65288a05f605a4b9e858345a087337025197e4c30cbb229c811ecaded8c61392

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 12:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Size 2.0MB
Sample261023-pt4essch68
SHA256 65288a05f605a4b9e858345a087337025197e4c30cbb229c811ecaded8c61392
MD5 4c1887ddb449f45406e8e3153f2d2acb
SHA1 83e971f4caf2c3550e25560fb8bd6549da69934c
SHA512 e8c3bd24170686dafcd763700e40e6fa8aa14bdf1ffa17944d822a42cf01735494f10178b8e90dfed0867a3e33d36e3f9a984f24059fe23700874539cc5bad57
SSDEEP 49152:IJ0kHCMIX0z96GhH9hi3Z3fDuYkjsl82ot4+Ej2Ez+lneVqGhiwqDmg27RnWGj:VmYkjsl82ot4+Ej2Ez+lneVqZD527BWG
TLSH
T18FA5BF64B5458427DCD166F28B9C7766441CE8A447355CC7E3C82EDEA3A43C2AE32CFA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3568	elevation_service.exe
6112	elevation_service.exe
3252	maintenanceservice.exe
3276	OSE.EXE
5724	PerceptionSimulationService.exe
400	perfhost.exe
1700	ReFsDedupSvc.exe
2100	SensorDataService.exe
4980	ssh-agent.exe
1448	AgentService.exe
5316	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4f1eae36b68fd3f0.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaw.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000c441a568eb62dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fc78cf68eb62dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001846a168eb62dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b1b15f68eb62dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d0078ca9eb62dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000739b5568eb62dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000027fa9667eb62dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000013c5c7a9eb62dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001d30446beb62dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
6008	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
6008	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
6008	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
6008	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
6008	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
6008	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
6008	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
6008	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
6008	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
6008	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
6008	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
6008	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
6008	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
6008	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
6008	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
6008	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
6008	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
6008	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
6008	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
6008	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
6008	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
6008	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
6008	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
6008	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
6008	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
6008	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
6008	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
6008	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
3568	elevation_service.exe
3568	elevation_service.exe
3568	elevation_service.exe
3568	elevation_service.exe
3568	elevation_service.exe
3568	elevation_service.exe
3568	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6008	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeAssignPrimaryTokenPrivilege	1448	AgentService.exe
Token: SeBackupPrivilege	1700	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1700	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1700	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1700	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1700	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1700	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1700	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1700	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1700	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1700	ReFsDedupSvc.exe
Token: 33	5316	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5316	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5316	SearchIndexer.exe
Token: SeDebugPrivilege	6008	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	6008	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	6008	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	6008	2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	3568	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5316 wrote to memory of 1440	5316	SearchIndexer.exe	101
PID 5316 wrote to memory of 4560	5316	SearchIndexer.exe	102
PID 5316 wrote to memory of 5796	5316	SearchIndexer.exe	103
PID 5316 wrote to memory of 4932	5316	SearchIndexer.exe	104
PID 5316 wrote to memory of 4160	5316	SearchIndexer.exe	106
PID 5316 wrote to memory of 1200	5316	SearchIndexer.exe	107
PID 5316 wrote to memory of 5896	5316	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-23_4c1887ddb449f45406e8e3153f2d2acb_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6008

