Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/11/2026, 23:44
Behavioral task
behavioral1
Sample
2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
21 signatures
150 seconds
General
- Target 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe
- Size 3.6MB
- Sample261101-3rdm9ayxht
- SHA256 417b6beee15381e4d7414ab264b0b5a57eea23824445139e8dfbf74a46f6f862
- MD5 7c566ccda70fd957296456bf84cb2190
- SHA1 72e9dec1ba8407c01aca11b70fb35af280fa8f97
- SHA512 735eba72ebf7abe04229b6e2bc500da4ee80cdf823ae2fd41ef8d115fce1f1d3099f4b4fac02d652e08e97a9635a58179e5de6b0be6bd2fd678b7048782ca997
- SSDEEP 98304:4z5nj5iV8FSGIkXP9QtSBt7rMt73tgEWbwqOMkJxFufM:o1tXPZtkt73tgHFOMkPoM
- TLSH T18606BF117EB19833C5A30372896EF27D326DAD641B3850CB53CB3A983E34AF25A35567
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
- Detect Neshta payload 39 IoCs
resource yara_rule behavioral2/files/0x00070000000188fc-48.dat family_neshta behavioral2/files/0x000100000001b94f-211.dat family_neshta behavioral2/files/0x0008000000018964-409.dat family_neshta behavioral2/files/0x0005000000018a29-408.dat family_neshta behavioral2/files/0x0005000000018a2e-421.dat family_neshta behavioral2/files/0x000200000001898d-420.dat family_neshta behavioral2/files/0x0007000000018913-424.dat family_neshta behavioral2/files/0x00050000000189ef-423.dat family_neshta behavioral2/files/0x0002000000018975-422.dat family_neshta behavioral2/files/0x0005000000018a1c-419.dat family_neshta behavioral2/files/0x000200000001897a-418.dat family_neshta behavioral2/files/0x000200000001890b-417.dat family_neshta behavioral2/files/0x0005000000018a1b-416.dat family_neshta behavioral2/files/0x00070000000188f8-415.dat family_neshta behavioral2/files/0x0007000000018904-414.dat family_neshta behavioral2/files/0x000100000001b953-435.dat family_neshta behavioral2/files/0x000100000001b9d4-433.dat family_neshta behavioral2/files/0x0002000000019bbb-431.dat family_neshta behavioral2/files/0x0002000000019bba-430.dat family_neshta behavioral2/files/0x0002000000019bb9-429.dat family_neshta behavioral2/files/0x0002000000019c0e-428.dat family_neshta behavioral2/files/0x00030000000189f3-427.dat family_neshta behavioral2/files/0x000900000001891d-426.dat family_neshta behavioral2/files/0x000700000001891b-425.dat family_neshta behavioral2/files/0x000a0000000171e1-445.dat family_neshta behavioral2/files/0x00060000000177ba-444.dat family_neshta behavioral2/files/0x0009000000017403-443.dat family_neshta behavioral2/files/0x0010000000016dca-442.dat family_neshta behavioral2/files/0x00090000000170be-441.dat family_neshta behavioral2/files/0x00030000000173a0-440.dat family_neshta behavioral2/files/0x000800000001829c-439.dat family_neshta behavioral2/files/0x00030000000172c8-438.dat family_neshta behavioral2/files/0x0007000000016db3-437.dat family_neshta behavioral2/files/0x00020000000187b0-436.dat family_neshta behavioral2/memory/3316-447-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3316-471-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3316-474-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3316-478-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3316-481-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta - Executes dropped EXE 12 IoCs
pid Process 4664 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe 5932 elevation_service.exe 4912 elevation_service.exe 4140 maintenanceservice.exe 4628 OSE.EXE 5124 PerceptionSimulationService.exe 1052 perfhost.exe 4736 ReFsDedupSvc.exe 2884 SensorDataService.exe 6028 ssh-agent.exe 3276 AgentService.exe 4196 SearchIndexer.exe - Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe - Drops file in System32 directory 57 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\ce01db1d67fac3b7.bin elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\Windows\System32\vds.exe 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\locator.exe 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe elevation_service.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MICROS~3.EXE 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7z.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe elevation_service.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\cookie_exporter.exe 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevated_tracing_service.exe 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MI391D~1.EXE 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe elevation_service.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\elevation_service.exe 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe elevation_service.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe elevation_service.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\identity_helper.exe 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~2\MICROS~1.EXE 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe elevation_service.