55266e8028361bd8213c90063af158552196fe69e889415ec2a7211b36e87c01

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/10/2026, 01:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Size 2.1MB
Sample261030-becrmsvtas
SHA256 55266e8028361bd8213c90063af158552196fe69e889415ec2a7211b36e87c01
MD5 7feaeac7ed6f5a6c069c38448a70f88c
SHA1 63bd2188b0e1a384fa419d7a24cfc3085f50221c
SHA512 4e0c9eb2a4953a5c93c899a189743d49d60ea38be5cccca504a0bbf92d5c461b738282a27782c09a6c93e5b4d95a86f378c6feb140d79a35aaef3f96d9f86cda
SSDEEP 49152:F8SpvEhgOFKFQgBbbeMHfdVesRWjNSibOyyk5WQ/lFTjN4:a74QAfdVesRMhLm
TLSH
T1EBA55B1177E95A29F1FB2B31AEB841954A7B7C616F35C6CF13801A5E3930AC09936B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery ransomware spyware stealer trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
90	3276	Process not Found

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe

Executes dropped EXE 24 IoCs

pid	Process
2568	alg.exe
3712	DiagnosticsHub.StandardCollector.Service.exe
4648	fxssvc.exe
1908	elevation_service.exe
1072	elevation_service.exe
1052	maintenanceservice.exe
1084	msdtc.exe
1656	OSE.EXE
2740	PerceptionSimulationService.exe
2068	perfhost.exe
1744	locator.exe
4276	SensorDataService.exe
3272	snmptrap.exe
2736	spectrum.exe
1296	ssh-agent.exe
4348	TieringEngineService.exe
1044	AgentService.exe
2452	vds.exe
3032	vssvc.exe
1144	wbengine.exe
3408	WmiApSrv.exe
3020	SearchIndexer.exe
2760	Reader_sl.exe
1124	RdrServicesUpdater2_x86.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4f73d75f288da564.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_157859\javaw.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Reader_sl.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RdrServicesUpdater2_x86.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RdrServicesUpdater2_x86.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Reader_sl.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrServicesUpdater2_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000965630710a68dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bb8604720a68dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002aa51f710a68dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000caf2f2720a68dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bc413c710a68dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006eb913710a68dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000025ca64710a68dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3736	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3736	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3736	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3736	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3736	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3736	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3736	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3736	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3736	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3736	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3736	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3736	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3736	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3736	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3736	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3736	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3736	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3736	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3736	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3736	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3736	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3736	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3736	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3736	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3736	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3736	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3736	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3736	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3736	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3736	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3736	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3736	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3736	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3736	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3736	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
1124	RdrServicesUpdater2_x86.exe
1124	RdrServicesUpdater2_x86.exe
1124	RdrServicesUpdater2_x86.exe
1124	RdrServicesUpdater2_x86.exe
1124	RdrServicesUpdater2_x86.exe
1124	RdrServicesUpdater2_x86.exe
1124	RdrServicesUpdater2_x86.exe
1124	RdrServicesUpdater2_x86.exe
1124	RdrServicesUpdater2_x86.exe
1124	RdrServicesUpdater2_x86.exe
1124	RdrServicesUpdater2_x86.exe
1124	RdrServicesUpdater2_x86.exe
1124	RdrServicesUpdater2_x86.exe
1124	RdrServicesUpdater2_x86.exe
1124	RdrServicesUpdater2_x86.exe
1124	RdrServicesUpdater2_x86.exe
3712	DiagnosticsHub.StandardCollector.Service.exe
3712	DiagnosticsHub.StandardCollector.Service.exe
3712	DiagnosticsHub.StandardCollector.Service.exe
3712	DiagnosticsHub.StandardCollector.Service.exe
3712	DiagnosticsHub.StandardCollector.Service.exe
3712	DiagnosticsHub.StandardCollector.Service.exe
3712	DiagnosticsHub.StandardCollector.Service.exe
1908	elevation_service.exe
1908	elevation_service.exe
1908	elevation_service.exe
1908	elevation_service.exe
1908	elevation_service.exe
1908	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3736	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeAuditPrivilege	4648	fxssvc.exe
Token: SeRestorePrivilege	4348	TieringEngineService.exe
Token: SeManageVolumePrivilege	4348	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1044	AgentService.exe
Token: SeBackupPrivilege	3032	vssvc.exe
Token: SeRestorePrivilege	3032	vssvc.exe
Token: SeAuditPrivilege	3032	vssvc.exe
Token: SeBackupPrivilege	1144	wbengine.exe
Token: SeRestorePrivilege	1144	wbengine.exe
Token: SeSecurityPrivilege	1144	wbengine.exe
Token: 33	3020	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3020	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3020	SearchIndexer.exe
Token: SeDebugPrivilege	3736	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	3736	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	3736	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	3736	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	3736	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	3712	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	1908	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3736	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
3736	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 1464	3020	SearchIndexer.exe	111
PID 3020 wrote to memory of 1944	3020	SearchIndexer.exe	112
PID 3736 wrote to memory of 2760	3736	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe	122
PID 3736 wrote to memory of 1124	3736	2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe	124

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_7feaeac7ed6f5a6c069c38448a70f88c_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:2760
- C:\Program Files (x86)\Common Files\Adobe\ARM\Execute\4430\RdrServicesUpdater2_x86.exe
  "C:\Program Files (x86)\Common Files\Adobe\ARM\Execute\4430\RdrServicesUpdater2_x86.exe" R32
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1124