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3568

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:6112

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3252

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3276

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5724

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:400

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1700

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2100

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4980

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1448

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5316
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1440
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4560
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2956 2980 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5796
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4932
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4160
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1200
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2956 2980 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 af1f3b61aa79a157d67bd8880ea7678b5f1118bc018b84ca7497c71d824d9295
MD5 6bdaf409f3401ed62ac1041c68f4b493
SHA1 6c3a1481365584d4be8d2fd1db4199bd416c3ea8
SHA512 00d7d171f6e7c46a7cc2f94d44984a78af82a596068e4157063a15522a4926b698b702bcc9f564ecacc1eb27ee84516dcd1a142b2f5c4d961e22b09d33f7fe40
SSDEEP 49152:fb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnvDmg27RnWGj:d3q6HjB8D527BWG
TLSH
T1C2D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 829462a3dc4e5ebf397ad2263494472e1ec6ac55878506751149f49f18f77a1b
MD5 239ed532e8260bc79c0b429d21eb3b6e
SHA1 436b5e3bc5385adccb2906211ba8d2d611931760
SHA512 a36936201776df1b59754f575611f13f8ffd0b38cb920387c1def48d3fb14164c3163c90b54494fd9b516f7355564fd27b311b27cbedafe4063fff0b9bdb6c36
SSDEEP 24576:AXYfDtczAcsqjnhMgeiCl7G0nehbGZpbDi:3tcpDmg27RnWGj
TLSH
T15105F129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 de95d836366be9f456fc3a31a58c998faa0f7b352c384161472c52e493bd5a31
MD5 0525c9af972e7c3195151687415647e5
SHA1 5ae6fb0a29d57864f2f307f1edbdb243510abf30
SHA512 f069562807f30d2160b379997051ab87780b5bca4f060f21727a0ac0e39c2076d8372f37e070d08a3a6adcf843d812f6fdf6409931139a11d7b6d43825f701b7
SSDEEP 24576:Z0Le5ji0hmxirMDsqjnhMgeiCl7G0nehbGZpbDw:ZPji0AcODmg27RnWGj
TLSH
T16B359E26F6748335D073C0B9C5D2A68EED723086573089CB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4ffb8c5bb4b979f5a71fcdb939fd88a0087b58ee6ef12357435d54f6408a13ec
MD5 0e95f2df14c7a7bc73376a193672a641
SHA1 3d2fd48dbf5259ffc811a2b04b193ce6fb78adc1
SHA512 d9f4d73b314095b6e4f4e6e16fcd411764ac482b3d16b4ae29572710168b5784715ceee164b13d81171a19708c22a83f6a14551df3ae6d61939bf5bc49d2c635
SSDEEP 24576:La7/ezSC6vUyD/aqgrvWE6q8wyuFsqjnhMgeiCl7G0nehbGZpbDJ:m/ezSC6vUzPvxHjy6Dmg27RnWGj
TLSH
T1BB755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3f1404e1adaa51ecebe641531e8458285059e9c5d52169483ce1e4474bc39b93
MD5 fdf455a1c9e0eb9449cb68029c71df8f
SHA1 f8c002e637bf133a03483cd17947a8399696c196
SHA512 1168b25d77693e986fd4810849682cdfcec21480863717917b2688d0da768be656fdf23825e8bea058909a938877a5a375d4832740921a7e1500fbfbe3dbee73
SSDEEP 24576:mVbqPb88hv/l+6QsqjnhMgeiCl7G0nehbGZpbDe:mVO88hXl+DDmg27RnWGj
TLSH
T1B5559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 8afcb579a70a7e236adc5057c0967c18aa9c3eb8058a7700221e4d85d98d8709
MD5 8aecac29249e1dde416c5aeed9013f6c
SHA1 843cfdcddeb98a130d8f783b0d07a7c68cec55d8
SHA512 beadde31d8195b373473695c0342296579b9fbc203396de97f60c101680c33f3661b9e72e260f020164a9aa916142d83199a17fd6d6f9ecea9093967d5c10e64
SSDEEP 12288:URXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:URXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17EC423BE924C11CAEA7708B5C3E9F51EAC177E5698200C436AA37DFDE6B5454CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 28d03d745db7087bbdd59cd385f66a387d134be465d8ef5f3dd3d0def5a8a6b5
MD5 3d33009922ea99f46e6fee2b4174cdd9
SHA1 08cfef1ec6f7da27449e52c393b628dbebcda2f7
SHA512 0d6ec76a8f772e51e12ad8526d004fd4f80093c408ac4da07a6664cd76920ffd6e941c073d6ee791919a940c132729ddcf7503982a262f0f2dfa36c7461098a6
SSDEEP 12288:9eBNUbTVO86U4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDM:9JIU4sqjnhMgeiCl7G0nehbGZpbDM
TLSH
T1F205CF7BEE28FCD2C27A8DB95791C600E77278314B21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 872a5adbe66bf67f427904452c7e46b8472393e374f3cc28c11546be8fd528bc
MD5 ce2a0f8bbc785dc09d52950d8f8e0796
SHA1 4f5497ef9674411277d4740c50941e0315766ba9
SHA512 186519180134587179191628b3e6558ab1f016701489954862f93b379faf0a6d4c6fe47d670f1efc5b07fda6894d23d1241cea88f165d29f0ccde90cb3b23cc1
SSDEEP 49152:mQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THX:mQvGAdlCEL8c/yRNw5CJD527BWG
TLSH
T127266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 c0415ef3c2fa4cf040d0d75244cbb1bbe3c33f550918c98e438c82ccf8065764
MD5 ae007293bc96dfc4008e98fd8feefd28
