f2460cdea9bb3143c5def437dcb357bfbeee2ce88235f3472072bac6b4bced65

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Size 4.6MB
Sample261104-vr7mbsby2s
SHA256 f2460cdea9bb3143c5def437dcb357bfbeee2ce88235f3472072bac6b4bced65
MD5 7102652d029a4102cb1be08f9b66ebe5
SHA1 294f25f6dc5ad761f0dd406f8525fb109ef95a22
SHA512 25f7436ff9d707c6fc1ccbdd6c9695f595cf846dc11a85a5a1ddb8de690ff7458dc2967cfdd196d0ce5014c2c3f663028297d41881a1e0911d1fb79dd05f1176
SSDEEP 98304:mgJxIxMfY9b4hY8ffnpBZa8wSypsmCqC5+uMU+57:mgQx2Y9bJGfZMfsmCrVg
TLSH
T16726A0207607C037DA9351B25A2CAB9F863CAA201FB614D793E43E7D0D615C36B36E97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit defense_evasion discovery persistence spyware stealer upx

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
9	6120	240737812.tmp

Executes dropped EXE 13 IoCs

pid	Process
4164	elevation_service.exe
4308	elevation_service.exe
4548	maintenanceservice.exe
3512	OSE.EXE
4748	PerceptionSimulationService.exe
4956	perfhost.exe
5384	ReFsDedupSvc.exe
3028	SensorDataService.exe
4580	ssh-agent.exe
2396	AgentService.exe
3216	SearchIndexer.exe
6120	240737812.tmp
4692	oahbsfev.exe

Loads dropped DLL 1 IoCs

pid	Process
2940	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
9	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\11565b5fc17a6531.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00010000000093ab-392.dat	upx
behavioral2/files/0x000100000000932b-391.dat	upx
behavioral2/files/0x0001000000009cd6-398.dat	upx
behavioral2/files/0x0001000000009b92-400.dat	upx
behavioral2/files/0x000100000000a0ce-403.dat	upx
behavioral2/files/0x000100000000a2c1-406.dat	upx
behavioral2/files/0x000100000000935d-405.dat	upx
behavioral2/files/0x000100000000a1d4-404.dat	upx
behavioral2/files/0x000100000000ba3e-402.dat	upx
behavioral2/files/0x0001000000006215-401.dat	upx
behavioral2/files/0x0001000000009cfe-399.dat	upx
behavioral2/files/0x000100000001b96e-397.dat	upx
behavioral2/files/0x0001000000009952-396.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104140\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\CCUpdate.ini	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	240737812.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	240737812.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005d250642806cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004619f207806cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000009ed4307806cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000036812c08806cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b4a30943806cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000018d4a906806cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
4692	oahbsfev.exe
4692	oahbsfev.exe
4692	oahbsfev.exe
4692	oahbsfev.exe
4164	elevation_service.exe
4164	elevation_service.exe
4164	elevation_service.exe
4164	elevation_service.exe
4164	elevation_service.exe
4164	elevation_service.exe
4164	elevation_service.exe
4308	elevation_service.exe
4308	elevation_service.exe
4308	elevation_service.exe
4308	elevation_service.exe
4308	elevation_service.exe
4308	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3800	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeAssignPrimaryTokenPrivilege	2396	AgentService.exe
Token: SeBackupPrivilege	5384	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5384	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5384	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5384	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5384	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5384	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5384	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5384	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5384	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5384	ReFsDedupSvc.exe
Token: 33	3216	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3216	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3216	SearchIndexer.exe
Token: SeDebugPrivilege	4164	elevation_service.exe
Token: SeDebugPrivilege	4308	elevation_service.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 3500	3216	SearchIndexer.exe	100
PID 3800 wrote to memory of 6120	3800	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe	101
PID 3800 wrote to memory of 2940	3800	2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe	102
PID 6120 wrote to memory of 4692	6120	240737812.tmp	103
PID 4692 wrote to memory of 5608	4692	oahbsfev.exe	104
PID 4692 wrote to memory of 2284	4692	oahbsfev.exe	106
PID 3216 wrote to memory of 4736	3216	SearchIndexer.exe	108
PID 3216 wrote to memory of 1160	3216	SearchIndexer.exe	109
PID 3216 wrote to memory of 992	3216	SearchIndexer.exe	110
PID 3216 wrote to memory of 5372	3216	SearchIndexer.exe	112
PID 3216 wrote to memory of 4772	3216	SearchIndexer.exe	113
PID 3216 wrote to memory of 1848	3216	SearchIndexer.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3800
- C:\Users\Admin\AppData\Roaming\240737812.tmp
  "C:\Users\Admin\AppData\Roaming\240737812.tmp"
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:6120
- - C:\Users\Admin\AppData\Local\Temp\oahbsfev.exe
    "C:\Users\Admin\AppData\Local\Temp\oahbsfev.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4692
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks.exe /Delete /TN "MicrosoftEdgeUpdateTaskMachine96ad8d82" /F
      4⤵
      PID:5608
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks.exe /Query /TN "MicrosoftEdgeUpdateTaskMachine96ad8d82"
      4⤵
      PID:2284
- C:\Users\Admin\AppData\Local\Temp\2026-11-03_7102652d029a4102cb1be08f9b66ebe5_amadey_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
  CCUpdate.exe /emupdater /applydll "C:\Users\Admin\AppData\Local\Temp\3d924f90-ac88-4209-a19c-e1563f6a8080.dll"
  2⤵
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - Direct Volume Access: Opens a physical disk for reading
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  PID:2940