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2568

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3712

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4716

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4648

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1908

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1072

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1052

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1084

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1656

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2740

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2068

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1744

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4276

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3272

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2736

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2600

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4348

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1044

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2452

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3032

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1144

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3408

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1464
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
Size 1.3MB
SHA256 9e750524d2cff4e1a46e11dad604baa2d0f359bba63d20777b0b45f45c8e011d
MD5 d0e194a3262293026f90c0389cde05c4
SHA1 f4231db97f00e062388f30f29a87af25714f7640
SHA512 f59ed8338ca6f38cce4f3ec0099c14ec29535d24323d3ea1c3a6f1e9df54f583121af9a6f7888f222d7d223f588a9c6ae0666875ae7a8e1769baaef9e960ce23
SSDEEP 12288:vF5GGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:d5mnQ/tbw/2Mkjy6Fr7g0on
TLSH
T13D5522273B46EB53E91205B10C9287A5A3BFCD90BF9567D76744222E89BC3C019B734E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
Size 1.7MB
SHA256 95ddf3a2b1b1d582a9d806de8bb0b29b64b79960c954d9d92c63c58cced97693
MD5 ef6ef7751f3155719b55fe439a3c3b39
SHA1 4e765b554227aaf043b71a8f6e07005cf2bd9f92
SHA512 5ca3bb3a27f1441b37afca6bbd58cc460c4d11e2f22e2271c880baa16803d778fc8021adf091e8b5bb2dc65e9520d6818743662b4c774665ddeea38e86258c85
SSDEEP 49152:kSgouvAeFfenxyQTXS7uQ0NIkQ/lFTjN4:kS1uxaxnS7u8Lm
TLSH
T1E7856A0267F94129F1F37B71EEB993645A777CA1AE39C50E5280025E0DB4A90DE72B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
Size 1.6MB
SHA256 e9be386b5ec206457443f4d3c75c14dfb9287eaf8de4f6459bd9f6cf03335697
MD5 60041496f36cc9e0c1f7d0bb4c604c77
SHA1 1df64b3a4b9d41adac2c9dbee180f47e05d73742
SHA512 192738f149ecf64d2798d1b71c21bc505430fb1edf190c2cbdc8af589e6abecefdddcb04fb0beb5dbc7a0883d5fb90c86cecdac854f88b3ed1dad93f60aa19b2
SSDEEP 12288:i6dVWnxlMzn7nFKbltn+Ch/m6XyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0b:57TAbD+OmeynQ/tbw/2Mkjy6Fr7g0oU
TLSH
T12075E11037D0C036F1B329768ABFD724556DBDB15F6882CFA388162E5E706E0AA3171B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f35bd66e2bb6e07a3ad1ab58915185d34a7db0f9ac1a8039245862f3a1927754
MD5 bef92af4e6ec165a16ffdd2819d553ac
SHA1 ecc6e6b61adff9785c94529854dc45ba09b9cf80
SHA512 52f509f54d3cc577961aa8d67aec043d5483b67eeadf7e87fa448509c006bb36acfbe091a8fc63222d339edf4e4d11fb1b79ed3139d0880ad62b9c728b3c3f04
SSDEEP 49152:Mb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnVQ/lFTjN4:23q6HjBxLm
TLSH
T1EAD58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 52d2a5d0506cb4b40da460a6bebe9c2869aacd12a1b82c51ffef155e45e51dd1
MD5 4ada69ddedba3d1dd3780154eca11107
SHA1 e5a7b055f4f7d685a84c1c667a2788db52e917cc
SHA512 73a3be8b34def804738063e9f5377687ad520e7ffd13d2d5a101a039c8032e7f5cca33b627fc94e6d13af104cb01ed93e64af9e8f6b47331557504b60775b93d
SSDEEP 12288:I1XLsswWkxy2lRq2czA6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:uXYfDtczA6nQ/tbw/2Mkjy6Fr7g0oT
TLSH
T1EB65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 b1b7bc2facea352b8c26ffd9aec8b80d2e39e7f2280495618ad9a0de9ec284c1
MD5 91f8cdb8f51d937d0b07a270fe6bfcf3
SHA1 ab42c80b95f279e5d33366352e1b454a4bef6077
SHA512 f9d14ab47e767cc047c5cd335cc0d462815488f86f2de7088c2671a7b268de5e8f6bb68f93fff523b9c2c6cc3f6e62bfe9c99bbe1b824ff13a08179122e6bc2b
SSDEEP 24576:x0Le5ji0hmxLrMdnQ/tbw/2Mkjy6Fr7g0on:xPji0AlYQ/lFTjN4
TLSH
T13F859E15F6748735D073C0B9C5D2A68AEA7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 89679ab8a045ecc2e315a7f2909fa6de9a09117f1f75598551e4e0761d1b4b40
MD5 1edeb9b8d91ad1686624e0b623f4f195
SHA1 50fd266d463b1689aecc13bdc5433523e1cc4070
SHA512 416e731b2d089bb1daf4c5962edc3a7467ae73ac7176cdf02bde2cb3428bfeeecdba572697d1a18ed6df171a25abc504e208b43464c863c33c2392d18fd20ff2
SSDEEP 24576:fa7/ezSC6vUyD/aqgrvWE6q8wyufnQ/tbw/2Mkjy6Fr7g0oL:S/ezSC6vUzPvxHjyMQ/lFTjN4
TLSH
T127755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c205dea044f913d30b213b9df326da8a9c08b7a25a958f88c13aae9141a49441
MD5 313ffed14dd42df2cec0d8cb79b64678
SHA1 bdd5a4ae479d390ef2b84c0aef794da8eb4aebe5
SHA512 2990574695e373eadf3f2c5721974529f89c2990c6a5264864e0633866a9863edfe908728595aeff88c0717de6cb98c7fbf635f5ace012e2291d00a4d99fd310
SSDEEP 24576:hVbqPb88hv/l+6WnQ/tbw/2Mkjy6Fr7g0ol:hVO88hXl+xQ/lFTjN4
TLSH
T102559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 81b05380784b9e76ea0cd0b28a821435aedad372a124e16a4677e5c0e6506a26
MD5 ff26cc495e58394f58808f9ce92c0c8c
SHA1 c85e322c167e532731a1b36915ede1fc65a5b401
SHA512 e0bcfde1a946e200189dc2b4256fee3b04082df59da7192a9b30b08cbfc238c03058d19da36fdf02fc9bbce1dbd476bbc1422bf36f2e809721d155704fd01a8e
SSDEEP 12288:sz5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:szJnQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1855523796A24F897FF2B06B15CC284826B7B0EC1BFD4A74E6B44362D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 995d140f3b5ec71fb9ab734855fd9fefa854efca2d84fc756edbea97c51185e6
MD5 25b3d98d1dacae486074db275c947d36
SHA1 474d142344bdff2ebd84e38a74798c07cff93ce0
SHA512 ec834e6fa58bf623ff180a74e367275a63250ce688dc1f5dfb059e58d091148a5372cf8f0986d79517c63741c48ac0a4f2bfd690a57e3f9301a8845cfead9901
SSDEEP 12288:4eBNUbTVO86U+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:4JIU+nQ/tbw/2Mkjy6Fr7g0o6
TLSH