SHA1 ce657ff7b5fe4689853a98ba109970583d2f4011
SHA512 d238f0490b93089b557cf7c24d5875eaefc6c30478179f79cfe955c443dfb29f93bc0176d370539f9d2889bd329e3c1aab31fa006282e5630481be385a16e37b
SSDEEP 12288:EAwSfxL/2Dc34DLLmt0LDQewsAjKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:ZdewsAjKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15C15E031FA74E036C77B0DB20B76D71A182D7A204F6119C3E3E89E9E99702D12776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 aa82fa3b3cb8d5e1913335372a0c0f5ffd0fb2a89b5b26f8081e053e893e6fd4
MD5 4cbf98c4ce771728aa22e6eb626cc3c0
SHA1 9425cd3ecdd4ee86a2d86832c9623ff8c55ae097
SHA512 cd5ccdb8aaaad5f2e2efa3944876d6cd0ef078f2bd769817150de1c864df6d61617ff501a66e4ad0de2447845d1e0115a235677d803204075f4ee0154e9d5788
SSDEEP 196608:0UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHmVQBWG:0UEtQevvqc2W1cpV2EI325B
TLSH
T1EC474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 32a458f3eb6a363432418ce50c03e791afb9b3589a2585657980852234a3ee1c
MD5 01e1c81eea7d2cf26ca86a08f7557c1e
SHA1 9425dac948dff6eda50d75baab0a44a3ba02c515
SHA512 9912cb085687aba809106e8ee78296ecb0a9acd424eb92e8dddffefaa2a7897511465034c089904b4ec22af75bea69797ac07f74c1f6ade6a1258e7fab2ba04c
SSDEEP 49152:qCbRquA/m2yL5zQfFiV+XenmE3/z+Dmg27RnWGj:foqtVjnmlD527BWG
TLSH
T168D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1446f392b54a5623f3a2b28d5d019e1fbffef38bac70e9f6682f890a8e8640de
MD5 e3cbe52496d17e363aa51d60d69dcded
SHA1 69005201ad98efc95ee0f1b12d4a9ec093b8bd9d
SHA512 c43a563a05311e98332d5cae1555e05016b73c5582bdd44a429bd2269818a31ffe837e360d0a011b24741f81ef58f691d31f67f6ac5d5a7617b5c330835b4b01
SSDEEP 24576:2AhGLJIFoiwtA5l7S53xsqjnhMgeiCl7G0nehbGZpbDA:2AMyFoiq51Dmg27RnWGj
TLSH
T14E359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 6c4434a56820387afd1a88704d5490809428453a7a2f690940a0cea386bae9f2
MD5 e16f13a15291f4c180e008506579c903
SHA1 d877250c3593b3ee759f4ac9c29658b598d637e5
SHA512 09bc6cf5bf35be0edfc14798cfcf71cec4949e598bdb3f185605f2619b82382f82d64db88080110ac54a726a3fc5213a6d0cde4994369d809b51886b1da92f33
SSDEEP 12288:Pmw5HEjsChNVBFgl0WDm+ClXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L6:uwuoOWWsqjnhMgeiCl7G0nehbGZpbDB
TLSH
T19905F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 80c66908bb96e137a73104109ec22cb8bb955f1912a7b70e5e04d992a7b1c93b
MD5 ef47e96c7fbfb65126bd3066d9de1526
SHA1 b5239c09211f95565eaaf3ca777f8c07e9e8870a
SHA512 0c325bfbf4b09370f50ccb273ab656df132219fa2c64a33c04b7e73695af1a152cec554f02d3b801d1531ce1a37be3fdc8acab196fa929b9dafd9b194bd95b95
SSDEEP 12288:bBZ1IyaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbEM:1ZuLsqjnhMgeiCl7G0nehbGZpbDa
TLSH
T102E412AE239820FAE5634178C6E5D609E7333C63673003CF166656AA6F739D44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 4770c323bf363c3b5f7a2f42875f06496e9e4bb65e1fe9855e33d33b2241d234
MD5 dd5c5e2e04754287c62fcf32856ada95
SHA1 31804c92bf2c0fe69d87de0e30abb5378649ecf7
SHA512 bbac59e038716fe1babd82b9dccd98c5226f190871d4283ea6389413d450fc70949c5af211d4eb8e5c69cbf37e8c7f898e4a87e189b091b31b94ddc8baa144ed
SSDEEP 98304:EQRQyi36YOcPQLvw2gAf+PN3AD527BWG:LQyiKayX+PNwVQBWG
TLSH
T1F1667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a78d2cb6d7e73aa9312d3781f933360911e50d40bafcf5a2487a41afbad12f47
MD5 6802ef996c8a7e08ba2beb33c16d4bc2
SHA1 ef11407bb6fd89b5c2289e4d969d42cfe1f2c0ae
SHA512 03cb5033aabbfaff062f1ec447a03569cbb34dc6e139d848eb925318248e7822541b45a1ca7fe9f53e4a19a16d437e7da45201fe7a2658d11d2a8919220c0956
SSDEEP 98304:gQRQyi36YOcPQLvw2gAf+PN3AD527BWG:3QyiKayX+PNwVQBWG
TLSH
T15E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0d6687f08297833d5f08eef755b7245b23bab351781030f43960b63c70fac53c
MD5 d5d980bc7488d0454edc47e7ec9a80e7
SHA1 7ffb70fd93591b9e7f27a9e0e1f427396ba39d9e
SHA512 264883baf40c4484c14bcbf6a9e608a777df61f1a72b3cc725e15224e684049828879468c904e727527eabe7329ec148ca9592b583dc0dcdf86ff95d55377889
SSDEEP 24576:8wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL07sqjnhMgeiCl7Gp:C68Qg55nhheWu7PNU3/ODmg27RnWGj
TLSH
T14AB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5a6ad27f27feffa8de49d6ca0ebbd4a7561340e04a5d987fdce2d90a479e74d2
MD5 f1beb0d50ec781f1812ad80ccb54a74a
SHA1 523587bee128436dbb08defb3d2e44eb5af0d6bd
SHA512 f7ce65828dcf4f35180cf21712c24b3f94f243e7ffa80ee5fbce96f89ad67fb0aa19d18a2f5d8d14233f2b68fc0de112f22f649ed533e7664101063ea44a7d09
SSDEEP 98304:Ry5112gYy5azzVvL69nLKnhZrD527BWG:sLIHmWhNVQBWG
TLSH
T176167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f7e6ef9820baf30ad876f41c21783b0c5c6be93715c4c602fb59c226b8a17559
MD5 ef5b25977a62a1f7296351f17376aa2a
SHA1 3dc29907c208f80ee008a93f16bde0d641f5f925
SHA512 3932026ca1a7df9dbcca0adb188b47998fd281c621e450bfe4e78ee4b7e9b262e23dd4bcef3288ff3f4772bb9b9cd97064392107c3d18a8defb1f033c1ff961d
SSDEEP 49152:fB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl4Dmg27RnWGj:hu6JmVxd2d4D527BWG
TLSH
T167D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c203f7b3ce7fb0a06175f1d60162affccefb31edd6a6c0672a9a4edbfa2a0934