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4164

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4308

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4548

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3512

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4748

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4956

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5384

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3028

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4580

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2396

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3500
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4736
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3068 3056 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1160
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3036 3024 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:992
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5372
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3036 3024 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4772
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3068 3056 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2507b7ac3dc67dfb91e64745507c946c514f859c305903a24a951e334abbf70f
MD5 bd6e3b54312a0b7bc8ba7c0cd1274b87
SHA1 5c012d3b78a1936549a8c30fcc5e41144ec6c444
SHA512 8b30b00ad1e6a98cd3200872bc292a944d7c37cd4abe24c4170b6b3a55f2a2bf7e4d0dce4a1cc51d9d012b3561f562f0f78a993ac311318bb6328112b71345bb
SSDEEP 49152:Ab+632BuPkFKRrdE6ohQstBhuXjfS4LWxnzxrYpBZa8DkSyp:q3q6tjBXpBZa8wSyp
TLSH
T182D59D03F29900E9E069D178D7469133EAA2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.2MB
SHA256 4fcd23198fa65132d6a8f2fcd1b46371e9489a3309017253acfc3adb1efeae16
MD5 607290c48cb9653baaeb6a747ac2801b
SHA1 92e8b1929d6e8659c47d09752ff2454a28cc9df2
SHA512 a601b46a80136881cff5c2078915394e11d1602f0569ec7fb6474b18acd642b8bf5b0a61a28bf76131efd566acd61142dae2f9afbbb0c8f99f94cee28ee6b2fd
SSDEEP 49152:nncdxrYpBZa8DkSyp4qmCZqCBjLiuMU+57:nBpBZa8wSyptmCqC5+uMU+57
TLSH
T1A9B51228779489F9ED678278C8B29415E7327C418760E75B03B4A93A4F337C8AD3EB54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.2MB
SHA256 1f7b8be9c6bbca0d8d82fd76550ffe7e77a63274fe33d30175b684faa9e7f04c
MD5 852e36f20722c5285259fbc25976070c
SHA1 dd361b5af3d211a881a322e982fa9635f2a045f3
SHA512 f3ccead097b951f712668e7d7e261e5d58bd67f22d4ad4bbe914dcf59ff61dec5d53a5e64fa925610d77a6ec1ae5f776c67d2703de13cbcba6758f09f6036249