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\svchost.com 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname elevation_service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain elevation_service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c0723b045b6add01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007607c3015b6add01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e73522045b6add01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000071499a3f5b6add01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bb8970045b6add01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000976fc8055b6add01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a833a0025b6add01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut" SearchProtocolHost.exe - Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 5932 elevation_service.exe 5932 elevation_service.exe 5932 elevation_service.exe 5932 elevation_service.exe 5932 elevation_service.exe 5932 elevation_service.exe 5932 elevation_service.exe 4912 elevation_service.exe 4912 elevation_service.exe 4912 elevation_service.exe 4912 elevation_service.exe 4912 elevation_service.exe 4912 elevation_service.exe 4912 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 816 Process not Found 816 Process not Found - Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4664 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe Token: SeBackupPrivilege 4736 ReFsDedupSvc.exe Token: SeRestorePrivilege 4736 ReFsDedupSvc.exe Token: SeBackupPrivilege 4736 ReFsDedupSvc.exe Token: SeRestorePrivilege 4736 ReFsDedupSvc.exe Token: SeBackupPrivilege 4736 ReFsDedupSvc.exe Token: SeRestorePrivilege 4736 ReFsDedupSvc.exe Token: SeBackupPrivilege 4736 ReFsDedupSvc.exe Token: SeRestorePrivilege 4736 ReFsDedupSvc.exe Token: SeBackupPrivilege 4736 ReFsDedupSvc.exe Token: SeRestorePrivilege 4736 ReFsDedupSvc.exe Token: SeAssignPrimaryTokenPrivilege 3276 AgentService.exe Token: 33 4196 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4196 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4196 SearchIndexer.exe Token: SeDebugPrivilege 5932 elevation_service.exe Token: SeDebugPrivilege 4912 elevation_service.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4664 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe 4664 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3316 wrote to memory of 4664 3316 2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe 89 PID 4196 wrote to memory of 5360 4196 SearchIndexer.exe 101 PID 4196 wrote to memory of 3748 4196 SearchIndexer.exe 102 PID 4196 wrote to memory of 3244 4196 SearchIndexer.exe 103 PID 4196 wrote to memory of 3192 4196 SearchIndexer.exe 104 PID 4196 wrote to memory of 4772 4196 SearchIndexer.exe 106 PID 4196 wrote to memory of 4900 4196 SearchIndexer.exe 107 PID 4196 wrote to memory of 4844 4196 SearchIndexer.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe"1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4664
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5932
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4912
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4140
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4628
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:5124
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1052
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4736
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2884
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:6028
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3276
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:5360
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:3748
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 2892 2900 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:3244
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 2592 2588 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:3192
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4772
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 2592 2588 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:4900
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 2892 2900 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:4844
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
- Size 2.4MB
- SHA256 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
- MD5 8ffc3bdf4a1903d9e28b99d1643fc9c7
- SHA1 919ba8594db0ae245a8abd80f9f3698826fc6fe5
- SHA512 0b94ead97374d74eaee87e7614ddd3911d2cf66d4c49abbfd06b02c03e5dd56fd00993b4947e8a4bcd9d891fa39cab18cc6b61efc7d0812e91eb3aea9cd1a427
- SSDEEP 49152:oTfiUEWo6zuEz439z99akTBc4O8b8ITDnlT4NvJX:oTfiG/nzU90T
- TLSH T179C59226A2C8C0EBE5642170CC59BBF900546D78DBA2CDD7BD447E16BA307D29533A3E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE
- Size 867KB
- SHA256 6a52f42aab17f2c683d345f982c0beb162953c7d83a9411fc9a6d1f6c12fa591
- MD5 ade11c99a3552b3c3db0bbf397d91c1e
- SHA1 9cd80e528899931b1f4d1346889689931430a1de
- SHA512 5f1f851e7e571311c3b9cc87cee0265c5b03031fa4cc99173525f13e9564e0049af55cc086736053d03cabf62290e5597508e7f7ea1ba5eca9c0344c972782ea
- SSDEEP 24576:WXYfDtczAmLqna7RGw1iqhuOM6ansBjxkOTWvks/N:VtcPWoRGw7uOMkBjxFT6fF