MD5 e0eefaf9678c89f613af735159afd74d
SHA1 874d960ef1f407e1a34f6bdad3481638ae07edfb
SHA512 80cf02f03b5d1c6ac3f6e6bafe841403c52633f03fe48228c3c65c6b4cb25abf39ac90940ef0364a890645ec7be44a141e282a966d843121476d812a64ef5f00
SSDEEP 49152:o1hpsNoJpF1A6UU44CwH7R4xEDmg27RnWGj:omifPbRlD527BWG
TLSH
T102B5BE13F2D800E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2e8f662383f894873730377a18101b5b4928b46f99f7c7b09177a83334facab1
MD5 d3203af6792bb432e40b26beadbbc661
SHA1 166dfbaa2c173f6574ab51c3a67147cc83630b9b
SHA512 c630ce9f06082cadd2f04554f4556a2d6586c9b27b20d0ccc450cfab20037efb536cc9b2ec9452489580225d3e4403d557924b44b964d8b3ade83548d1bd451a
SSDEEP 49152:ISuZQIY0Be2KRRVtOnks6NMHq/Dmg27RnWGj:S5dKTi61/D527BWG
TLSH
T1FEC5BE13F2E900E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 97fc35f7f2c99a7e66ae99899ce25db441fec11bfdbd4610962e9d466f2a0a23
MD5 92621576cae7510040ec7d02f56ff381
SHA1 00a5814a9ad9d334fcd4065514b13b1d30cbccdf
SHA512 91b4d8fa15af1c3444536e960e9b73633e140fe315ccb03fe8d4522c7b9ad2455a144f6bd322843251baa9501d9dc77607ba64680fe1574e1eee2f21f9cdf84b
SSDEEP 49152:ZhtSn8EApI0figngiDn0AP5wIDmg27RnWGj:oX2iyphRD527BWG
TLSH
T1C995BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 3ae067bf88aa7505e565afa59c854ef2ec3664e463ca76e7668e0eab03278738
MD5 94c906ff61f36fae47c5cd0772ce0910
SHA1 ee7322187b417546d2379c7fd251447c4aae9d88
SHA512 05829e048c0cf2d62d0ce98c8a259342397ee871a5c8b5b4f9552fdd1a64af74bdbf5227b08d6234ae33d74c7ff00f86f6edf69216c6bdbc9bbfd197587bb769
SSDEEP 12288:ufXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE7:ufsqjnhMgeiCl7G0nehbGZpbDJ
TLSH
T165C423BE915C01CAE92644B5C3E5F15DAC173E57E9200483BB9B78BEF7F24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 89643a7aa5dfc3c3e0b550cfb6d5aaa9e02b3d0bcb329a1f4fc7259b0189dccf
MD5 9a81ec1bcaec37c867e809eb769be5aa
SHA1 1f799c1f849aea4ac84b451b814f219aa4151b73
SHA512 c5edd4a70bd3204e96b5c6a1847d1ee546c8322aa751179859da53b132d308dcb551f4357c1b04db8079dbb0b90b715af3ee9615fee5b8a2bcd876554db7ff8f
SSDEEP 12288:9uXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE7:9usqjnhMgeiCl7G0nehbGZpbDJ
TLSH
T178C423BE915C01CBE92644B5C3E5E15DEC173E67E92004837B9B78BAF7F24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 fe9843775675da7f26ab2bef0c7eb8664e46133e9b28169407b2461437aae769
MD5 6f7f98068cf5c87b2977679593f0ee5f
SHA1 aa8954df28dd6c37d9a9a7b209166b70ef49c11a
SHA512 724e6490821503ea811465ea27dce23bd40f7b99f0a8ec0f7b341d5450d2c18c4cffe13f1d5dc7a6483032979694983589355e80585f739595aaada855824c0e
SSDEEP 12288:HAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbEj:HAsqjnhMgeiCl7G0nehbGZpbDd
TLSH
T154C423BE915C01CBE92644B5C3E5E15DEC173E57E9200483BA9B78BDF7F24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 1b0f8084d3270ed642b70511f428ff8a7da9fe885cd548cc8ead651f3550baf4
MD5 8ad3fd8425b128f7be3fece36dc010d5
SHA1 a6f6d1278244434743024515c82a17d9b49b0e84
SHA512 1555db92e56af789c63dbd26fc7e46b178c7cd9a8f02a83f356fe1dbc761f154a5008007282a0a275ab4df3e99c05c2eeb1a8d19adb47cb6e9c42012693de5d7
SSDEEP 12288:QVRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbES:YsqjnhMgeiCl7G0nehbGZpbDs
TLSH
T112D4236E535C01C6E83285B5C2E5E11DE8377D56E73005CB6B532CAEAFF26944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 685af71c413decb623930c23968cf01584a6693f29eacd2c59595937106784e2
MD5 ff1583ecdc136f3549445987ee36abe9
SHA1 dc7c9bbbc5cf363c6e591c09e87f82810a06e63f
SHA512 7f34ab5f68257ab3a5e56aae5c850eae7bdd2679ad571d7506b610f3488069b94508efe6bfd89da06e90de984c190d7b227421bc1f039ef42a15456aa616ad3e
SSDEEP 12288:PpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbEj:PpsqjnhMgeiCl7G0nehbGZpbDd
TLSH
T195C423BE915C01CBE92644B5C3E5E15DEC173E5BE9200483BA9B78BDF7F24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 18bd5264454dfb3ff64452e89ae37671222368fef5d30dc23cd0496944fe65fd
MD5 58d2d21290f49392911e2f27e04d94bd
SHA1 e4438e6059a68c3b9f4b0d80b4e9617abe373703
SHA512 0d391b465b81028cad77b508bc68cf13b45c29ef1ad9393bfc76fd4a2c339bcc34e494c809c24a0b815822a1799fc7ecd4abed9994cae1a19f88c705b3e13bb0
SSDEEP 12288:xyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbER:xysqjnhMgeiCl7G0nehbGZpbD3
TLSH
T1F2C423BE915C01CBE92644B5C3E5E15DAC173E5BE92004837A9B78BEF7F24684B3D422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 643e0d3888304a8a75b8d5cbd85e931517bbda00caab0c20cf80ceb31f8b2e99
MD5 cd63a4a483785b95893d71d1fe1591e8
SHA1 8869d7a07c83b5961752433c503ff5417af3608e
SHA512 2aa896eebc48176b7441200d0ad19c8fa97287ff1ff1a92b961c461fb1cbf67c244698b855615fe72be79576945030ffc334f65cc8ddfb1ea3a0d913add8b865
SSDEEP 12288:ZGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbEo:ZGsqjnhMgeiCl7G0nehbGZpbD6
TLSH
T1EFC423BE915C01CAE92644B5C3E5F15DAC173E5BE9200483BA5B78BEF7F24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 1213428e048c58ffc08c85f1af3b81dd1b847d6cdded03b590e832b3b2514a07
MD5 f9fc214047967bd47a1d02146c33d8c2
SHA1 64dd969a02bd5070ad8560bdd6c0aa373b84684c