T17F75CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 423045cc1126923aef4825ef8c21e24022cd965e7813aead2388974cc1dd1261
MD5 78b92f6234bdba11176ee9c9ddb2efb0
SHA1 25b097017063badb7999925e42be164d954becc6
SHA512 c428230bd93bfda6eeb7fcbd756b2ed9d7af750cc4d76394ebe5e47d57b18b2f6f37a63e31b840af7e5a779fcd691cf6364df39c7321923da604cb859bb565ad
SSDEEP 49152:cQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THU:cQvGAdlCEL8c/yRNw5CELm
TLSH
T118267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 8313c851e5f7680adccec6b87c38804f5bd4aca7b463c6367e562095ea8f7246
MD5 abcf615d9284d8dbb5590fe856723f6c
SHA1 ae3e9c9ab66696c7fa18247fd8cafa6859fe552e
SHA512 0c2fd9b07664397938acba7682ef2bce57bfab5e99b10f27115d246893c3c85eb06a63f0ae163c59ff0bb29e95d0390e5964f65516fb00b02f69e67ea1392c39
SSDEEP 12288:zAwSfxL/2Dc39DLLmt0LDQewsAjIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgi:sQewsAjInQ/tbw/2Mkjy6Fr7g0oY
TLSH
T17575E031FE74E436C77F0DB21B22C706593D6A604FA11AC3E3A84A9D59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 fbe02c38e576f14ecfec5eb41a5eeb94f5099dc5715e5e077f272abd231b0788
MD5 0ca332f3097d38916e4d1abc2ee5cc39
SHA1 7c3be41409cbd30503414ad835d11e402d3de620
SHA512 c696cc5d9263ef57e1ab0acc93c6158685d6561553e1a929fe8d7c630fad47869f904787c9477986ba990616a97941c56a2268436729eaa652da5794c4dba251
SSDEEP 196608:bUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHzL:bUEtQevvqc2W1cpV2EI32
TLSH
T1B1474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8c842ed2d37fe970f294f64fe5ac9c5bc2d47de2aa23ebbd6e40361452adc6ba
MD5 962bb65ea1fedb0647a7162ece0dce14
SHA1 e85e36ab28c5ef4363761498be6b7014991fdb97
SHA512 a49abc4f24590e960d909b490f0d6480a19a05b19b1de3d41c9e6082e9f97fb8d8f9112ff99ce1d811afdab317b06d6652af3fcbffbc4d66bd7e09818c604d0e
SSDEEP 49152:7CbRquA/m2yL5zQfFiV+XenmE3/zoQ/lFTjN4:koqtVjnmoLm
TLSH
T10BD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e8657a4237bd34fcdbb20e50a7bfdeae38bce457111ede37b8af747f4f4829d0
MD5 00ad34150f1b175bdba3aa53f7ff146a
SHA1 b8484cf5ef3b2017088873e12d504c7026a42255
SHA512 805df535bf7c6e15ae45609ca2ad4676956d9375a9b3626c108d317d11e616059f5fe56cc6aeb4bdbc0c9328abbf74efe160ba4c4c4e276a18e82f091f63de0b
SSDEEP 24576:6AhGLJIFoiwtA5l7S53jnQ/tbw/2Mkjy6Fr7g0ow:6AMyFoiq5zQ/lFTjN4
TLSH
T11D35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 e4e6944ffc9725fb8e120d08cb7e9e691fbbfedb17541554e71e3afe4efc66ae
MD5 27d4048f74ef8d8d3bc00897477779b9
SHA1 46841ba17a22e17056b43b85a7280626bdd27291
SHA512 f2277daf2d3a45530b69d417e8e25a2d1dc91ff65eb753ef962f11bb46156e132c0ba716dc9ac148680e86b03f475bf38e132602bbc18ab1d6b6e420efceb335
SSDEEP 12288:Umw5HEjsChN2BFgl0WDm+CfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMx:RwuHOWsnQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T1C165F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 a2268b9e8b4bbb0bf7c9aea36ce4eac35c8fbf9db4186e6e571df84afa2b6f4a
MD5 ef0c1dc59230b1efbfb4f243b8f2978d
SHA1 e47ad570c22997197e36671e6c9092e3eb521787
SHA512 de3372ce81e7d0ac68a9858c8022e82d552402a25c6f8407755718031a769b85d5b94229a14e62c33075016a6203e82ec6189fe162bce5a2d16e760398cee678
SSDEEP 12288:iXZ1Iy4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:6ZuFnQ/tbw/2Mkjy6Fr7g0oi
TLSH
T16055126933A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 447d21d25a0e9a56b2869421f8e923b6e58fcb462ba147551faf5d808c79afe0
MD5 02202d717ef9f330d187b2e6abb4b169
SHA1 e364aa3fee43533f9a01237fbeaa29b2f0a15871
SHA512 ad69abde990e9a591504f698fe9b0df92c42080ad35784825940e14a0bac6601c40d70de0dad3979dc296f6cfae2a0fbbac27b1bdf744b34d13108ad05b0ffcd
SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UI:WQRQyi36YOcPQLvw2gAf+PN3tLm
TLSH
T1B9667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9011f8f6948d9c63c3bff3fc98e116d9b91f0e03ede624eba9767369e62c21c4
MD5 e75b83b5851c6908827a0bd7f70141b4
SHA1 e54d41b61b42b6a9ce79ba4fd1294ce6e6df4e6b
SHA512 b0207891afca74bcdca9ef4068bdb8b9ada4415ef1290fe86c73f96fcc28604e808a2de6ff3ab81f722bcd17d4e8a547db39c53463b343d01f002359b2e88a19
SSDEEP 49152:sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UI:jQRQyi36YOcPQLvw2gAf+PN3tLm
TLSH
T1BE667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d3fac6d212f21e4421b29b4331fd1031430ce4c27c73a80c1f916712ef9c663d
MD5 8288c41f1765949df9c2de8ee9a28d6d
SHA1 0147d89941f4517b7e0a31d6455858862a5cb296
SHA512 ee949fb768f32627c9a2a947d5347dfabb749b8c84ea6a76d85fc4ef1efffa426fc6d09e46f85b7eb946c59aeb7324b2bfd8c30e910cc56a9f29a7eff1a47e11
SSDEEP 24576:1wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0VnQ/tbw/2Mkjy6E:x68Qg55nhheWu7PNU3/YQ/lFTjN4
TLSH
T1CAB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 fffd74ba490343d797e90f14da25ff71879b7947b6c6d35770894194893a7cbc
MD5 19a149d22417eae4d2dc73b36fc43a3f
SHA1 83a69a3c31694663becf36ccc5c962e2b6042cbf
SHA512 d6fc88b8b33e49534e130b43b5db79e796a332c955c913f80b38485834fde7424a0ca9d37f8a84ccd0aedef64a5308c3cc3d95149a1cce3048532a5ab7cc565e
SSDEEP 49152:l3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99u:Ey5112gYy5azzVvL69nLKnhZ+Lm
TLSH
T14D167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c7f9e469c57113dde7e7be92a1f74ea145676f4ac542d3d9af0b1999393ae85c
MD5 d35ce2cefe0dc50708b4090567392c98
SHA1 96ff3e15015e64d84949b318f4d7df19cd1dedcc
SHA512 47ba9bc5312a3bd2f15eeb10668990c5a47585f788ef8f1ab212c9a1889e6b28a9f29a6a82c947ae618a12f968b2d829ee3e85f42d697fe879d549dee8909065
SSDEEP 49152:zB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glKQ/lFTjN4:Fu6JmVxd2dFLm
TLSH
T1C7D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2dd234a9af6d195aa8f85e1679af0f2e020be65c9390135391b87ccc770dc0ef
MD5 bb663df5bec61791cd4f8b5d285e8497
SHA1 03f60319157bf2a9df5e0ea95ba454f8e93bd7c8
SHA512 331b6f0e5c4653aa0a10349025397bed36651aadf6880ed68546506d9bfae512e012e025f0f5ba7f8e4e346c0302de1d49d944e8501d407e9a184ae6751c58b4
SSDEEP 49152:C1hpsNoJpF1A6UU44CwH7R4xeQ/lFTjN4:CmifPbRoLm
TLSH
T186B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 340ef22b8a5340099320b14ece47285fa3588b88eccb43217e414a04564d76d0
MD5 22834719414a438e76c94bb93a421700
SHA1 724787b4d3b6c1b6d6b8d6e66f1e5899b3dfde66
SHA512 9ef591a46d3a089a9923b02baf3bb198c76435e6c2e1c5f5b96df02c3a037115fc18347289461ce3679fa4119db9699d9d55fd9f5e755d699e707849ebb8e24b