- TLSH T1D715F129B7D008F9ED67827CCCA28111E633B8654B60E6DB03F459694E337D95E3EB42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe
- Size 175KB
- SHA256 3f00404dd591c2856e6f71bd78423ed47199902e0b85f228e6c4de72c59ddffe
- MD5 576410de51e63c3b5442540c8fdacbee
- SHA1 8de673b679e0fee6e460cbf4f21ab728e41e0973
- SHA512 f7761f3878775b30cc3d756fa122e74548dfc0a27e38fa4109e34a59a009df333d074bf14a227549ae347605f271be47984c55148685faac479aeb481f7191db
- SSDEEP 3072:sr85CnHb5CZCq5DACsVlNl7HIJ1PcJ7LxnkdA53Pa4sjSTX4:k9n4N5QVrZZ7Lxkmsjj
- TLSH T119045C22BBC09075E69317723EFC79E44BF6BC319AA410ABF318495B197E350963931B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe
- Size 328KB
- SHA256 888a1dd0033e5d758a4e731e3e55357de866e80d03b1b194375f714e1fd4351d
- MD5 39c8a4c2c3984b64b701b85cb724533b
- SHA1 c911f4c4070dfe9a35d9adcb7de6e6fb1482ce00
- SHA512 f42ca2962fe60cff1a13dea8b81ff0647b317c785ee4f5159c38487c34d33aecba8478757047d31ab2ee893fbdcb91a21655353456ba6a018fc71b2278db4db2
- SSDEEP 6144:k9x6edjvw6L6jAVnhH1Am2ZBU4M528hW8Bi7Q5VYN9:Y6exwI1oB8RZ4Q5VYH
- TLSH T1DC645B017F908EB6F5A2807F5D7A631D5A6ABA221B10E2C373703B5DCD321C59A3E356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
- Size 9.4MB
- SHA256 31da9632f5d25806b77b617d48da52a14afc574bbe1653120f97705284ea566c
- MD5 322302633e36360a24252f6291cdfc91
- SHA1 238ed62353776c646957efefc0174c545c2afa3d
- SHA512 5a1f7c44ce7f5036bffc18ebac39e2bf70e6f35fa252617d665b26448f4c4473adfa115467b7e2d9b7068823e448f74410cdcdfef1ac1c09021e051921787373
- SSDEEP 98304:FrbT5JhEP+SuC0qyLfPeLDo/uLGM7gbl91hxkPZTA:lXnfW/JLGMcblLheTA
- TLSH T186A6AF1D7BE21036CD732176AF4FA104E739D007A215C6977ADC83981FB1AA152B6FE8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- Size 86KB
- SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
- MD5 3b73078a714bf61d1c19ebc3afc0e454
- SHA1 9abeabd74613a2f533e2244c9ee6f967188e4e7e
- SHA512 75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4
- SSDEEP 1536:JxqjQ+P04wsmJCNgh/sE/EkHd0Ci2zkQASqk+H6L2C:sr85CysEM6GC+QA8+HlC
- TLSH T17493AE13FAF18872D1621BF89C29E359C93F7A306E3056A7A3E40D5D5D747C26C2924B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
- Size 5.7MB
- SHA256 1b5c715d71384f043843ea1785a6873a9f39d2daae112ccdeffcd88b10a3a403
- MD5 09acdc5bbec5a47e8ae47f4a348541e2
- SHA1 658f64967b2a9372c1c0bdd59c6fb2a18301d891
- SHA512 3867bf98e1a0e253114a98b78b047b0d8282b5abf4aaf836f31cc0e26224e2a1b802c65df9d90dc7696a6dbcb9a8e4b900f1d1299e1b11e36f095ebaf8a2e5b8
- SSDEEP 49152:DmlI9H9rY654KYroYJqkhWFUBlNwnFq3kXRsPI6BRY20YZAliDgFL2YmXZjU2P38:oiH9MfT3NwMkKhBRr0yAk6qkKvq
- TLSH T1F3567C22B902C139E15102B159ECBFE9C49D99348FB105DFBAC41F6E9A613E33931E67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe
- Size 183KB
- SHA256 ecd5e94da88c653e4c34b6ab325e0aca8824247b290336f75c410caa16381bc5
- MD5 9dfcdd1ab508b26917bb2461488d8605
- SHA1 4ba6342bcf4942ade05fb12db83da89dc8c56a21
- SHA512 1afc1b95f160333f1ff2fa14b3f22a28ae33850699c6b5498915a8b6bec1cfc40f33cb69583240aa9206bc2ea7ab14e05e071275b836502a92aa8c529fc1b137
- SSDEEP 3072:sr85Cl8pIsfHwCbf9MFdRvyAgnz8n/dfQ7PjFKq23T/h:k9KbfHwCbyFdAafCPc53T/h
- TLSH T177046B51F7C7C9B2E09206704C2AAF6541B9FE381F7105EBF3E87A1E5A713C2182566B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe
- Size 131KB
- SHA256 5c3ef3ec7594c040146e908014791dd15201ba58b4d70032770bb661b6a0e394
- MD5 5791075058b526842f4601c46abd59f5
- SHA1 b2748f7542e2eebcd0353c3720d92bbffad8678f
- SHA512 83e303971ed64019fde9e4ba6f6e889f8fb105088490dfa7dcf579a12baff20ef491f563d132d60c7b24a4fd3cac29bd9dc974571cd162000fae8fba4e0e54fb
- SSDEEP 3072:sr85Ciq9YnyoRmLisiselSsONt3F7oQGO7M1bp:k9kgLHvld2
- TLSH T19CD37C13BBE0C872D66207785D25F36696AFF6305E74CB677B880B0E9DB46824D0C64A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
- Size 254KB
- SHA256 16d65f2463658a72dba205dcaa18bc3d0bab4453e726233d68bc176e69db0950
- MD5 4ddc609ae13a777493f3eeda70a81d40
- SHA1 8957c390f9b2c136d37190e32bccae3ae671c80a
- SHA512 9d7f90d1529cab20078c2690bf7bffab5a451a41d8993781effe807e619da0e7292f991da2f0c5c131b111d028b3e6084e5648c90816e74dfb664e7f78181bc5
- SSDEEP 3072:sr85CYl4dsOc6v2vTzwU+Pho86meq+FaSoB2+vSHr8qcVz5fzsC:k9r3PiY+Fa7BdvG1cT7
- TLSH T128446B307B86C53BE66301718CF8EBBF942EBA150F6851D7B3984B5E5EA05D32E31846
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe
- Size 386KB
- SHA256 473eb551101caeaf2d18f811342e21de323c8dd19ed21011997716871defe997
- MD5 8c753d6448183dea5269445738486e01
- SHA1 ebbbdc0022ca7487cd6294714cd3fbcb70923af9
- SHA512 4f6fddefc42455540448eac0b693a4847e21b68467486376a4186776bfe137337733d3075b7b87ed7dac532478dc9afc63883607ec8205df3f155fee64c7a9be
- SSDEEP 6144:k9W3n0dK2NP0RHx8D98WTBPW8fF8oABm1nKZ0RsrI:WKhHSDeWTRW8fdebmqI
- TLSH T16A84AE11FB86C172D96602728DAAA35CC4BDB5714F314BD3E3DC6F0D9E601D2A932B86
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
- Size 125KB
- SHA256 fe44ca8d5050932851aa54c23133277e66db939501af58e5aeb7b67ec1dde7b5
- MD5 cce8964848413b49f18a44da9cb0a79b
- SHA1 0b7452100d400acebb1c1887542f322a92cbd7ae