SHA512 73b76e3f5e7e6b4d9b1d8a32991b63587a6b19a17bd9e64d9d18d17875ea14da7d84f13f923c504e8aa31d6edb0cadb2590b28b79d0dcb562dd77ca206afe86e
SSDEEP 24576:ZZMSzFVSOOsqjnhMgeiCl7G0nehbGZpbDC:ZZMSzfGDmg27RnWGj
TLSH
T1FD0501A9B35018F8EC63813EC965D90AD5B37C5A0B70C61F13A5366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 6872c44de03a3bece64771d0b9f1889d540bdd216b6f121bccff92e0d7d8d4fc
MD5 730a3e5181c45a6b8a65eade13dce6b9
SHA1 6b9eb6854e10e7eab55ecce7b2cf81192c5ae0f5
SHA512 b1801697c814d16649d5431c449a95a65a70c537411152cedc6b6e313c0c1a858565cd8e874bd0b5ddeb52a6a5fc4cff0dcb0cfa2e9f2479c3cbb13f6ce54243
SSDEEP 12288:KbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbEg:KbsqjnhMgeiCl7G0nehbGZpbD2
TLSH
T130C423BE915C01CAE92644B5C3E5E15DAC173E5BF9200483BA9B78BDF7F24684B3D422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 c3a61207ab8b5fadae56a7369cf7f40fc855fc86d0b9c59f2e638505688df3ac
MD5 6e9b81b8ca821fa159d5ff9547d98342
SHA1 e1c5a3ada04baf2b148ca999f4dbd27a5191299b
SHA512 d3147d9ec5a448c0e7237b31b3c0bd40a968fd8999960068572f3dd5a43fca2137f9931c5b82821d35d9ca0cae940c6d11895d8f2d487c7726b9d46efaee95b4
SSDEEP 12288:9nXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbEg:9nsqjnhMgeiCl7G0nehbGZpbD2
TLSH
T1FDC423BE915C01CAE92644B5C3E5F15DAC173E5BE9200483BA5B78BEF7F24684B3D422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 ba46188266b1791bfc911b16526c7cc3d041d2673e2c18426ece0dcb9f81c203
MD5 58e030b083aaa3284ac7a71472973788
SHA1 43c857e94bab398e9f3ca97132a2aafc830b7f26
SHA512 d435c982093da83436484c2aefe9b55f71a4c26c648621a37a3163a5973ae21a81cb59b8c557f896c0258250f5598fba11d548b8cc438ac9990bcc4ae3203586
SSDEEP 12288:wyPz5L8aXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BzyasqjnhMgeiCl7G0nehbGZpbDK
TLSH
T1A9F4025B73A530F9D5378138C5A29A06F7337C3247204A9F17A516BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 ffb3e5790ae1de364d0b5fc228405514f7476d4095d3028c004fba4f4e3b8f27
MD5 00be95ab7c644ddeee1d65892a21aec2
SHA1 3a417d3866e3cf7e2d801f6db2974e767fda96c5
SHA512 c9f677dec8c5eede80720e9947e338520e0b9cf20db6c32052410dc5e1bcc16bd23d4e0ecb269e38e3fc7686c28be07ca1dd140a910b90432f076ae65369c931
SSDEEP 12288:YbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbEN:YbsqjnhMgeiCl7G0nehbGZpbDf
TLSH
T1B4C423BE915C01CAE92644B5C3E5E15DEC173E5BE9200483BA9B78BDF7F24684B3D422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 cb798ebf880918b376c155d9439e6991c299937c4d7cd67e7b2012e1229838c7
MD5 0044d467d89babbc6ed3e45b0969d1eb
SHA1 260888ea65a94bae01062db457785243584f4570
SHA512 e81d25c0e67d570e0e9dd80cf8b278c35e0c5a23926098a4e9965c0e04c1189e1cfe99a662ecb7de76f967b03c4fe1140c55f122ff250eca722d7a1f8ca08232
SSDEEP 12288:ebXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbEN:ebsqjnhMgeiCl7G0nehbGZpbDf
TLSH
T180C423BE915C01CAE92644B5C3E5E15DAC173E5BF9200483BA9B78BDF7F24684B3D422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 1c3996cda4a34e44cc28e07f41a5a0ec3a0a66ebca2be4a696c964134986314a
MD5 9eb622e14b851be33ab8ab8dfd90352d
SHA1 de17630660cecb405bece8190bfcae384aa1200a
SHA512 1c7a23ac09b2f898c2937950f17fc4ce35824de6688b27ac28bf9adcebc0040b3549f8fb5c41117318782816d30709f207b5ad77fde29b0f05d59303a5e32ec9
SSDEEP 12288:jyPz5L8aXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbEQ:OzyasqjnhMgeiCl7G0nehbGZpbDu
TLSH
T1A7F4025B73A530F9D5378138C5A29A06F7337C3247204A9F17A516BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 b7bcc73041f220c66e397724e980bdb52a84aec042e2a561b532e81677fd3081
MD5 3d9c6f5be74460de3691842929a30191
SHA1 3c7fbd75eb6f237201e00af7c0b744e268b2c551
SHA512 32ae062398e4e7f02f7f569ad2bf9db9d0d8e04b959b2a0f2dd9f0293e282895e6c0e2ddd8483148e3e73f83dcbdcbbf8476c4312fdb027bc70319a8c8777896
SSDEEP 24576:PTHaLl3z0zDwsqjnhMgeiCl7G0nehbGZpbD+:PT6Llj5Dmg27RnWGj
TLSH
T1880501A9B35018F8EC67813EC965C90AD5B37C5A0B70CA1F13A5366A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 52067e96e32577901224ae5f23c039015719e3361fe56d9a61f47d71f71abba5
MD5 6fae4638d4fc16f9dbed849294a8f111
SHA1 2e5478c0834985ad274dab5d78e92c425f406a5e
SHA512 471f6c4e86063475a6429dc3a3b636d1adae24124683530749f21029169faf3d6228e8645d0c2912a8f1809be091d11c1e2b1438da41f40beb6bbf4dc87305a9
SSDEEP 24576:737d9CHKy7GZEsqjnhMgeiCl7G0nehbGZpbDP:b7d9CHKyaGDmg27RnWGj
TLSH
T1C625CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 cff078feb383ca49e2370f837458804672a790d4bf31dafa25bee4108966fe9c
MD5 9d6894a49209ea4ed2e2663aeda1935f
SHA1 3e4ce9cf773fb1e4cd73f6d94db40137fd4dace9
SHA512 d3df2691c42f9e72ebc89ec68c2c2b2465516fca08fe4c81b011880981b59c1c3e3910d564db24386be9ac577112c9d422eb236317d309ee0c533bd825cb1f37
SSDEEP 12288:9gXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbEP:9gsqjnhMgeiCl7G0nehbGZpbDx
TLSH
T18AC423BE915C01CAE92644B5C3E5F15DEC173E57E9200883BA9B78BDF7F24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 8b66703bb4efed37f0a55d369d8667dbbc9666f720e97cb099d0b1c5fc869d62
MD5 318a1706afb734723e91b1b2deef5d42
SHA1 c3bdea581d04228cd0f4a77f48257dbb4e17ba6c
SHA512 d013126f5486f499120a0f7d822207902af53f5c1c81174ba21d47f19b873bdfe82e6419070617e2e7db7efcf14776310acfa25acc7ff7073b31cf5659b5882b