SSDEEP 49152:YtcdxrYpBZa8DkSyp4qmCZqCBjLiuMU+57:YvpBZa8wSyptmCqC5+uMU+57
TLSH
T180B51228779489F9ED678278C8B29415E7327C418760E79B03B4A53A4F337C8AD3EB54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 2de40a4ad101f4675054f5898afd09fd49a0208522cedeaa57add1d3b678f42d
MD5 774a608273ca4852b31ffcda7709824a
SHA1 b6dd70f2986cdbd8dc7fa78dda8feb4db3fc0a98
SHA512 3c6916238cccfaa64f24abd8910cbaabb89537ae53c46bcc9d29d3da21212307b7b39956e840cf65d15812632c7f3ec232f74f411c0beaec057c73deb7a09b29
SSDEEP 24576:M0Le5ji0hmxnrM5osXhn6NmrVYLlBZ/y8DkSvuQCpv:MPji0Ax8xrYpBZa8DkSyp
TLSH
T1A685AF16F6748335D073C0B9C5D2A68EEA7130865B308ACB4286D77C7F67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4e755de31256835e4172668f612e4b2baf85a5ef55af41582a5e02f20ee721f7
MD5 cb7f81124abbb8cdb93b8f8ae397ea59
SHA1 173367f37b5bbc9bd24c4a8026ff867806386590
SHA512 2c2ab3b5971f352d1b4e70a622e143a20fbe0092cf79e7f11485bfd8be19b1014bf6e48645def96f2e3f8399b6b5692d5d1e02a3047edbbff6287195c1e2b641
SSDEEP 24576:pa7/ezSC6vUyDZaqgrvWx6q8wyunosXhn6NmrVYLlBZ/y8DkSvuQCpv:Y/ezSC6vURPvMHjy4xrYpBZa8DkSyp
TLSH
T132755C25F5788323D0B2D0BAC5D6BA99FE3230465B3089CB4246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a75549dd8dddcc3f7ba1818e06625136894e22e393c910b3088decee01dbec7b
MD5 d916da94f6dca127de09dd917b15a61e
SHA1 7b03221b4180558137e48023bdb7a109f855edb6
SHA512 ffa8796b7aa5614fb1112beaca00d00c3f7599d8d4aa98b3922bf41430a701796a3146ff115df14807c1df3a2739b8780289806ce0f0abeb1db34a44de9369f7
SSDEEP 24576:hVbqPb88hv/lV7wosXhn6NmrVYLlBZ/y8DkSvuQCpv:hVO88hXlVexrYpBZa8DkSyp
TLSH
T1CE559E66F574C331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C2E67AD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 c6fd53bc18885e86cd80d78dcb6a9a912946b2f111c850071bd85f40cb6aa206
MD5 4541c9ad9af1b8f96ce001a94973024d
SHA1 9fa1dcd54dd5977286bd6787cfc96c940605745e
SHA512 549362501f09eea5a67e5ba41ee14ddac4ff1a0b47eaa25374f949dbf510484eb782357a29b02c3e316fec1aceef8f04e385781978469e3413ad4d1a868ebeaa
SSDEEP 12288:cG24TosSqhucX6NmEfJn+VYLlBD9rL0Xp55mDkSDj9sQCpluE/pN:cGVosXhn6NmrVYLlBZ/y8DkSvuQCpv
TLSH
T1C2552359BB0CC2EAFF79E7B7C41A70C853086F00EB66991BD5203DAB42B5CCDE8155A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 fa3c87e3d0a15d3f90ffb0020747d764607c581d4ddeafc12165cbeec14072e2
MD5 aeb74ba547a33d95a9828e8513da872b
SHA1 9fbc9bd84b3d001111da5fc865b315b8b12c4d0f
SHA512 46a98df1a477cc21ceb7c613936d062cf9b11ac0e4d8f47bc96b69e24c2bbd29402fd1d50671d41b56f3e0d0672d2279b5f039a2001afc00b32b225392276cdf
SSDEEP 24576:YJIUIosXhn6NmrVYLlBZ/y8DkSvuQCpv:YJIUyxrYpBZa8DkSyp