SSDEEP 49152:wSuZQIY0Be2KRRVtOnks6NMHqFQ/lFTjN4:q5dKTi61qLm
TLSH
T120C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5ae78efe4142df75febf5bd31250f5ed65737bdbf43b5dd5447b36e83f4fca77
MD5 7a8102cc9426883085dfc9c880aa9df3
SHA1 c0ff4088a5f4e21b42e1886f472cc15fecd47a55
SHA512 0fc6f938083e9a1bf604833b7bcce79546878b7dbd92a571d468cc5bae1dd3c18399b80c69b22d7bd566f6cdb9163fb47f83e04b32eff796dfabff5f1174ab9f
SSDEEP 49152:GhtSn8EApI0figngiDn0AP5w6Q/lFTjN4:HX2iyphMLm
TLSH
T17E95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 bd0600983a999816220cb6c566de7a5954951e4436990c30e126b331c8797bcf
MD5 6f290e80d1bc2b9002a5b6fb44430cef
SHA1 0c88f0f1cc00275caf78a0a11f2c081a1355a6fb
SHA512 0541e7d21fcb2088d645c4a2fc260a4b9cd5b32f38b48f3044b5a8251ace465da02de9e125a5e44f6d5562d8094283e0237ba1b75aa010bd481983b87d47c98e
SSDEEP 12288:IhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:IxnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1585523697965F98BFA1706F18C828182A73F0EC6BFD1938F77482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 49c7febc6cbba49b90b86553f01cd12a1f28372e0d592ed9e26c1eaec3fa3366
MD5 4c7df845c86f12b1af8a3590d041cc9c
SHA1 8674542b7c27c6a548582a354565b08f166c1832
SHA512 170fbb58705a9191ffc0fe503a627fd637c1ff2b1a255651674d5e7bcd9714bf447d59966e330806d82935ce42e6a87b501af47d0f15dc6770c1b3a9ada257db
SSDEEP 12288:YEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:YknQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1835523797965F98BFA1706F14C8281829B3B0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 d929d8a56a6c64d6e5b39860026b889fd84b80107976a2e8ffd9e02ddbe677e3
MD5 96da20fac78346bdb8f826f5981f002b
SHA1 f700d5fdd97888d05ef78840fd9ed6eca2062138
SHA512 dcdf7e75f0448244679e6a9649a8c4dd766dedde3e5e6db138ab0c74ad7a146fe81a28ef39a68c0572bb933ee0b184fdfc7ed5312299f8cae6e86a5c60668381
SSDEEP 12288:wGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:wmnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1AD5523697965F98BFA1706F14C8381829B3B0DC6BFD1938F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 973fbe8b2030050cad5c61f964f05218074f8920bfbb53916760851a516f41d7
MD5 3dbc3d47e9b1c037c6bb82736cb8bdf4
SHA1 69abd0c09e5dde6df5015c46cefe3db874634a09
SHA512 0f0dc0d6a973de6b187ed17ff82c993eb978078f72d7769ec56ac632f2d09235e696f6016f53f61b66b03001c1150e24958a5580c8f642bb9d1edcced9c54766
SSDEEP 12288:yVTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:snQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1D45523693A69F4C7F92742B4CC928142E77B3DC6BBB1A3CF6B04111D4E793D419A6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 158159b493cf4a988e6397944714f7084af23451b241a278f06d338e1f51d097
MD5 3850596511c5f23f1b39935d065b8185
SHA1 548bf0f21eed61a20d36cd64cb3b592f357ec129
SHA512 f17b82f75d4fc193a234ac40354b85ff5dde1d4c4e3721a3154b860319ea68c7b9a9764cac20f7c620be6c37c2138b13a6f527af4ff2b87ec648576d9b5101e0
SSDEEP 12288:jLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:j7nQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1955523697965F98BFA1706F14C8281829B3B0EC7BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 eba6dabbb6cd1d7d6cce0384bfabb548b8896b86dc5c97406d03be1db37d0f81
MD5 21f421ce5f5ac21a88b1371674048e9a
SHA1 cb711e755ab08f6db534e82fb2491929c2153c72
SHA512 91c9e8d8ced13c3f0d86858cdc317a13dac1df31d29a44a886f05ae71ae6af882fb26af2ee12afc6f941a9bf26d5f99aa78802d9b50b26057b5fb88c380c2d9c
SSDEEP 12288:1wGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:1QnQ/tbw/2Mkjy6Fr7g0o4
TLSH
T1B25523697965F98BFA2706F14C828182973B0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 0cd55af8744e9766bbc7b78cf830f02fd9a41f554a186b0aab2aab462fd56868
MD5 b8095f958b5375b34ac04543bb7e61a5
SHA1 cf05701e64ad30b94306b63093d431944ade9f30
SHA512 2dbc773ec664299a2d0aedd54b1944731872bf609ab96f2d79afd6ba2a03e75d8bbac3dccf7403150f3470654028321065a666be96334ac7b1c86a3b49d52ef2
SSDEEP 12288:Q8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:Q8nQ/tbw/2Mkjy6Fr7g0oA
TLSH
T1FF5523797965F98BFA2706F14C8281829B3F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 2951c0d547e619cc6f91425fcdfafb1f1f161b7d2a97feb93052adc13d75eb7f
MD5 b74bd3cc5ecc9025ff4614c5935c13ba
SHA1 3805793980d9df592877848383ae7f4d9c774abd
SHA512 159288ed625a90b94fb6135b51ab1b2854ca63b510e58bbcb1e8fa01513b0be2b957bc342bb48a0ca3c50c2e5bad416ddb3456734f6835f1ef9cca963325e3df
SSDEEP 12288:DiZwbDzzFEoS2cPvykGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:uZM3zFVSOEnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1F87501A5B39058F9EC67427ECC518906D7B27C5A1BA0C70F13A8362A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 0214ded8508ce966dd14ac7f45d270af987c844b998ffa5fa994a76fa99d8814
MD5 188d3d7c2555a6258df7e59236e355a1
SHA1 af2c5526146916160d4416088718bfcd0d1ebaff
SHA512 79391a3602d6a1a239f66fff30be8344619d92659dc91498201518463421184a1d320537d5da6ffd511ce4761edc4ae1d1430f146e607b3de568ba87a3144045
SSDEEP 12288:9VGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:91nQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1CA5523697965F98BFA1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 fcdf5082df1b943111738d290927082e277f853d57f42510e323b2ca8b954e8d
MD5 142edd95befbe79d1e7c9151c2f6d51b
SHA1 d6242de39c778faf897bd5720f1de0cb1caee44e
SHA512 5f28f0be917ad21bc32d7233eacf7a14019adbef67d67044f8843106daeb28994565d843395bed9ece322e56502f384a09be7cde48e6a811fa531c2e0997716e
SSDEEP 24576:ScP4mcvIjkGOxhKP2l71nNKbrh/8KBtnQ/tbw/2Mkjy6Fr7g0od:dP4m4IpOO67W8KPQ/lFTjN4
TLSH
T1AE65AE2DABDC0096D0BB917485658A4AFAB1742A2F3286CB1160933C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 207d488b98d6cd56c62956bd0954d40f5123d64ac9b9498e36c6914156b4cd0f
MD5 82aa45d1dd7df4a73533d51b49ffa85a
SHA1 14f0c3a65d8b30d43d41107a3a9c0622b060dd93
SHA512 4eff9736c2323e94bd99c3d69c386e255a839273f948427719d0cb244c9d44c57148ceeaac4eebf916f6186e54a8939b85bd9898da94cdc826ef2cd69dad92f6
SSDEEP 12288:PssflGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:jFnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T13665F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdrManifest2.msi

Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
Size 18KB
SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
MD5 f5d4c05bc8ea0d4fc4d277abda7369d9
SHA1 f67e793b159bd1e75ed4dec0de352ea1b6583708
SHA512 359a966c4dc8d62a570b428dfb3e666a63efd6bfff7c5b5ace3bc97ea09ba701d9fa524f439bf9902746c2ecac9c1f76c90868b0152eb825b2a09a9474fdbb34
SSDEEP 384:MrUq75oUFtb0F+o5nfy9jdIYigYws0i9Db9Ey8RbmL4A8UiINyGNB:MrUq75oUFtb0F+o5nfy9uYigY9K5ALdH
TLSH
T19D820BA2B4408C11CD868F3EA4C1D726D672BC813D8591C27565F219CFB23869A9F7EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdrServicesUpdater2_x86.exe

Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_x86.exe
Size 846KB
SHA256 6a142c879a0676aef5c825d6fd6336800846167fab422d0f912096d286aa0070
MD5 a447c3cf3b7547e5a1e12dbb92d8c052
SHA1 d2b246eda6302534b21b2003719d9f911d0c77d3
SHA512 ce7446e337cc13a560a12b0b789813bfb5a96a6a9d25a8b3e2fc1ed884f0c4950f01937714614666befb9b92123d359b9597116e9ed9e8efd46b77a640d002ea
SSDEEP 24576:uSU4vrTQA/gK/c8DV5Wa1ZmPEKBLeiGA5nEJ:uP4j5gKU83W3FLeilVEJ
TLSH
T10C059E22EAD18073D563143102A66F368EBEB9310971D98FA3D41A4E5E705E1BB3F397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Other[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OA8BQZYH\Other[1].htm
Size 13B
SHA256 b633a587c652d02386c4f16f8c6f6aab7352d97f16367c3c40576214372dd628
MD5 c83301425b2ad1d496473a5ff3d9ecca
SHA1 941efb7368e46b27b937d34b07fc4d41da01b002
SHA512 83bafe4c888008afdd1b72c028c7f50dee651ca9e7d8e1b332e0bf3aa1315884155a1458a304f6e5c5627e714bf5a855a8b8d7db3f4eb2bb2789fe2f8f6a1d83
MD5 SHA1 SHA512

Submit Download

ReportUpdaterPolicy[1].txt

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TY6HNOHQ\ReportUpdaterPolicy[1].txt
Size 4B
SHA256 69bf0bc46f51b33377c4f3d92caf876714f6bbbe99e7544487327920873f9820
MD5 455831477b82574f6bf871193f2f761d
SHA1 f44217a81173869e08671753c52553646ff5d95b
SHA512 cbc0ee58e447428bdcf72fc8b03c8cfb086edbb14205b918e75ebeff1d85ff1dd254e9dcb387afbd3fa766c803937c306e0a2a79870c0d87abcb7ab93661cf85
MD5 SHA1 SHA512

Submit Download

Tmp2282.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp2282.tmp
Size 5KB
SHA256 b2e41f3d236f5418f702111b610f382663c8893d82d5284462d2133f0e0c0fdf
MD5 38c0245547bc1440fb56c7308c2bb222
SHA1 8ccf6f27b9644fad1c8f13d98e9d680154c8d572
SHA512 78da2e84d0ebb47faec6999320198da63e02f8653a0b0609a16675592ff26b2ecc8de6a3210c31e28b72d6ee340dcdd792207cba96e1ae92b72c07d1d9fec897
SSDEEP 96:HX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yJF46R:3ULc8pq8RuwdmL4pUQrNyH4o
TLSH
T14FC13BA388946C45EC27ED00B4C89A23EDF576591DC0D1C33248C2A58B923973BDE2EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp458D.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp458D.tmp
Size 5KB
SHA256 512146b59d21f56f01882290e8b1e93e0553b85435b4d31e4c51d3d9ccd14df5
MD5 8de699a7d8a071e752e129d70525fcc8
SHA1 da6fcbafb68dd579195ff775afcf64f4209ef52a
SHA512 43697eaa55d5b7ca68036110d2bd12e01f6fc45fc7e3d4baf99b1de506170707a4eb801d6460dfcdf491fd58bafa3c93b8aeb5e2b36435e5249a2d7fe6a30be5
SSDEEP 96:PX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yh54pD3D:fULc8pq8RuwdmL4pUQrNyh54pzD
TLSH
T1F8C12CA349907C45ED17ED00B4D8A923FDF2B6952DC1D0C36258C5A58B823973BDE5EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp54B1.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp54B1.tmp
Size 5KB
SHA256 e6bcbcb70401d63ff0746fcbcc63230269058736f7644151393edfdcec8b8765
MD5 1b7ade3253fc67477dea69ef2147603d
SHA1 b71e8e749a3461c9b37ff2c3d099b1911d9cc6a0
SHA512 0edd5eb1635b1599e50b368cb254c94bf1588acf1d063e89f45fcfd6fa625e33d2c7764d9d00afd53dec2dfb342e9cfe199d256edcff8430ae183d357d4382da
SSDEEP 96:7NLX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yGtDwwBq:RULc8pq8RuwdmL4pUQrNyGewBq
TLSH
T16CC12AB388D06C41AD5BBD11B4C89933ADB272992DC1D0D33258C6A58B913873BDE2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp8151.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp8151.tmp
Size 5KB
SHA256 a86ac1b119a6653e0c3fc24c2c40e44a7bfdc435fd81c4442af9d5526ef64e85
MD5 5bc2d1f7a5fd950dd51547ead6afdabd
SHA1 90f4e48ac87f4eb9dd10f1a80d46a7063f06a7d2
SHA512 45f18bf24c7f1102c17dd30aa205498f27336259ac3869c1d6129609a40385e68d9a2f353e3b13f18f40e7d1d32c4fb31d10f7b2fa204e24e4411183bb749f55
SSDEEP 96:7sX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yQRlOelNMQtU:gULc8pq8RuwdmL4pUQrNyYlOefM/
TLSH
T13DC12AA388D46C05AD17BC04B4C49A23FEB2B2855EC1D1D36258C1A58B913973ADE6ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4f73d75f288da564.bin