- SHA512 bf8fc270229d46a083ced30da6637f3ca510b0ce44624a9b21ec6aacac81666dffd41855053a936aa9e8ea6e745a09b820b506ec7bf1173b6f1837828a35103d
- SSDEEP 1536:JxqjQ+P04wsmJCWM2D57Kykf8d/R8Tyr5J5is7MDjrXDyO4zkm8dbHVLokF8iJTp:sr85CCQw/STyr5Jks7MvrMzkm8PL3Eo
- TLSH T127C3AE22F6A1C432D4920D788919C3B18E3F7D3169A99957F7E80B5E9E607C0EA1D31F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe
- Size 142KB
- SHA256 3e9da97a7106122245e77f13f3f3cc96c055d732ab841eb848d03ac25401c1bc
- MD5 92dc0a5b61c98ac6ca3c9e09711e0a5d
- SHA1 f809f50cfdfbc469561bced921d0bad343a0d7b4
- SHA512 d9eefb19f82e0786d9be0dbe5e339d25473fb3a09682f40c6d190d4c320cca5556abb72b5d97c6b0da4f8faefdc6d39ac9d0415fdf94ebcc90ecdf2e513c6a31
- SSDEEP 1536:JxqjQ+P04wsmJC9S7UmwuBLAefbVH8x+FOI31EmkIY2d5J6WUghEuireklhKsikg:sr85Cs7HN9fN8sFOE1Z5Y2966ilU9xL
- TLSH T1F2E38D21F5C188B2E67205B54D2AA79E942CF6340F3194E3B3E84F2D9D342C39F765A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe
- Size 278KB
- SHA256 22a585c183e27b3c732028ff193733c2f9d03700a0e95e65c556b0592c43d880
- MD5 12c29dd57aa69f45ddd2e47620e0a8d9
- SHA1 ba297aa3fe237ca916257bc46370b360a2db2223
- SHA512 255176cd1a88dfa2af3838769cc20dc7ad9d969344801f07b9ebb372c12cee3f47f2dba3559f391deab10650875cad245d9724acfa23a42b336bfa96559a5488
- SSDEEP 6144:k9P1UKupTu8ffMb0/GxsZfcJtqQ1UBZ6g:jK+HMYcytZh
- TLSH T105546C1A77D84CF5E467C23DCD528642E2B278551B34D7CB6760022AAF637E0AE3DB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 92KB
- SHA256 2f947e3ca624ce7373080b4a3934e21644fb070a53feeaae442b15b849c2954f
- MD5 176436d406fd1aabebae353963b3ebcf
- SHA1 9ffdfdb8cc832a0c6501c4c0e85b23a0f7eff57a
- SHA512 a2d1a714e0c1e5463260c64048ba8fd5064cfa06d4a43d02fc04a30748102ff5ba86d20a08e611e200dc778e2b7b3ae808da48132a05a61aa09ac424a182a06a
- SSDEEP 1536:JxqjQ+P04wsmJC66w8MghW4wNlu9HQIXsW/44:sr85C66w8oFlKwW//
- TLSH T1E1936C13BB928E33D4204AB91C6997B8D4BEF5306F1556E367650A4E8DBC3C22C3925F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
- Size 147KB
- SHA256 750824b5f75c91a6c2eeb8c5e60ae28d7a81e323d3762c8652255bfea5cba0bb
- MD5 3b35b268659965ab93b6ee42f8193395
- SHA1 8faefc346e99c9b2488f2414234c9e4740b96d88
- SHA512 035259a7598584ddb770db3da4e066b64dc65638501cdd8ff9f8e2646f23b76e3dfffa1fb5ed57c9bd15bb4efa3f7dd33fdc2e769e5cc195c25de0e340eb89ab
- SSDEEP 3072:sr85Ce6l8TRpR+EMucyaGoS43IIJNdS3UA:k9e6l8aGo/3VL4kA
- TLSH T15EE38C57B7E134F8E1768A78CC615608EB32B8352A319BAF03A4065A5F273C05E3DF25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
- Size 1.2MB
- SHA256 b1ec065f71cc40f400e006586d370997102860504fd643b235e8ed9f5607262a
- MD5 d47ed8961782d9e27f359447fa86c266
- SHA1 d37d3f962c8d302b18ec468b4abe94f792f72a3b
- SHA512 3e33f2cdf35024868b183449019de9278035e7966b342ba320a6c601b5629792cbb98a19850d4ca80b906c85d10e8503b0193794d1f1efa849fa33d26cff0669
- SSDEEP 12288:M0ZRHkXVfeeO4LMneqyQsWSjGQCfLBlS7guN1AnQ6i12NI+03Sgouvb:M0ZRHkFfenxyQZXS7gZnQh2NIDSgouvb
- TLSH T19D45E50267F94129F1F37B71EEB993645A77BC61AE39C50E5284025E0DB4A90EE31B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
- Size 454KB
- SHA256 bb07d817b8b1b6b4c25e62b6120e51dec10118557d7b6b696ad084a5ba5bfdeb
- MD5 bcd0f32f28d3c2ba8f53d1052d05252d
- SHA1 c29b4591df930dabc1a4bd0fa2c0ad91500eafb2
- SHA512 79f407735853f82f46870c52058ceee4d91857a89db14868ee1169abd5c0fd2e3fa1ed230ab90b5f479a9581b88998643d69b0df498defea29e73b0d487f3b10
- SSDEEP 6144:k9sQsSVWSLjX2PxPNMRyfn7LzPdKblt0K+HAfh0v8axsbQuXYvr6yIll6Jf:+VWnxlMSn7nFKbltn+Ch/m6Xl6l
- TLSH T1E1A47C1077D0C036F1B329768A7FE728546DB9715F6881CFE3881A6E4E706E0AA3571B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe
- Size 555KB
- SHA256 c5a99f42100834599e4995d0a178b32b772a6e774a4050a6bb00438af0a6a1f3
- MD5 ce82862ca68d666d7aa47acc514c3e3d
- SHA1 f458c7f43372dbcdac8257b1639e0fe51f592e28
- SHA512 bca7afd6589c3215c92fdaca552ad3380f53d3db8c4b69329a1fa81528dd952a14bf012321de92ad1d20e5c1888eab3dd512b1ac80a406baccc37ee6ff4a90dc
- SSDEEP 12288:PKv89GDYikjjqggz7/PtFxRNWBYrpkQJ7u:PKqjjg/PzNWyr9J7u
- TLSH T1A5C4BF2079A0C032D17311344D6AE794A63EF6700E7249E777D46FBD7E346C1EB28AA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
- Size 325KB
- SHA256 5e2e22ead49ce9cc11141dbeebbe5b93a530c966695d8efc2083f00e6be53423
- MD5 9a8d683f9f884ddd9160a5912ca06995
- SHA1 98dc8682a0c44727ee039298665f5d95b057c854
- SHA512 6aecf8c5cb5796d6879f8643e20c653f58bad70820896b0019c39623604d5b3c8a4420562ab051c6685edce60aa068d9c2dbb4413a7b16c6d01a9ac10dc22c12
- SSDEEP 6144:k9/jbN5zFEjGkqkAJHyEzYV/PvyeWPZw22b:GjzzFEoS2cPvyeiZwbb
- TLSH T19D649EA5B3901CF4EC63453ECC258916D6B27C2A0B70C65F13A8366A5F733911D3EB9A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe
- Size 325KB
- SHA256 e2262c798729169f697e6c30e5211cde604fd8b14769311ff4ea81abba8c2781
- MD5 892cf4fc5398e07bf652c50ef2aa3b88
- SHA1 c399e55756b23938057a0ecae597bd9dbe481866
- SHA512 f16a9e4b1150098c5936ec6107c36d47246dafd5a43e9f4ad9a31ecab69cc789c768691fa23a1440fae7f6e93e8e62566b5c86f7ed6bb4cfe26368149ea8c167
- SSDEEP 6144:k9/eWYoTOLHIsPPzAdnz0YutYPDvh2AHdwSc:GeWYoaLHF3z0z04PDvh2Cd9c
- TLSH T15A649EA5B3901CF4EC67853ECC258916D6B27C2A0B70C65F13B8366A5F333911D2DB9A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe
- Size 505KB
- SHA256 da73b6e071788372702104b9c72b6697e84e7c75e248e964996700b77c6b6f1c
- MD5 452c3ce70edba3c6e358fad9fb47eb4c
- SHA1 d24ea3b642f385a666159ef4c39714bec2b08636
- SHA512 fe8a0b9b1386d6931dc7b646d0dd99c3d1b44bd40698b33077e7eeba877b53e5cb39ff2aa0f6919ccab62953a674577bc1b2516d9cadc0c051009b2083a08085
- SSDEEP 6144:k9/4aKTRnXtTkCgwCzUg/HpjN4IBwu7QTLbpqmHdIvWTiYB2n5:GHWRdTfgwCHKy7GLbbdIvWTi4e5
- TLSH T178B43990F3E414F4F0B79A3589764511DAB67C6A1B71DA8F03A8261A1F337D18D39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
- Size 5.7MB
- SHA256 3acf99624820fd862ac30780021108f0ff2df60db3df351cd17400404f279d3c
- MD5 e63e539e0f0393fdea9da0d6ee80ac45
- SHA1 027c8609ca7bb42b61256abb3269e1babce0141b
- SHA512 f4d0458b8bfe5a66254cb85b8ba3859c9d6a937e6d14f8e15b95b7e131aaeff8a1be39f0eee3939e305901797d98dd2c5aac1837873a49f786cfcac0c9b1e6d6
- SSDEEP 98304:Fog5HQ+hDHQTW6Af4fF7KkOuYO6IgF+IAMk/JexMXP8iuHG9XXYXQz7w7:Fog1P9fIlOuz6IgF+I3m2MXP6HG8QzU
- TLSH T133567C23A4E08034E5F732756D2CA73959327BA29F3145CB86946C946FB83D3293936F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 0adefbc7624da68a492f274712bfc1d00b776376224b55d7ad70293c9b2faa79
- MD5 5112ae3bc0b574b981b606ee3e578081
- SHA1 4720dcb5ba8c33924081642a5be03c629ef58f0b
- SHA512 262832f2d8aafd11f4a9346d3c6a9c186d5f0ba46767fa6f652abe000a69bb2053a41d088113d805b88ae0d4745ffd38ef4af80191efb51bb8247c504c1e10c8
- SSDEEP 49152:7b+632BuPkFKRrdE6ohQstBhuXjfS4LWxnhWoRGw7uOMkBjxFT6f:J3q6tjB6WbwqOMkJxFuf
- TLSH T110D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe
- Size 141KB
- SHA256 294a66a0948d474fafaac4ab64279d58d648c488271c265f27feef305075b04f
- MD5 666c821957ea2d96efdb73ae4e0da061
- SHA1 26ff71cc1e52f4faa0ef5409f1ffeaf975b483ee
- SHA512 f18204ab354b6ed340dcde9323b6cc7b863240eff8e57e19c1783fbee66305a4b7521d13dce83c0745da783d2c9d21d187f0146cc197832476345aebbb301555
- SSDEEP 3072:sr85CORD5bCs57y4jem7y6t+NRCywDw1DiJku6UY:k9UD5F57y4j94T4DtOUY
- TLSH T11FE38D41FBE0C8B2F5B20B746C3797359E36BD226D605B4B63907A4CEC723C1A929746
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 826KB
- SHA256 eb9a2bfd5045b58dee565aece279fd5e875de1607e71d488a0802f8f759f30e6
- MD5 2871a63c051dc3575f4b28ce312ff630
- SHA1 89a821c35e63c943782b77a6922fce4b8c175384
- SHA512 24417d466205de13d0def13fcef1a25af9c3342703a8601bf032582b5dd2a9e6e02de6bfd511e6c112bc4278d2ba299f73b741993ecbfb5ac25ad2275e8b139c
- SSDEEP 24576:cXYfDtczAmLqna7RGw1iqhuOM6ansBjxkOTWvks/:btcPWoRGw7uOMkBjxFT6f
- TLSH T189050129B7D408F9ED678138C8A28511E633B89547A0E7DB03F499690F337D85E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 e4ef6370119e0ab5d5ac600e058937284191fc8c0d8cfd917156a90a406cb4e3
- MD5 4072c892f0155a9d09c843da57d34a6d
- SHA1 41a1eddca4ea5726904d3dae450f0e0272ce29cc
- SHA512 26db823922dc5b0df09327ab47d3ae973b6bd5e3d26cb5b5c0dee695501d3dc99921ec8db2c6daf15a4ca35d754f5694e3ca7384aadfe366931f6cbac66ca885
- SSDEEP 24576:R0Le5ji0hmxnrMpLqna7RGw1iqhuOM6ansBjxkOTWvks/:RPji0Ax4WoRGw7uOMkBjxFT6f
- TLSH T1F035AE16F6748331D073C0B9C5D2A69AED7230865B308ACB4296D77C3E67BE68636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 bfcf0b0ea8af61e37f84b3ac900759813dff9d3098c3136cc96ffaf4d7b06223
- MD5 3bbdba176641e052c6dd73f40debd902
- SHA1 cbcd987c12ed85785267b53200ac104a04d12d85
- SHA512 c36c7605ac829f05a64fd4603a3775f425383d392654a6b810d1cd5a4d8969442b56d4da8e0b9a7525183dc7e496e5ba7ad01c767dde4bf9b80836e0ba28c9d5
- SSDEEP 24576:Ra7/ezSC6vUyDZaqgrvWx6q8wyufLqna7RGw1iqhuOM6ansBjxkOTWvks/:Q/ezSC6vURPvMHjyEWoRGw7uOMkBjxFO
- TLSH T131756C25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246976C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 6438317b59fac841dd9b63721b38e4b17f5d82588ea23292822bede30f8315c2
- MD5 30c45259004a8430acfe0418cf688d3f
- SHA1 44fd95f30995223d5727e8b5ca8fd6216f0304a8
- SHA512 59edd23215ed055603b4277d0054507dadddd0646d1e9a3f422b0ab8d7ffee7898b831091562843cea5b40c3c9cd9ac1a86c1ceb1eaad7a62bb3812612349bf6
- SSDEEP 24576:PVbqPb88hv/lV7KLqna7RGw1iqhuOM6ansBjxkOTWvks/:PVO88hXlV+WoRGw7uOMkBjxFT6f
- TLSH T183559F66F5748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677E6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 582KB
- SHA256 037e5b10e19a4d146fe198e0423d9d560b5b44fb9fd29581b21703422e6b6d86
- MD5 08d613cee58fa1c3a1fd643ecd3bb07e
- SHA1 1b9e69be957c1d7713b8ecf28939e49cccb69aa0
- SHA512 adc1c359fe5c4a328b85322149e00140c2e63f04b4f3e13ea72cbacfea44c34a349ff7a90b75620f65d56367e29b5723ec82f56ef2cb6e7034ee4d5c29191bd2
- SSDEEP 12288:MG9LN4narfybM0nw1iqD7ZuOM6aTPD5uicYzgwexx27xcTWvv8s4w:MG9Lqna7RGw1iqhuOM6ansBjxkOTWvke
- TLSH T125C42357EB853096FF63853069DE90301401EEFAED9498AA1F753C8D40B89FBC6E2587
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 32dfaac55ac75eb21a58129a1854dc17f0d5a7cc9d8538cba1856543f8bf1b72
- MD5 3048dc11d59664d24235fbc2210cc201
- SHA1 91f473f3beb694f3934f056c5bf36e1a637941ab
- SHA512 7b9e751ce672763f761f804e109440bff6b23fc8ffba563f2cd44da3c08e223bc398a8c09b569d5ac14cfe4f255170aa93d9af0e86a3d01e42245a545e583afa
- SSDEEP 49152:9CbRquA/m2yL5zifFiV+XenmE3/zoWoRGw7uOMkBjxFT6f:6oqHVjnmbWbwqOMkJxFuf