SSDEEP 12288:a6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbErC:a6sqjnhMgeiCl7G0nehbGZpbD0
TLSH
T1C0C423BE915C01DAE92644F5C3E5E11DAC173E57E9200483BB9778BAF7F24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 65bf547a5dd3a2dd107a5cf98ed07d53e4233f21872cc50fbc3e2e49d0be7f97
MD5 9e8aad9db045a6764f0b1c06bf8aa2ae
SHA1 185960450fdb5b40849cc369132f17e60ae02f9d
SHA512 6fbcf208ff9651c4ce96afb7a2be2a48d4addcc9aa8f919feabfbb11fd64dff9e42c3488506138c7d6dbd2979185864db58311167311144e1311a4388092bc7a
SSDEEP 12288:Y9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbErO:Y9sqjnhMgeiCl7G0nehbGZpbD4
TLSH
T1EBC423BE915C01CAE92644B5C3E5E15DAC173E5BF9200483BA9B78BDF7F24684B3D422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 c962d328a7d5dbfbb379a451827ebe7950d7629a20c604fec9841b7b15b31478
MD5 6ddb595f88ddaa8b7d2aa6d330e538b3
SHA1 989b3364397c57a573bf9bb525f1efb5be7f00a4
SHA512 133dca72ca8e15e0cb22b592b1d14280b89ddf2f24471cb07c6e996dc8b774eb0e246fb612adbf109282d148dd4c0a30d9514884095c61859fc7e028b5978ba4
SSDEEP 12288:AbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbEs:AbsqjnhMgeiCl7G0nehbGZpbDK
TLSH
T1E5C423BE915C01CAE92644B5C3E5E15DAC173E5BF9200483BA9B78BDF7F24684B3D422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 a0a24f80d5e0944b6efaad4c40e4dd99b39073005fbc22e594108272e0991822
MD5 14335531f0838e08bfb794ff7c13a373
SHA1 869fb6b5000b68c4c43ee4970568af8a99477b8d
SHA512 48ba4f1a1ebbff691d9094460d6eaba5fad5eb67d7d6c58685203df7f0642a13692624ce99c97180657c29f7abfb28e58afa10d94a0dd2aabf50f2147d01a5e7
SSDEEP 12288:tgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbEQ:tgsqjnhMgeiCl7G0nehbGZpbDm
TLSH
T1D7C423BE915C01CAE92644B5C3E5E15DEC173E57F9200883BA9B78BDF7F24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 905f93c87be7f22afc46ff6367d64a09237eaeac41a332caf3284c6edbe5e502
MD5 06a4df4372e6373d1a97635023ec40a8
SHA1 0fb3fc547bb9e71e4ac9445dc5c64da3fbe33135
SHA512 5928e7304e34d292e6410754e966d902fa857af8794515b6aa8e7d0e508a9a2138bee4635258659b4fd4047942176446c33938a990659b25657e573f7c3f2b40
SSDEEP 12288:IzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbEs:IzsqjnhMgeiCl7G0nehbGZpbDK
TLSH
T126C423BE955C01CAE92644F5C3E5E11DAC1B3E57F9200483BA5B78BEF7F24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 79aed6a89f40bc23a5cdbc3b8ec76a2be54400ecea4b8f6c8004c60d35e81939
MD5 c896d28e277f502a763f2c9da1f3d851
SHA1 1ed1e8fa2c2f2981c3a93b0a7ae0a08d409b73fa
SHA512 cb6147afa0313d3b980b1663259c93a7b3b482bfaace95a0b1df5947fc904d0675cd16ecc2764f91ea4f413def03c88118f5993c4e4743a893491e410b01deb0
SSDEEP 12288:1pXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbEy:1psqjnhMgeiCl7G0nehbGZpbDE
TLSH
T1F2C423BE915C01CAE92644B5C3E5E15DEC173E57E9200483BA9B78BDF7F24684B3D422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 ae7bc5af7027e93fec54ca8ed5ab02fdffd8594f84082c0d97de7bb5b91d7b5e
MD5 5c50faec981e4b868a4c0df9621746c1
SHA1 ff2b7b03a46e213b6f18ae1ba409a516263140f6
SHA512 9c066c966312758d8a46f32b4f2f296a230c67d23cdbf3f2498fad4c55c28d550386fc3766f2639daa33f85052325e637e10ef2a557fe9174b47e8ee56c75c7e
SSDEEP 24576:Xfwvok9RX6wkyAI3sqjnhMgeiCl7G0nehbGZpbDD:RMnYILDmg27RnWGj
TLSH
T1AE35D029EBDC04E5E177913C89B7860AF6B278591B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b58456ab94ac58bf02c71600bb9c2285ba5a44fb40e3bce86d1a57c8d7ca1207
MD5 aebea58511770140dbf8e48bd6316895
SHA1 97765d552ea6abb7d7ff4fa718a3e1f4ab132db5
SHA512 45b4f1bf6517db587c7c29b025fd469dafed01b055387e8522e5f0f696925154d764a04ba32a2c6efbb0a544a9fa4113c25cbbae047ec265fabd42615e60c3d9
SSDEEP 49152:IYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0oDmg27RnWGj:WySzPgD527BWG
TLSH
T164066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 aabea11b6575905276eae5176248f4cc49d45242d1d4c1d0baefd4983a550e56
MD5 706d1ef7c50dc2ca1231bf0e7418331a
SHA1 2867c982f29de39fd720034dbeaf7fbe249ab0b1
SHA512 5af5c1f414086dfa25066bca2a098387829989149fee8273648e41830296ef34e4e4993d65a8b45dd6e1505016fde19bdaa12626dd2be12f2421b6c513635ed0
SSDEEP 24576:r47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYesqjnhMgeiCl7G0nehbGZpbDF:r47JUQj1irIhCnDHUPfF/4Dmg27RnWGj
TLSH
T14E65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 c352a098a013b52729e3d15165d62bdc0e51067a5e09be1ef9bc33d9f969289e
MD5 046b5bc343219c67007496c9e76a7b0d
SHA1 28bf164ff4272126233155bac328db61c0513ab9
SHA512 9b12335e6b3911e376dbaf3715468616e634217429e93c5e37f6949ace2545ba37575f83b926869b08be21a2d00f70e16289462f00551726fb424bc25bf1166a
SSDEEP 12288:9NsfLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbEg:SLsqjnhMgeiCl7G0nehbGZpbDO
TLSH
T120E4015AD29802D8C06E5179C3969605F7333C2697E093CB67D1F87E1F766908EFAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 ddb430cf3acbb573a54101c706e0cb2ce52841f6f6f49e950278ffce8a92b7b5
MD5 e759de49a88f74b4ad9a4e3930e87af8
SHA1 db5c9114084e32cd9c54350833f7dea6c564e412
SHA512 c5c17bf75ca3afe46bc0385599520cebb637dcec24d9bbcaafa305ad35cb3b3c42ab99fea2612e31d94f20586ca8a3668e15ca70ebf89b7f4da41930804cec6c