Path C:\Users\Admin\AppData\Roaming\4f73d75f288da564.bin
Size 12KB
SHA256 c53e8905c311eb762fbac225f594ce23b1ad40ddcc80f16de8ba0f252694455f
MD5 2da9c1efa1c1432a91c0fc7af97e35e0
SHA1 31b4729f088a7d5c884497c9c3aa11b7ec2ea1a0
SHA512 45db3c4a736ad2468fe2e4c03e2cb4c3fa6b146554dc2c41e00e6e96999257aba1a63bd2029a517cec1d6bc7a1f8e1bd88d79a0a9c8f72e81c5594222ede4943
SSDEEP 384:i8NurNb6aMraw4wmZ9b8LCBVl7pNZ22Mp:DurnMlEQGBPjZtK
TLSH
T1C342C0057C289E1B9FC807B54847E1DC906DFFAA04304AE9591C47CDF95508B6ABE1CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 a3370cbcafa393b4d2ed21d118e879f8c43def7487ba3b7d9fce0ba468e31281
MD5 e0b274caf2414cebd624f797f5773227
SHA1 a561ea65929576fe16652d2b678b3a165d4ff435
SHA512 1494aa6e13b2b2dd93ad1c2d1968e3609646ccfdf4fb53f0fc4bebbc6700b646cb24781aa15d6f89a52d96c7450ade669be4eb78a70e9f1b26f5caf49f367380
SSDEEP 12288:kFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:klnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1E65523796668F94BFA3B16B05882C151673F0EC5BF91D38FBB08222D967C3D00EA6745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 0d7ff83cb7aceb86c1bd03184de28565aaf37e6da13a0b2b1a8ef8c51f110f1f
MD5 ebc43dbc65af9902d73c309b5f25ea03
SHA1 5ddb629ce155f58c4ee9024e67339b6c00cad8ac
SHA512 eebbd120711618f25fb7866a2bcef89adc4da12a6f86dc75b0b22b15aa2a3669c13f1796052d743704917b46bf34909d416ba7e5a85f2ef92e304d6336c2c04d
SSDEEP 49152:Qa0h2GEkuAe73q3pp46zwwQ7Q/lFTjN4:Qa0hNYG4JwzLm
TLSH
T103859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 44d549ee61d316e5afcf4433e9fb0c3ddd3dd0b3ac4ccc8b0a9cdda64bbd7a5f
MD5 22fd645e3779660b182f16181406ae62
SHA1 6f37d25d50e62a9e76ec3ed4026ab23c887f9b9c
SHA512 674acef4e185bcadef406c28bc0ea6c10409fc3cd7120f8a56693dfbd22a12bde55dcfd62b5793982315932489e9497af07c03ee8b7ee0853ced9dd5febb54f6
SSDEEP 12288:ZhbHjfXUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:ZhbHjP0nQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T1DE55027D26AC30DAF53692BD88928546D732BC552B11A3DF2381427D4F3BBE40D7AB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 e077376c68b7c9a26fd18fdd4d4745c88c120a88eb54bb779b5735406b49a61e
MD5 36888af5f9d71d9e7009e36dc14fe76f
SHA1 ac7366f2cfb516d0ec40bf4d32ea263619d92347
SHA512 be0621b5a36dd184d4f91cde865cb1fe41590220c40c4e7784c440ee72d193505fd1352f488a079cb00d30ea92969770f9e6f56b689530c59d129bca6d5ed957
SSDEEP 24576:j3YgnJcRTk4yti+R5dBR/snQ/tbw/2Mkjy6Fr7g0ok:jIgnaTk46pBR/sQ/lFTjN4
TLSH
T11545BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 c9a787da8e02e11fdec3ec6e444ce04475729f2cd7c0ba6649d1cb371fe7ec33
MD5 3bb8d71000020d1c8bf531ad3ae1fae6
SHA1 13ae78bbcd2c0c44bee1c41277eec97bf7eca7ef
SHA512 3a89b9babdcea2d8d48eaad7730cac009a3c572228376c3aa26572294da92e149347a30d87ccfc8a22baa938c5438218f365a52df1318f6bc46674d7ef2b8464
SSDEEP 12288:JZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:JpnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1835523696614F98BFA2B06F54C838546673B0EC17FA1A3CF7B48212D967D3D40AF6780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 39b0b2c6aefd7235ff63ff3f40d16d5fc271b19396ec4e23db33651bae1db0a3
MD5 dddd3517d8e7448279b659884dd77eeb
SHA1 7302c5110c0496dc1083d00c9a7d2dfec70bf71c
SHA512 a2c6ec0aaf622d20c783771c99c43b5b038c0bb5017ca8f5d4e3499260fcd132f98e1fc65b5e23f371aaa453d6e3a0fc94d56158d1d2c7b21ac90e1f570c8287
SSDEEP 12288:uOb4A4LWOsvAYFT6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:XwL3UT6nQ/tbw/2Mkjy6Fr7g0o7
TLSH
T15175F155F7A450F9E92B817CC8A28616E372789D1764E7DF03A84A691F333E14E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 1978becafa73bb0e38cdabc5c3b59c0d4b6f150f7b38a61de5ed4447fd33a85f
MD5 a786416ecdb1256ccdd72667d6a14fa2
SHA1 9a84720deef0dea5081807b4fe08a9cadd49fc87
SHA512 82b547dfca9425fd42d7aed7572549c83c52045eb7f439a57737cfc2e22a73e70b48b226384a0f15c586bfb8a0e2925649e217f695a5f8aa2516a5967db0591a
SSDEEP 12288:8pFtCOeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:FOenQ/tbw/2Mkjy6Fr7g0od
TLSH
T18855022D36EC60E6E536527C89838249D37278921B6253DF0780817E5F7BBF81C7AB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 535235f4aec45ad8dc41df972ea8346c248bfb102f77978ce980218f31c5172f
MD5 1cc587420e0df15c80afa29c4e54bc86
SHA1 02cd8aeb6f4e1b0a52c775980da96c4b30540136
SHA512 9cc5e4af881d155245c43888ca8f0445851cdfacd60dd7b3354d2f99a10a222f5d20f556b416bfc9cea5281763a04300c3983188313fb4b52ac256225e6003dc
SSDEEP 24576:G7NM9YqZqmWMUkPjZM48Mv6bEhs1nQ/tbw/2Mkjy6Fr7g0oT:G7cBWMpPjN8DbEhUQ/lFTjN4
TLSH
T141659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 3f4771b98fd38606c67749b6db5ac86c3c7a3f19ea47f703dfb6794423ec6eed
MD5 c827fec77261a442faf4f00b247e36cd
SHA1 366c1c5799a2c9e5a08d57a8e1113f48e8e9735d
SHA512 220dd6fed3bf73b728ce2d2662e7ba23d095c595a980b1dbc7f1a650e153fd8b3b9eb4a50f33196bf9658b915412ac4196af61f4929d883d4cba17dae234fef4
SSDEEP 24576:cW6BApg2YuyuNDYTabvcdvNYf8km13nQ/tbw/2Mkjy6Fr7g0o2:cF2YuHNETovAvNYf8kmVQ/lFTjN4
TLSH
T14E857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 fd9ebf21fed9e14ec15dfb13608df75e753fe54089d0a9a344d3ba10978adab4
MD5 22acf80b13cc4af94abb13efb92924df
SHA1 5a26e1237d1b9dd63d3303788904a21167051191
SHA512 8f5e364618b4ffbc35f76c45a4844b0b600a305c3b931ef23682c2f2d34b7695ce7a852ed5497790224f0b84f57f91b05832dbf4eaccdafb3721cf45d9b15811
SSDEEP 24576:9AFs06+Omlf3NXEbToCnQ/tbw/2Mkjy6Fr7g0of:yFs060lVXubQ/lFTjN4
TLSH
T17F65AF2F66AC00D5E07ED17D8997C91AF7B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 fae81ba91300d20315396a3862d93f9d33453d8d1c93b915bfbcd23208d0a5fe
MD5 526885864e706f7e3078de37d0bf6064
SHA1 828fedb140d164025b04e044a5c5d6aa219fa1b9
SHA512 34a828eefd910757ac6a11f14b1824ebd53f5c223e26d169084cb2415d3689a1bee89d1917265f0c1e59f7b1e6df3bf5541887f8c5479a8415f40b560bf85fbe
SSDEEP 12288:XCJnJ5D3Vkrqzx1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:yJnJ5D3WabnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T17975D03DD2A810E9E477C2B4819A1746FF72386D2F226ACB2864D5357F22FE05979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 d1595fa0a647dfe6388add835dfbd5c81bc82e76bb6098587f0f435df37b9c18
MD5 f727b1fc8caef1de061b1f62b0bdbfce
SHA1 b805b98497dc986ace4af00e373e34037ea20a3a
SHA512 97f0db194b86fce94a8e13ef0aa3158ea73bbdb202a5dd5676953124b80e9b784b48cc099a6d8bbc88fe2dbda3c73ff7305801c9d3f7833cff3ce0095278d1bd
SSDEEP 24576:XEPghm6/7IIXdwcXrif7qQncjlP65i3VusnQ/tbw/2Mkjy6Fr7g0o/:Qg06DIKdwc+eQnSt65aVxQ/lFTjN4
TLSH
T1D9955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 7f1cbcd0b92c365bf5233ef7df55435198641dd0b4a4a403adf88119e35426e4
MD5 fea686c6411f3281152e240e97068d4e
SHA1 f35306a9cb8a668558eca8420de799a40f399754
SHA512 16fd6dac54aebcc25a5618485d5d2493898e644197ca7e9c7b71594b528e659cd2698afdc0b549aa06ae6d5c290ba75b96d355938ba2d5fb0fa3dca3e97c24ea