- TLSH T17ED58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 a5949c91fc03348c6b283c937d72660216469bc478a0ff5b18b0e13d5bf76e76
- MD5 658d4b5dcc95488ae2aa494a9cf3dc0c
- SHA1 8c78e2d6b247b4217f14a656be9ef97d8d0f3961
- SHA512 488f10aab2f05b87c4f192964fdc8b1a0b549ed75d0e8e0c07eafb52178a5c00f9cf2d6806d127a7e14e4a491d4f30a05488bd91e0c44ed0131611ae7b605624
- SSDEEP 24576:2wuXOWkLqna7RGw1iqhuOM6ansBjxkOTWvks/:2wQOHWoRGw7uOMkBjxFT6f
- TLSH T12405F14677E41CF9EA6381388597C135F7B2BC562A21CB1F0760C65B5F373A1AD2AB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 d29836f71c9b8927437150f7f6855db9e2167d4f376b9df4af402c90e4ae8878
- MD5 6a3bfbb029c49e81736bf25286583fca
- SHA1 2971871d8adb0942ea32c311589a8da8eabaaff9
- SHA512 4067fe0294520f5b58ce3e6d60168dbc2371c5d936dfdba02cc91e48544284eb6a0c726f93bcd95ba9b3e6225b8978d101a2331279f5a0e593cea0236a22c5be
- SSDEEP 49152:PB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glWWoRGw7uOMkBjxFT6f:xu6JmQxd2dWWbwqOMkJxFuf
- TLSH T1AED59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.0MB
- SHA256 e9b512fc3293b674237567e4447971a85afada28cef801d7314f918b81ffcee5
- MD5 11731e6f74c427d33ab429613defd792
- SHA1 7bf7a33331f8d6b75927ea476c984d02adb822ee
- SHA512 bcdd63acb92e30789412d1d404d3c64c8e6732e0584f9763ff648fef946027d6003a14d88e8d925dc474ccb19e8fd70051fef97ffaf2c1751b9e2ee018b13e4c
- SSDEEP 24576:BfwvOk9RX6wkyAIdLqna7RGw1iqhuOM6ansBjxkOTWvks/:tMnYIdWoRGw7uOMkBjxFT6f
- TLSH T1FD35D029EBDC04E5E177823C99B7460AF6B178691B31C6CF029A53AD0E37ED45E3A710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 b80bede0ad2b7a665f9953b1b9ce919d12dd47c614324ebb88691e46f6211520
- MD5 53cacb85462b64f5af6eefcfd00621a6
- SHA1 826a3da2ebf9136208d33559846ed55224ef1cd2
- SHA512 c7728236e41225cfb6b83511d0bec949c214225c135fde8a4fb069cc64ae7a6f3e3d1828cf91138787b9b8e9271d54fb8fb00b414dcecd70539e1411a9dff923
- SSDEEP 49152:+YjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0GWoRGw7uOMkBy:2ySzPOWbwqOMkJxFuf
- TLSH T1E5066C96A1A801D5C1B9C1B98F0BCC1BFA7134490335ABEB03E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 48a24fd6ac74dd38c3335a03d6c5012839fd65a3c9d25b852690cf3a385967ff
- MD5 a3f80a0fa35f49592c63e3d2f955161b
- SHA1 525c38cb5f9ea679b6332a4c24b7684764574573
- SHA512 9c772e1335f8597b1d45728469733ea3cc8407358a0e53924355a1abbbc21a49ab43e53f490853232a270caf13519f535baee466a62662e5d419a161e47fcb02
- SSDEEP 24576:a47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYsLqna7RGw1iqhuOM6ansBjxkOTWvke:a47JUQjairIhCnDHUPfF/WWoRGw7uOMv
- TLSH T1BE65AE1EA3EC01E5E1BA827885154A1AEA71782E5F31CACF2270437D6F63ED45F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.1MB
- SHA256 210a8b94c116e13c568c5734dc0c5c8d479dcd64f9af43a1af6682bb761513e7
- MD5 518a1851f29ff3ec468e65d778dd1282
- SHA1 66b2260cfaa9be65247e031c642337dc13fec678
- SHA512 288e5f3cb4f095b2a1614e0ad7f7feb9cc5e7b09d6acce846d64e1ce17ae95e5cd40ec3c537525e3f7a927600cb7fdb4cf92343e0ab5e11c87c9eaa2615d71ec
- SSDEEP 12288:gipmU3fz8B56i9erOEh46K8CdiAsadftEm/jKqB:giYUPzgMydhsaJOm7z
- TLSH T1AA3518507666CB4FC5A940325E36D2CCAB707D15EE04AF0773C98B3F8576658BAF2282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.4MB
- SHA256 51c7cfef29dc5665333d918984887accde2e301efdcf87408cc858f0bafb8136
- MD5 0e145d8bebe09837b5ceca2fb02422e8
- SHA1 730ac2a05d00fb9645c7ae8419bb27d611c54fc5
- SHA512 892913879a978900efd7e560c299ec2b5d1f5da27159dee06d884626b215eff35295c24c4089a9592805ac5fec4dcedf6610f4829e7bcdd0aa48827d9768674f
- SSDEEP 6144:JYT/OdzeGoEh46K68HeOOJwvEtMxKvEtMxfUNYoPsW0hRxkrg5uMSrzW/O:ezGoEh46K68+OOJiYl5Yzb
- TLSH T1EA650940A537E78FD1B66032072A5B8CBB64EC07B7496F227399453ED867B11A0F93C6
- MD5 SHA1 SHA512 SSDEEP TLSH
2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe
- Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-10-31_7c566ccda70fd957296456bf84cb2190_amadey_darkgate_elex_glassworm_luca-stealer_neshta_njrat_ransomhub_smoke-loader.exe
- Size 3.5MB
- SHA256 82c10e1622ba19ea2bf8e53abe9dbae72033fc005bf6f8fa8e4cb568b01c0710
- MD5 77cf83458d8f8b2c89bfa4010b8fef2e
- SHA1 90dbafa3558e2b61ebd13cd6f576eeb06a796c45
- SHA512 c24282a89ee001c02e8b077d9320f256069ff45505cc0fed26f804bcd6f4dafee3ac1366ea21591fa24504f282e8176606c51029ae36766b99a722da8585cd26
- SSDEEP 98304:3z5nj5iV8FSGIkXP9QtSBt7rMt73tgEWbwqOMkJxFuf:p1tXPZtkt73tgHFOMkPo
- TLSH T16E06BF217EB19833C5A30372496EF27D326DAD641B3850CB53CB3A983E34AF25A35567
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
- Size 494KB
- SHA256 7b945c7e6b8bfbb489f003ecd1d0dcd4803042003de4646d4206114361a0fbbb
- MD5 05bdfd8a3128ab14d96818f43ebe9c0e
- SHA1 495cbbd020391e05d11c52aa23bdae7b89532eb7
- SHA512 8d9b9fc407986bd53fe3b56c96b7371cc782b4bac705253bfb0a2b0b1e6883fdb022f1ac87b8bfd7005291991b6a3dfbaceab54f5d494e0af70f0435a0b8b0da
- SSDEEP 6144:k9r5Qw0tneDA/sqhleIc0HftDrkYY1hj63hgDonsogCh6NEpAFH78r:abM3npxYfj63hgD1Zim8r
- TLSH T1BDB42A12B7E99135F6F31B31AE7592614A7ABC729D35C20F23D41A0D0DB0A90EA75B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\All Users\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
- Size 485KB