SSDEEP 6144:kgsBC2na2SV5/Orru0RotMxAWgoF0rf9KeUxmfEiU8I1cu3FUEPYFFLAeYLuiLWJ:AUyn0pKqmF+YCiLU5QJoADs6XYv7Jn
TLSH
T1353527107666CB4FC6A940321E33D1CCAB707D11EE05AB0772C9873FC576A59BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 8ffbe35adc7c49f4e808bb191aa995eb47b0b84ad6c9dbc0b8c80fa683933f48
MD5 ce0b536f7d9905d31846b7c05e7ead1a
SHA1 0eae27210a44a7b233d726de2ac966c7b100151a
SHA512 70328a99031e3fb1e8bd6f924a4faf88afe05d589476b351c71254f6759da50703d9a127fd51a8cffa607d4ab12aca0ef87b31a79a45fd5d60736202f6a68c18
SSDEEP 6144:Qe7pShSQSVu+j2UdqRuEcKvKcKQbSI1KGqmfPx8gw1ocEe0fe6/u4UDdqYf2bpgC:FdBKvKcKAl8Z+FiA+49ehY
TLSH
T1045509419437A7CFD5BB6032072A5B4CAB64EC06B7096F22B7C5053ED82BB55A0F93D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 15f16b7f0cc0f79a68578a63ee1d7b0d1f4a532cd3da9dff56029ff0f8a4bf9f
MD5 f5ba61cf10bc9491b65c057242f0b1d5
SHA1 6999c883e13128f07679f18f4b5f99b2daac7e4a
SHA512 2a0489dbe3b535cddecf89b4ee1d922d2f804ef4cf7c35ec163fb06b3e41313c7499f3932b3ab2ae5a4f790c05067a1424bde302d11727b801be4051d00d788f
SSDEEP 12288:9M7jXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2jsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1ACD423BA934C118AE93605B482EAE12D781B3E669F1004C3BA4779FDF6B18D48F39517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c44e4fb4fb300dbd31c66c264acfc940c2fe2b06651e86ad4ab76824d9a10946
MD5 00855330d14100c6a98a848d51f3c346
SHA1 567e443b4a8b902cc626e2fda0e4e107c8face91
SHA512 d6013a2b26e6f842a946c68f926d420c8aa25d47a139f74adcb2972ad67f30ab12788acdeb4a4db7f26730492dcb570583cc1200aeca890e12d5d784eb74514f
SSDEEP 24576:hgb6bmBIi49WNNFpg1rSvFv7bYFsqjnhMgeiCl7G0nehbGZpbD/:hgb4mBIBhGFyDmg27RnWGj
TLSH
T1BF659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 09e174320ec39da3fdd8e29d52d1a32b034eae5f32846f59623ee6090094ed77
MD5 2d2ee13aa3d09be7a8de99d73860d722
SHA1 7d2694de1ee8aabfdf77823234127d74e1a8ef4b
SHA512 1f2d3a5bdcf97df1503019b9e88af05e92ea930e77bf47a9eac93c1db2d64f3cdf8cc841bb44d9189d81993569cc8861cd4c245924f4d32eb160ca0ad3cabe32
SSDEEP 24576:VG88u8FpJqH1bzria7/mOsqjnhMgeiCl7G0nehbGZpbDP:Y7ZFPqVea7/BDmg27RnWGj
TLSH
T15E35016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 b649d7309996c60784a0d2f6142a81ee38ae94df44aa1448b87169dfca745525
MD5 1ca83d51433310ec6614eef0f5e06c44
SHA1 7f1e2173962b87d6819510fb1d35a24037b85a3b
SHA512 47a364051c703da002eadfcb574449fc2fe021df29dcf9a6875f453d3ce8f0ae52368c26a0de5a5ce526684ce24f3d0fe1c3ff3310226c8ef8614dbc62886a34
SSDEEP 24576:QPUr+NQCsqjnhMgeiCl7G0nehbGZpbDI:QJQGDmg27RnWGj
TLSH
T10805F12F62AC18E5E676A17D8682C70DF6727862171192CF02E1817E5F73DE8AD3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 aadd3801edb6ae2e76df37603ec6667772a901d8fbff2adb06c286aadf775b65
MD5 c8d935a3f31fb3f30fb838d53ca42d29
SHA1 609875ac1d2b58cbb3c4e331c635eaff68d45771
SHA512 c64615b0ffedf743eb54d45a86fca7c6ceaf2d26362cbe927e3ebbd83a13567999c4669589e7533de9a6b2361641af6813eedaf79480c35ea45d7d7d0384450e
SSDEEP 49152:hBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj2Dmg27RnWGj:CG05lO43bTD527BWG
TLSH
T147D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 956a8bcc668274bf4687e2e816bac92ba355facb23c368aad48f8c2b8789e951
MD5 656d62d02e54e14f4eb0e84545fd1c01
SHA1 4a09dedc3b604fb5e7dece1c5d3191f421bf0953
SHA512 440cbb20e3a798a98bade5c6e15d02caac453625c67a067e75132b306d6f75663bcab112811be1f804c474d0e659a31d02ddbf86d832ee30d82211d5682d1797
SSDEEP 24576:afa5POZ3dpFWVM50JicR2hG0lasx2+47eidn8sqjnhMgeiCl7G0nehbGZpbDy:ya5POZ3+Jt2pasx2+mODmg27RnWGj
TLSH
T13565BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ddaf0096b63ab0117946f030546bbbe67871a4da68106dab726fec789773557b
MD5 02069f2468daf7ab96e1c5d68d706f89
SHA1 2047e2b778d172a35eda45fdea5cc901173d6c1e
SHA512 cbef7925e28824b6251e2f64a0aa578136722b2e6bac69286657c32c5e41dff2e079bee5aa0ea8f8524b2c2a579738a5aa1ee2ca4e0491816130338e20fef0f1
SSDEEP 24576:TNcwHdjbyQ4nLC18lb/EOjowL7Fk2sqjnhMgeiCl7G0nehbGZpbDX:TNc/zEOVHFhDmg27RnWGj
TLSH
T13E857B2623E901E4E5BBE1BE89779546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 412ff58b9a4ca5e3ab2b1c873ab29325c8c70576f54893386ff5733f24cb99e1
MD5 306fd29a5d4c12858dd630d39e25d6d0
SHA1 16f1f43c8582fa5faae0ffa52b708e6cc1bc8a36
SHA512 eba20a40f14efe6ad05f63a0fedbd8a04c1025e94319931bc4d2d16d0bd05da2e0e64432adf7bcf4c0430128ceece11b1d634b91750668e73fc77887f6865321
SSDEEP 24576:g8kNvNnaFeYhJNtmZBmIsqjnhMgeiCl7G0nehbGZpbDM:g8MwBtOm0Dmg27RnWGj
TLSH
T14E55AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 f89b03b4a12567a1c0c22cdc9a46b3f04f53b1f0cab3f686bc943fb3ecf8de9b
MD5 c0a754a8064b2ad73cd8e877832a7ec2
SHA1 9d1727211030ae3f80b3b2a5610918a79eb5e315
SHA512 89ea4e4b8d0c12dbb1fb99e8755856b5b5fba743846f2ca6675ff209337c8a9f101afe87c85abba75730d2b51cfc1bf0d55899f015aa2623573df14842cfe4ae
SSDEEP 24576:mD3FHshBIYQgA/sqjnhMgeiCl7G0nehbGZpbDM:mDVHeBIAAjDmg27RnWGj
TLSH
T11525E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/400-79-0x00000000008A0000-0x0000000000907000-memory.dmp