SSDEEP 12288:HEP3RSfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:MS/nQ/tbw/2Mkjy6Fr7g0oa
TLSH
T17055126D37ACB0EAE526517D88918145D373F4A12B5267EF2680823D8F3B7E81E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 c83d28b6e6f24d14be5c7bce7269acaf5d1937abd300c03d0ae4c56f2aa7971f
MD5 7eb95676644d09c6760282d3834523bd
SHA1 5f0cf76e395aa2b1244d1308926641109b468211
SHA512 679c2e9d181b4c737791075c19e5a5e265fd7675dab8942c25ea8811e6f721a6db3bced5e40d6582237d89fe910f02e7c5ddc573cfe9455a7fb575ede40c58ff
SSDEEP 12288:CjkyEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:CIyknQ/tbw/2Mkjy6Fr7g0ob
TLSH
T1BB6512186398F4CAFA7A06788DA381919B367C506F2193DF6280F23E9F3A3D45D75B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 80596b5fff520721ca56ff0033380bdb214bf3753db0e12a80e1c40d152e8464
MD5 85c727a1fd8836ed5ebe34fde7f46d1c
SHA1 55dcb7d962b214816bea20f9fce97f2c1d7498e8
SHA512 382d456d66ef98b9277e18cdc2f5a7c6bf4d3e8f9521e1b8275319cc8a1dbdaae4452663728b03f526cdff7d0b8c66ae1fd0d99a33354052164891fcb295a5ad
SSDEEP 12288:Q0OGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:LOnQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1F355236C2665F89BFE2706F448928542973B09C17F9163EF36846239CB7D3D416F6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 e9bc2e08469841dfb536834f2a0ec9b2f4141ba74892b75b61924d17b4a532ea
MD5 5b32547e1f4f59783db3f7025aa504ba
SHA1 467b9a2c59bb958d89fd80871ffa51da06313228
SHA512 9750b5daf98d09b3a1c7e304af1660bdc0582e0597ed73c86f1426ba3c3b30d6ed8c4f8538dd6955348e177184dcf7bea2a090a7af87bcd50e7e0900c6d4e79c
SSDEEP 24576:7Q9MxZKdcz9dw39nQ/tbw/2Mkjy6Fr7g0og:7VKZ9Q/lFTjN4
TLSH
T1FD558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 4b92b4d93b38621aa6d814a5ceb4d0294514159c35cb88a10d9f465d696521f6
MD5 5ef44bd1711892801a0bcbac439ec05a
SHA1 e15bbf5acb71217e3a65357bc7aaca5e41e8507f
SHA512 f4d23b0094dfedc170374fd3efe057750d4576239b438c7fd6a9db676976e9eb41a5ed400d173e87f944e931547c920d374c3b1bd6bddde07180bb8334ccbcab
SSDEEP 12288:TyoKo20Rple9pIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:TyocSApInQ/tbw/2Mkjy6Fr7g0oW
TLSH
T1C965E01FBB6990A2E136813C88818745E773B4706B6253CB6691C33D8F776E87D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 df6fe634c3936e1606f98dd0b6780f1288ab0a6796ca1f13cbc009900b0d6e7f
MD5 2e02e0658085a8f91f5c27dd392e3beb
SHA1 0df7d319625af799f947e70d522f486de9e37bd5
SHA512 1747343090e84616356448df7c8761b7ddf2a01f5f3c9ae6dd1e9c8fdf841077a7b76b42765a60311537fde7f9b9dd3ffa3811d86bfe446bafe17885249456c2
SSDEEP 49152:0WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKIQ/lFTjN4:e0zuNI1Lm
TLSH
T1DBA57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 472B
SHA256 9d7407b8bcd4af6820eae7da00db7598246d0f58dc502ef3c89aacbd9cc8a104
MD5 150650f8b4ce06bf6720a55c29275c38
SHA1 c69a908cd7138d119f38c8db07031364b1d21388
SHA512 fcfb7f30078c6e1c43cf272b96b5fbd599fb6ea694cbb79a7a3e40de0eea9e031a4b67d1c2f348d3ab19760b48b67758fd7b4ddd921aab9f3e8d3a064c662bd4
TLSH
T198F0651725F54655E0F75F11DBF990B35B367C456D18846CA0C8031F0CD1A51D872BB3
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 596B
SHA256 550a13ba1f49e521874c12f8908b48d130519016d3abd734b9ba3e3695f2a8bd
MD5 dc1ecc554b3f04dc9600236cdecc8a5b
SHA1 5ae617e99bdded544273928e3e02147405e6a032
SHA512 5c18ad0696a910c5806e952965b6ea6a7943443714eab387cfe0437c5546b6b43c87d70495e5a21ecd284faaf545ab0b6c7fbfc5f89b27ab4779e3cef124f11b
TLSH
T168F03A5726F54668E0F35F15EEF994B31B367C026E19D4AC90C8031E0CE1A61E9727B3
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 726B
SHA256 c89ff4970db3664d4435522769ed127af57f09ba648689de94c00a60572db3c9
MD5 66912ae2193d013c3bf5b8b031c7a36c
SHA1 e5288840baebf03420e92c9deb1a60121f24467d
SHA512 c519bdc0aaf38be5206f763c6ec85e3b1d245ef900c36f2fdfc8865783430e62e09c53fb344e4559e939e4ac40a2fe4e81b79e396264be2dedf9a237cdfb1462
TLSH
T12B01D6962AE91235F0F35F45DFF994731A327C131E18C89C50C8410E49E1EA1E871B7B
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 910B
SHA256 29aad3c953b84d978bd9c489ec6365d819b090264d3f63d55b4dce568fffdade
MD5 a450581a2a8b8beb8dd3de0a9d645c63
SHA1 1bba5a58b4ba51023c189f482055bd4408b20709
SHA512 603c344f420bfcd2931ec5dce59a6bea8e078d8056ebb86f61a6a79c0e4f3b3410000d67e20fa5dcd840d2b9cfc304028d69682b1e118d1c9d7ad9ce27d65a4d
TLSH
T14211C4862AE91275F0B35F45EFB994721E363C532E18C89C40C8510E0DE1EA1E972B7B
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Windows\Temp\ArmUI.ini
Size 234KB
SHA256 790b06745f32e0f56a7af24c871ffce225ba05ebf0d8f8a71a00c727c97dcf09
MD5 cd12a965da4fb66e7f8a07e3f421196c
SHA1 f6377f231362acbd1063aff829ced283a2660b89
SHA512 3fa242c3f573c706e0f36b477ce03f47d9ba0712ef72b94eae4f426dfe21ebbaf1dbebb0981335970b5186d416b4d25e175773796486f39e17de1df0a68a9b0d
SSDEEP 3072:03IJ8zcVOWmxltum8PMkufNWwhEIrKNCpNugYWKOlCIr0YxbFKRWSp4Vf37FbAjO:BxJvW
TLSH
T124342A5667FD1209F6F37F41EEB852944B7B7DA2BE3AC14D1680014E08B5A90DA72B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 275ba6b2db1a7d2ac4ac08f1c4b32589d87bebb41a128bd02b04f3dc6b36c1a8
MD5 f7bd366ac7f6b225978eb12b338f89c7
SHA1 878e44a7f6c26ba62b92f7150866bb37e773bec7
SHA512 2b1d814ca74177720eb6b372222f011331a0a4d61fd54df77a0803cdf81366e98b3885d68c50eb2c32553de05faf299550b2c1090033336cb9c3b82370079be5
SSDEEP 24576:c1QT7EcpfxR+N5AWAz3ooiYtjMqb/nQ/tbw/2Mkjy6Fr7g0ob:BTDxR+N5YzTfjM+Q/lFTjN4
TLSH
T1A655B02EA7F855E9D17E86798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 6d3f51a08e91aa1c5820e65cbf9363a30c1d1b5f17016a0626d718e9ff0da7a9
MD5 b3612746075f9056d1f5e89c3240cd1a
SHA1 6d0a775dd87fa5316d06e2bd337afab2eaab6629
SHA512 dfbeb8bcc7bdac3c83f0df66f4d01c9c1c3cae671c46ef2e99cb57c0155fece31772925c6fc3626d07d87dec82184e4c2cf8544b7cde854ce875c32baf31445c
SSDEEP 24576:7TMdOz0FFS+1mSLDnQ/tbw/2Mkjy6Fr7g0o2:p0K+1mSLDQ/lFTjN4
TLSH
T16775E17E636D14E5E53BC27D9A438906E67334620322A6DB0690C17D2F6BFE4397EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 74ae16de7f8b10df719fd16f7f22de97753053d8af244aa65c860960ca414826
MD5 9623584c570b246c68db20d3bc3fdc32
SHA1 d08869e39a10d9ea37972c10625260d9923b934f
SHA512 58bcabd675aba2cb9a38606a168de29adf03feb6e47fbe11df7e3e1cffbddcbdfd41ab630b7369081607e1fc42a5060c055b044fdb5ae497c113a0e21bd2062e
SSDEEP 12288:54T6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:86nQ/tbw/2Mkjy6Fr7g0oe
TLSH
T1A355122D23E8B4DAF93352B48962414697327CA2276167FF36C4C63E8F3A3D44979B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1044-217-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1052-148-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1052-136-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/1052-145-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/1052-142-0x0000000001510000-0x0000000001570000-memory.dmp