- SHA256 8c35dcc975a5c7c687686a3970306452476d17a89787bc5bd3bf21b9de0d36a5
- MD5 86749cd13537a694795be5d87ef7106d
- SHA1 538030845680a8be8219618daee29e368dc1e06c
- SHA512 7b6ae20515fb6b13701df422cbb0844d26c8a98087b2758427781f0bf11eb9ec5da029096e42960bf99ddd3d4f817db6e29ac172039110df6ea92547d331db4c
- SSDEEP 12288:/0IursYCYQeSnyZJiqlEbXSb9NtoqOFBqkYHkZH:8MYenGJiKEbXWtpOLl5
- TLSH T1F4B47E32A6949032D6B214B3E515C5307E3DB1196F3448AB97909E2E3E7C582BBF734B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\All Users\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
- Size 674KB
- SHA256 c48abbc29405559e68cc9f8fc6d218aa317a9d0023839c7846ca509c1f563fea
- MD5 97510a7d9bf0811a6ea89fad85a9f3f3
- SHA1 2ac0c49b66a92789be65580a38ae9798237711db
- SHA512 2a93e2a3bd187fdde160f87ef777ccd1d1c398d547b7c869e6b64469b9418ad04d887cdfe94af7407476377bf2d009f576de3935c025b7aefbab26fbcd8f90fb
- SSDEEP 12288:kskY7gjcjhVIEhqgM7bWvcsi6aVOfIyWL2JGP9/ztLlAZHYdnMwJ:ksZgjS1hqgSC/izGfU2JGlbhlAZ4RMK
- TLSH T141E49F31E5614032D2F106B3B968E2347D3CE228672489AEE3D8ED5D7EA849177B7347
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\All Users\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
- Size 648KB
- SHA256 a1afa6e62527e43b25c7d27bb24bc6bebce4e10a166a6c0526b2eec4b03caebc
- MD5 dea6db557a780b85d6ca92291effed95
- SHA1 d6c57e3b395e148aebe55d8db0922f30365d7263
- SHA512 c7e3b7bbfc6df0221633f55237d08c0efb929655c46e2363a949236b43c157fb5b89b5a817cf314c224f32edfe2e77b3aa5e3b39500fd1f1013e0fcb48b6154e
- SSDEEP 12288:TEsd9PZfePv3xl7ft7V+6uC+zd5qLlE13wGKiy7nlEM0DnmdVL:T39PZfePv3r7fm6t+jqp+3l+zCM08L
- TLSH T101E48D32A5604032E6F10673BD28D6313D3CE328276488AAE7D4AD1D7EB84D667F7257
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\All Users\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
- Size 674KB
- SHA256 ccf37e88447a7afdb0ba4351b8c5606dbb05b984fb133194d71bcc00d7be4e36
- MD5 9c10a5ec52c145d340df7eafdb69c478
- SHA1 57f3d99e41d123ad5f185fc21454367a7285db42
- SHA512 2704cfd1a708bfca6db7c52467d3abf0b09313db0cdd1ea8e5d48504c8240c4bf24e677f17c5df9e3ac1f6a678e0328e73e951dc4481f35027cb03b2966dc38f
- SSDEEP 12288:kskY7gjcjhVIEhqgM7bWvcsi6aVtrIyzU40vy3W/ceKSHMsiFyY6XN94nMwJ:ksZgjS1hqgSC/izJfojymk4HM5yJoMK
- TLSH T1A8E49F32A5604032D6F106B3A918E2347D7CE21867248DAAE3E8ED5D7EA84D177F7347
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\All Users\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
- Size 495KB
- SHA256 45966655baaed42df92cd6d8094b4172c0e7a0320528b59cf63fca7c25d66e9c
- MD5 9597098cfbc45fae685d9480d135ed13
- SHA1 84401f03a7942a7e4fcd26e4414b227edd9b0f09
- SHA512 16afbdffe4b4b2e54b4cc96fe74e49ca367dea50752321ddf334756519812ba8ce147ef5459e421dc42e103bc3456aab1d185588cc86b35fa2315ac86b2a0164
- SSDEEP 6144:k98Mq5S+Ud8AK+ehB9XgdmAeUBZ2x52OoElZTxPhhQgO1Oi9+8Vl9fAx/WfoMnqV:tU8AMXE9B7PElZlP41N+4PUWfouqIO7
- TLSH T1C6B46D31A6A04037D2F106B3FD15D2707E7DA2187B2084AB9394AE1D7EA95E767F7203
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\All Users\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
- Size 485KB
- SHA256 8d0045c74270281c705009d49441167c8a51ac70b720f84ff941b39fad220919
- MD5 87f15006aea3b4433e226882a56f188d
- SHA1 e3ad6beb8229af62b0824151dbf546c0506d4f65
- SHA512 b01a8af6dc836044d2adc6828654fa7a187c3f7ffe2a4db4c73021be6d121f9c1c47b1643513c3f25c0e1b5123b8ce2dc78b2ca8ce638a09c2171f158762c7c1
- SSDEEP 12288:/0IursYCYQeSnyZJiqlEbXSb9NtCGOF2O27MVz+ZH:8MYenGJiKEbXWtfOkU+
- TLSH T1B7B47E32A6949032D5B214B3E919C5317E3DA1196F3048B797909E2E3E7C582BBFB347
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\All Users\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe
- Size 650KB
- SHA256 a6180f0aa9c56c32e71fe8dc150131177e4036a5a2111d0f3ec3c341fd813222
- MD5 2f826daacb184077b67aad3fe30e3413
- SHA1 981d415fe70414aaac3a11024e65ae2e949aced8
- SHA512 2a6d9bdf4b7be9b766008e522cbb2c21921ba55d84dfde653ca977f70639e342a9d5548768de29ae2a85031c11dac2ae4b3c76b9136c020a6e7c9a9a5879caeb
- SSDEEP 12288:CWukhI2jFMSjysAS9X/GsfTDYrGiCI1BrLXpdV0yJkxM6qG+vDnm35o:CWpI2jFM5sFzfTpil15Z+M6qTq5o
- TLSH T12BE49E32A5614032E7F105B3B928D1303D7CA728276089BAE7D4AD1D7EB44E267FB257
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\All Users\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\windowsdesktop-runtime-7.0.16-win-x64.exe
- Size 650KB
- SHA256 671be498af4e13872784eeae4bae2e462dfac62d51d7057b2b3bebff511b7d18
- MD5 72d0addae57f28c993b319bfafa190ac
- SHA1 8082ad7a004a399f0edbf447425f6a0f6c772ff3
- SHA512 98bcde1133edbff713aa43b944dceb5dae20a9cbdf8009f5b758da20ccfbcdf6d617f609a7094aa52a514373f6695b0fd43c3d601538483816cd08832edd15ab
- SSDEEP 12288:CWukhI2jFMSjysAS9X/GsfTDYrGiJ91Brr8GU0yJlhrY2DnmR5o:CWpI2jFM5sFzfTpi71R8dZ45o
- TLSH T128E49E32A5614036F7F106B3B928D1307D7CA328276089BAE3D4AD1D7E744A267FB257
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\All Users\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
- Size 495KB
- SHA256 d882f673ddf40a7ea6d89ce25e4ee55d94a5ef0b5403aa8d86656fd960d0e4ac
- MD5 07e194ce831b1846111eb6c8b176c86e
- SHA1 b9c83ec3b0949cb661878fb1a8b43a073e15baf1