TLSH
T11575CF3BEE28FCE2C67E9DB95A518240D77278308F62A3CBD164820ECE235D55D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8554e6e4c4467a92b271749308fcfdb843834d2a29803aa3d62cbfb6161cb92b
MD5 a44d8510747cd9a9a5bfe999829f5930
SHA1 bd735356f06ba4ca6fd7ab3af3f23f3f6b6b8a6a
SHA512 22c724c6845ae41617792727222da17ca507e9b4e8a084eb0b1dedf5588aa6b55081af385f0ad6d6222c629c6d131527a6dce46ad038037c65deef1ccc70233a
SSDEEP 49152:HQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THg:HQvGAdlCEL8c/pRNw5C0pBZa8wSyp
TLSH
T14B266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 fb94f7f7c165dc6f8f90a4755507f3d7d7c7a8d5f67ec63e1a58e7c683591644
MD5 2451bab5f12c305ac931ba1da8cd6322
SHA1 6c152c08075998e80135dfb6282ec1e6001889d6
SHA512 106e256b237edbde2ab245991cc44408236cf3d9efa174ebcb70f4dd449d00c6fdfe1f7e4cf599662046ccca8d88cfcb78c7b0475fab37abd25a12e3cdc86da4
SSDEEP 24576:UwewsAj2osXhn6NmrVYLlBZ/y8DkSvuQCpv:tljsxrYpBZa8DkSyp
TLSH
T1B075E031FE74E036D77F0DB61B26D316142CBE204B621AC3E3A85E9E49705C26776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7d66df9636438bfcbe4ab3d79d569e5fec211778c22ccf2d4eab50a0d97c4430
MD5 eebe29d89bc682d369acc25a392d04d1
SHA1 7e040fa0686e987f8b3a6e8cf2565ad049b18798
SHA512 2854daeb952d131d2ab66ac38c97e25fcee05c41ca33f8466c69da65ccd2b9c2b84602e850f8708d591fe3d2e760de23ffeb674e70453914545a66d2af8785af
SSDEEP 196608:vUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJH5ZMf:vUEtQevvqc2W1cpV29I325Z
TLSH
T139474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 93f5d082432570065cef7a5a67d2cd4eaf404618adfe8c8b270cfb44fc863085
MD5 06fc8c21777b2c2e843f145be097c8f5
SHA1 8429751179cc46ebc34d0b5229f3c47bc9a64c26
SHA512 7a98148ac675ab9b2a02df8ebe7d58b6d23cfa4a23b15f5610f4a7da242ebbfb39cc72b6da7bd5d7a1388681d4768f5d4e748115208dbf501a87dadc7d76316f
SSDEEP 49152:qCbRquA/m2yL5zifFiV+XenmE3/zMxrYpBZa8DkSyp:foqHVjnmwpBZa8wSyp
TLSH
T1C1D58D0976B8C2E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 216532ef8b461d6d8cf9e834fd572a687efc8f5832136c05ae94956263517edb
MD5 1dd99397cf87c7c291a311ac4643488b
SHA1 92ab08fc6373012924f0ade5d6b9f1b2f6b304ae
SHA512 31e3719a3c58e0d5b3c1733c18f51bc4a2ec5aa14eecc7c8df7ad007a8dae451de1b2c48b1c29fbb89b83cc279d2f90529dd973571cb001d06115974aa591335
SSDEEP 24576:FAhGLmIFoiwtA5l7S537osXhn6NmrVYLlBZ/y8DkSvuQCpv:FAM1Foiq5ZxrYpBZa8DkSyp
TLSH
T119359D81EBF955D4F5B3AAB899B69170EA76BCA55E31C20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 2d270d4aafb0a528f9803188f65e380f07523911f339ffb1fbb294f1260748a2