Download

memory/1072-401-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1072-126-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1072-132-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1084-399-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/1144-342-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1296-204-0x0000000000900000-0x0000000000960000-memory.dmp

Download

memory/1296-210-0x0000000000900000-0x0000000000960000-memory.dmp

Download

memory/1296-335-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1656-154-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1656-327-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/1656-160-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1744-330-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/1908-501-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1908-120-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1908-97-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/1908-103-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/1944-451-0x00000282A0BD0000-0x00000282A0BE0000-memory.dmp

Download

memory/1944-462-0x00000282A0BD0000-0x00000282A0BE0000-memory.dmp

Download

memory/1944-454-0x00000282A0BD0000-0x00000282A0BE0000-memory.dmp

Download

memory/1944-453-0x00000282A0BD0000-0x00000282A0BE0000-memory.dmp

Download

memory/1944-452-0x00000282A0BD0000-0x00000282A0BE0000-memory.dmp

Download

memory/1944-435-0x00000282A0BD0000-0x00000282A0BE0000-memory.dmp

Download

memory/1944-447-0x00000282A0BD0000-0x00000282A0BE0000-memory.dmp

Download

memory/1944-446-0x00000282A0BD0000-0x00000282A0BE0000-memory.dmp

Download

memory/1944-445-0x00000282A0BD0000-0x00000282A0BE0000-memory.dmp

Download

memory/1944-444-0x00000282A0BD0000-0x00000282A0BE0000-memory.dmp

Download

memory/1944-443-0x00000282A0BD0000-0x00000282A0BE0000-memory.dmp

Download

memory/1944-442-0x00000282A0BD0000-0x00000282A0BE0000-memory.dmp

Download

memory/1944-437-0x00000282A0BD0000-0x00000282A0BE0000-memory.dmp

Download

memory/1944-465-0x00000282A0BD0000-0x00000282A0BE0000-memory.dmp

Download

memory/1944-464-0x00000282A0BD0000-0x00000282A0BE0000-memory.dmp

Download

memory/1944-469-0x00000282A0BD0000-0x00000282A0BE0000-memory.dmp

Download

memory/1944-470-0x00000282A0BD0000-0x00000282A0BE0000-memory.dmp

Download

memory/1944-471-0x00000282A0BD0000-0x00000282A0BE0000-memory.dmp

Download

memory/1944-472-0x00000282A0BD0000-0x00000282A0BE0000-memory.dmp

Download

memory/1944-474-0x00000282A0BD0000-0x00000282A0BE0000-memory.dmp

Download

memory/1944-473-0x00000282A0BD0000-0x00000282A0BE0000-memory.dmp

Download

memory/1944-476-0x00000282A0BD0000-0x00000282A0BE0000-memory.dmp

Download

memory/1944-475-0x00000282A0BD0000-0x00000282A0BE0000-memory.dmp

Download

memory/1944-457-0x00000282A0BD0000-0x00000282A0BE0000-memory.dmp

Download

memory/1944-436-0x00000282A0BD0000-0x00000282A0BE0000-memory.dmp

Download

memory/1944-440-0x00000282A0BD0000-0x00000282A0BE0000-memory.dmp

Download

memory/1944-439-0x00000282A0BD0000-0x00000282A0BE0000-memory.dmp

Download

memory/1944-458-0x00000282A0BD0000-0x00000282A0BE0000-memory.dmp

Download

memory/1944-460-0x00000282A0BD0000-0x00000282A0BE0000-memory.dmp

Download

memory/1944-456-0x00000282A0BD0000-0x00000282A0BE0000-memory.dmp

Download

memory/1944-438-0x00000282A0BD0000-0x00000282A0BE0000-memory.dmp

Download

memory/1944-459-0x00000282A0BD0000-0x00000282A0BE0000-memory.dmp

Download

memory/1944-448-0x00000282A0BD0000-0x00000282A0BE0000-memory.dmp

Download

memory/1944-463-0x00000282A0BD0000-0x00000282A0BE0000-memory.dmp

Download

memory/1944-449-0x00000282A0BD0000-0x00000282A0BE0000-memory.dmp

Download

memory/1944-461-0x00000282A0BD0000-0x00000282A0BE0000-memory.dmp

Download

memory/1944-450-0x00000282A0BD0000-0x00000282A0BE0000-memory.dmp

Download

memory/1944-466-0x00000282A0BD0000-0x00000282A0BE0000-memory.dmp

Download

memory/1944-441-0x00000282A0BD0000-0x00000282A0BE0000-memory.dmp

Download

memory/1944-455-0x00000282A0BD0000-0x00000282A0BE0000-memory.dmp

Download

memory/2068-177-0x00000000005D0000-0x0000000000636000-memory.dmp

Download

memory/2068-182-0x00000000005D0000-0x0000000000636000-memory.dmp

Download

memory/2068-329-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/2452-338-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2568-468-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/2568-13-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/2736-193-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2736-199-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2736-333-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2740-164-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/2740-328-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/2740-170-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/2760-649-0x0000000000400000-0x0000000000547000-memory.dmp

Download

memory/2760-852-0x0000000000400000-0x0000000000547000-memory.dmp

Download

memory/2760-734-0x0000000000400000-0x0000000000547000-memory.dmp

Download

memory/3020-502-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3020-232-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/3020-248-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/3020-432-0x000000000CD60000-0x000000000CD68000-memory.dmp

Download

memory/3020-352-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3020-268-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/3032-339-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3272-332-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/3408-351-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/3712-69-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3712-81-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/3712-75-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3736-434-0x0000000000400000-0x0000000000616000-memory.dmp

Download

memory/3736-0-0x0000000000400000-0x0000000000616000-memory.dmp

Download

memory/3736-8-0x00000000024F0000-0x0000000002556000-memory.dmp

Download

memory/3736-1-0x00000000024F0000-0x0000000002556000-memory.dmp

Download

memory/3736-809-0x0000000000400000-0x0000000000616000-memory.dmp

Download

memory/4276-331-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4276-467-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4348-336-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/4648-94-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4648-149-0x0000000140000000-0x0000000140135000-memory.dmp

Download