download

memory/5036-58-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/5036-274-0x0000000140000000-0x000000014015A000-memory.dmp

Download

memory/5036-50-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/5036-48-0x0000000140000000-0x000000014015A000-memory.dmp

Download

memory/5456-56-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5456-37-0x0000000140000000-0x0000000140160000-memory.dmp

Download

memory/5456-38-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5456-60-0x0000000140000000-0x0000000140160000-memory.dmp

Download

memory/5456-44-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5544-85-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5544-92-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5544-94-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5544-398-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5544-400-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5544-317-0x0000000140000000-0x00000001402C9000-memory.dmp

Download