MD5 24971e7777c63160bf17ac666f51f840
SHA1 c9c48f982dadd7c46ee23287f1e725938c3689e3
SHA512 aa463c499d379c219dae66c27ecd0051f77fc2ad17c22d4a96dcd270460539b5a3ec854410215da06ac3198131cc10473027396d386d12743f254e117a18de61
SSDEEP 24576:/wuXOWKosXhn6NmrVYLlBZ/y8DkSvuQCpv:/wQOFxrYpBZa8DkSyp
TLSH
T1AB65F14A77A80CF9E9679239C557D036F7B2BC012A21CB1F5760CA6B5F33251AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 c396180935982cc682af44b90dbd204673143a52b82f4640c2610090326f137d
MD5 51af803b5787f1eab7b84aac52974442
SHA1 731be765590c4b56913477c43cbc26d51b089e51
SHA512 121725ca6b4cbc323dbe3aa732833b9e14fb1b20ab1614e2a57a9f2366546673a97df9f98031a6506a80047931a58376ae12a5ff89f5bf015710355e3a785832
SSDEEP 12288:AbZ1IyX4TosSqhucX6NmEfJn+VYLlBD9rL0Xp55mDkSDj9sQCpluE/pN:oZuxosXhn6NmrVYLlBZ/y8DkSvuQCpv
TLSH
T1D055125A379861FAF667937EC8A56048D3317C12A73283CF552026AA0F73DC96D39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0a0d19cfdf0614e3ed2672b62a80babab55654cc1f11d825b4605cf16285890a
MD5 5c7645806ad55e62c621c565e0472a2f
SHA1 20c2b1730375305c78bfe68871c639cfb76d8df9
SHA512 f44f070886f1859c3a9b663e6b58ad250fb7cabda60bb95b75e9b9353a7792d83e15d770e683ef9b42f03744cd64d0da716ee582624308bd138ad4cf85c19ed9
SSDEEP 98304:QQRQyi36YOcPuLvw2gAf+PN3LpBZa8wSyp:HQyiKakX+PN7ZMf
TLSH
T1F4667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8f91016f39747bb53bc9622b203c031d32d79e75fb46a22f606c391238a767df
MD5 3be31e4e2637e069da0ad7fe41e8b130
SHA1 534fbf38755dd8a310840b7fcef7558aad2af610
SHA512 4af83f6866db27340b4c86eb10b6b3ab6efb0aad3cc509a72638f4d9bc12caf3ef36f258d277d7b0dea90217c976c56ef2ebf513f4945290871aeff8de601840
SSDEEP 98304:CQRQyi36YOcPuLvw2gAf+PN3LpBZa8wSyp:ZQyiKakX+PN7ZMf
TLSH
T196667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 4d5b85fd7eafaa5c2fc14e6b80621bc54bae0b7a42b9edb820437d38534d464d
MD5 500d9951f2604064271063311ae249a4
SHA1 deaba521741c1cb21a33333fa2d9b1a7b0f02260
SHA512 4650c0ce657da8b16d059f5739406d467b1caa2ea369c0a1c5e9d3bddeea4252afb9ccef263aad81e91532ba12c7712637c581f50160271ebd9cf20a9bef208d
SSDEEP 49152:o68Qg55nhxeWu7PNU3/8xrYpBZa8DkSyp:ythGRc/1pBZa8wSyp
TLSH
T1E4B55933B2F600A9C44DE1769F4A972196D17C71CFE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 30ff58435a98b45538a6bea79ac011b2da1c32d51d17c7acb265f2638bd66e20
MD5 a8fa4c7dd0f48b63dcb44bf79045752e
SHA1 b48e8b5b4bf6cbdf161c7ee101c2fbc3dff9ac90
SHA512 9d18c9f50fe9394fcad1ac17a3f402fe8e1164101b592cf870afe199d9d1378c3d2674c121172b1aa003d265167e6b0cc5d20b686692753997630cf2a2f51462