Download

memory/400-122-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/400-84-0x00000000008A0000-0x0000000000907000-memory.dmp

Download

memory/1448-126-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1448-132-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1448-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1448-134-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1448-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1700-94-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1700-119-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1700-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1700-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1700-326-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1700-88-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2100-105-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2100-312-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2100-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2100-99-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2100-120-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3252-62-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3252-39-0x00000000017B0000-0x0000000001810000-memory.dmp

Download

memory/3252-47-0x00000000017B0000-0x0000000001810000-memory.dmp

Download

memory/3252-45-0x00000000017B0000-0x0000000001810000-memory.dmp

Download

memory/3252-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3252-63-0x00000000017B0000-0x0000000001810000-memory.dmp

Download

memory/3276-51-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3276-58-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3276-308-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3276-50-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3568-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3568-141-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3568-21-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/3568-20-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/3568-14-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/4980-121-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4980-311-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4980-111-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4980-117-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5316-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5316-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5316-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5316-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5724-75-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/5724-69-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/5724-67-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5724-309-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/6008-66-0x0000000000400000-0x0000000000602000-memory.dmp

Download

memory/6008-0-0x0000000000400000-0x0000000000602000-memory.dmp

Download

memory/6008-7-0x00000000024C0000-0x0000000002527000-memory.dmp

Download

memory/6008-6-0x00000000024C0000-0x0000000002527000-memory.dmp

Download

memory/6008-1-0x00000000024C0000-0x0000000002527000-memory.dmp

Download

memory/6112-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6112-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6112-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6112-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6112-258-0x0000000140000000-0x00000001402D4000-memory.dmp

Download