- SHA512 55f9b6d3199aa60d836b6792ae55731236fb2a99c79ce8522e07e579c64eabb88fa413c02632deb87a361dd8490361aa1424beed2e01ba28be220f8c676a1bb5
- SSDEEP 6144:k98Mq5S+Ud8AK+ehB9XgdmAeUBZ2x52OoElZTxPhhQgO1OiP6dQguVftf4qIuRes:tU8AMXE9B7PElZlP41f60OqIO7
- TLSH T1D3B46C31E6A04037D6F106B3FD14D2707D7DA2187B2184AB9394AE2D6EA85E767F7203
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 80042d0a71e6f43652db0894fbfe749f2b6defe00db129c0454e8a401b090bd3
- MD5 70394194308eb3646de1376c25bf8118
- SHA1 e6731cb26d28bc36b808171928c4543232f1139b
- SHA512 47824168317fb720a8962d43d46a3f36fbcdf08e331ace17556e3c83d1139c594ffb694a5cac0094dea08ad93768ebb7279a3acf36cacb4b18c9439e6802e5c0
- SSDEEP 12288:zz7JLN4narfybM0nw1iqD7ZuOM6aTPD5uicYzgwexx27xcTWvv8s4w:jJLqna7RGw1iqhuOM6ansBjxkOTWvks/
- TLSH T113D42317EBC92496FF738570649E90301405FEFEEF5084DB6E25288D50B4EEA4EB264B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 5758cb7af3282927563667994187b52bdcdd5cbd24ceb80c4e88832aa2d2cd53
- MD5 6c470e47cbb5aab2aa8204bec8490eae
- SHA1 d3ee6feb8d414cfb2d5176f50b2ef3b4351f2248
- SHA512 643864e0a7edae15a128b51b621c1edb1edd762a79325a59c868d018984375ce6efdd3ed9da0080fc247f887b46e4da4a618705c9916571089233e0f0fdd3aa4
- SSDEEP 24576:Mgb6bmBIi49WNNFpg1rSvFv7bYfLqna7RGw1iqhuOM6ansBjxkOTWvks/:Mgb4mBIBhGFsWoRGw7uOMkBjxFT6f
- TLSH T12265AE1E22EC02F5E0F6D2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.1MB
- SHA256 35d57a42033ee7005f845c4322fae22ad980e304a8863cd8f3776862c92d73b9
- MD5 dced86b54351f9674326aaa848850e15
- SHA1 a80498fa4db1ccfbebe6593bbc824e895f71564f
- SHA512 cd2ca6afcebe2ce859ab974e1cd5b207a8612ee60ea8ff58bf27c6aaacd2a5ee0728527ace8f4576a0fdf04dc35d019a64706ad79d1a10ac11f0f055d40f4510
- SSDEEP 24576:+G88u8FpJqH1nzria7/mcLqna7RGw1iqhuOM6ansBjxkOTWvks/:V7ZFPqV6a7/XWoRGw7uOMkBjxFT6f
- TLSH T1CB35F165B7E101F1D477C13889864663F6B2B8251360EFDF07A88A551F33AE50B7EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 4d2a1f3a568e96f80b40c23039ad9787a217a214c95c4a9a83e31a569a49c1cc
- MD5 2c1a31e6c4d2580034445796c1692fbf
- SHA1 da58c9033e0d2c58255d0a6cebf05de4800dc4cf
- SHA512 5543417aa0b484d34c302eff2c7f0f1e96bce5011a2990c7e94b4b6822ca5e2491abb45e9610fb53ca2ea13d9728340c9ee271b268c65535af90f761e75cb7a6
- SSDEEP 49152:QBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjwWoRGw7uOMkBjxFTS:LG05lO43b1WbwqOMkJxFuf
- TLSH T1DED5BF6A62EC11F9D1BBC17CD9C6460BEBB23825033556CF02A486A91F27FF4597E312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 a6378f486689193726c409b01c6c977df59d52abcca9b1cc2ab0212d088b7193
- MD5 2c6764ac9307aa36ce4e72f75e5f6936
- SHA1 121686f5bfa88891f1a5e1f72267e2114cea37fb
- SHA512 16f79135a920d608c8392086042040be1ca6a3acc9a06ec911b8eac82ffd58bdd88cb21729c83b559009e8206e3c6179eaeacb7271bca79a408a5c94be63d06b
- SSDEEP 24576:qfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnGLqna7RGw1iqhuOM6ansBjxkOTWP:ia5POZ3hJt2pasx2+m4WoRGw7uOMkBj2
- TLSH T19F65BF5EA7FC00D5E579D17DC583861AE5B1342653319ACF022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 fd579ffc991f6eae821e6e79a529687be2386cea2db210190b5af72758638d2f
- MD5 ea7147c5d3ef23c36d753da7bba3e85b
- SHA1 285a085e239a1eff2a7eadc0b57db34a410babf8
- SHA512 69097331970b18a50a8a9bd6ac73f244b70852052832b0d1d5a4d39539b154416bfad944d5412abeb1edad05932655fa393a5fd5d3526227543031d6e93af648
- SSDEEP 24576:4NcwHdjbyQ4nLC18lb/EOjowL7FkELqna7RGw1iqhuOM6ansBjxkOTWvks/:4Nc/zEOVHF3WoRGw7uOMkBjxFT6f
- TLSH T1B7858B1623E901E4F5BBE1BE89679546FA71786953308ACF0291811F1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 4c0941de07bc2a400dc1ce38303de9ea381c0010abd680bf0b9580a632d95be4
- MD5 9f87eace54eafbb216ba99fa852d0765
- SHA1 8d396550457b1ee6670f5e0b35e348480c223a58
- SHA512 884d50af1375946806f61d9847c7d6cb7288917eacac4c6176935832532cb035f63ca0471de34859e73a90268a1c2717b076717b68756ba4f8d08a88bffeaa68
- SSDEEP 24576:Q3kNvNnaFeYhJNtmZBmCLqna7RGw1iqhuOM6ansBjxkOTWvks/:Q3MwBtOmCWoRGw7uOMkBjxFT6f
- TLSH T1FE55AF6EBAF805E4E1FAC6B4CD238512E6727461173292CB5390C13F0E679D89E76F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 804KB
- SHA256 d91f4de43e4044243b738a60506bbbe5fe12b8a4763a31858ad9a3d4eb261165
- MD5 f48ca77aefb47dbbca6bc12cb92705be
- SHA1 1237914f549c0ba4281f7aa2c03518a2fd421e0e
- SHA512 dab28ebad99ba80b6e9a090e5637ef7307b7cc6f7008ff42e785e2215a22575093d3c0b777b696378088e2641d0b378d92e3d706929f7324449b578f9f1f7885
- SSDEEP 24576:oPUr+NQALqna7RGw1iqhuOM6ansBjxkOTWvks/:oJQAWoRGw7uOMkBjxFT6f
- TLSH T15705F12F62DD18E5FA76D17C89868219E771B8621711D2CF02E0417E0E77EE8BD3AB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 964KB
- SHA256 9be027039bb5f8d59174a0f56bd49d5d763a05633f6ab90291e80997123ac598
- MD5 48c13934baabc857a17a764bdc778c28
- SHA1 e3a834829fee87ae16c695d5bfca910dff0c312a
- SHA512 80a0bafe2acb8a139c3c7f30b0f27d44976921fa4f5aaa5f56066b3cc08a89c799533670817b9de69c6edf4d388d189f9b995da167c933f91467a895d3c85e15
- SSDEEP 24576:YD3FHshBIYQgAFLqna7RGw1iqhuOM6ansBjxkOTWvks/:YDVHeBIAAFWoRGw7uOMkBjxFT6f
- TLSH T17E25E13EEB9C00E4E97BC1BCDA538606E67138AD072155DB06D481BA1F6BEE46D39F40
- MD5 SHA1 SHA512 SSDEEP TLSH