SSDEEP 98304:My5112gYy5azzVvD69nLKnhZ6pBZa8wSyp:NLIH+WhcZMf
TLSH
T189167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c373f45a0cf798263fd8bf1133aef11ea957b5914410ec61521b273df1846dee
MD5 2ffeb0c489e7c46e10cf3ec5dd1ac653
SHA1 1c0014b207d98dbdfd5853c463b5093f94dff5ac
SHA512 00445f03cc1ad9d757acbf053f19f2b4605ebb8cea1f7521ec7a0631f7e00f371a36a84e4fbc0382e09084a55c8c2f6408a9941fe796c6846de32699c66a8ff7
SSDEEP 49152:LB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glmxrYpBZa8DkSyp:du6JmQxd2dTpBZa8wSyp
TLSH
T182D59D13F1DA01E8D06ED178974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 99bff2a463245f5779f9a21ae373ac2257584e0e5528515306d8d030650bfe00
MD5 49e398f3fb2996c177731cf2e48a920d
SHA1 ea04f5e9eeb68a4f9925633704ce83d487ff7f94
SHA512 cabaa0534ec42e275c9329cfa9e3501972f7922573c17c66af042248fb8f924614ec084145ced417d651cb83005e3d07f2947739dcebd309af1c36ac2bc8a61f
SSDEEP 49152:W1hpsNoJpF1A6yU44CwH7R4xSxrYpBZa8DkSyp:WmifPVRwpBZa8wSyp
TLSH
T1D7B5BE13F29901E8D06ED17887569232EA62BC460B34B6DF0A9077961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6700c5298c39e1a2d6a7c719d532bd8986e07238d7bb5b42467a6f7e55dff2da
MD5 246eb9efd5ff40716966c8b70f9ed448
SHA1 a5118cdc8297255909bf6eb6cd1ed02601984a1a
SHA512 4e27d0f6261101710ea5db529ee640d9f3a4327834d1db67e729463fa329e4f1ec64d4b341bf30de632cbfb47ba700c0aa3028d85e898da7bfb384ba695da759
SSDEEP 49152:6SuZQIY0Be2KIRVtOnks6NMHqjxrYpBZa8DkSyp:k5dKOi61OpBZa8wSyp
TLSH
T167C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b7e7be3cb181575b1eff3dc816b037cbeeece446f5b06c0201620fb3a4ef4d18
MD5 0fc61da6512489fe3a0776972646def2
SHA1 ccb816da9ce211bfe70bc1de4bd46af046baa1fb
SHA512 ed59e49407c5bab88afd541db3232ced4e660376e5da29dc1457d2c1cc2654eda1f9aece96b5bc55965e0788ab66358f305124e458c3a4c094743f845a2f303c
SSDEEP 49152:whtSn8EApI0figGgiDn0AP5wWxrYpBZa8DkSyp:hX2i/phspBZa8wSyp
TLSH
T1CB95BE13F2D901E8D05ED178C7468632EA62BC160B35AAEF0A50B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 65d99a90014a13ae2d44c2278ed9e6fbb59db780727a647625ff879cdc2e27b5
MD5 8073564f5a9095b8db50ce8dd91bacb8
SHA1 2299cb7b62b6a28ae4f523d94078b5edf7a93261
SHA512 a3cbe5b46a33e6ddc0bd05ed281c41ee5820158ee1bd5b431fdf48370fb5de4d8b61ee5594a4c33e51bcf18fc0413de9facd0b769182f5ef6e5d1acf62bdc0f7
SSDEEP 12288:4+4TosSqhucX6NmEfJn+VYLlBD9rL0Xp55mDkSDj9sQCpluE/pN:4tosXhn6NmrVYLlBZ/y8DkSvuQCpv
TLSH
T18655231ABA1DC3EAFA29E7B7C41A70C853087F05FB27951BE524396B43B2CCD68154E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 37d1263e3fc712069230b39e14a6ab2aefe9e0b7cd4182c9c617efd0ea25fa26
MD5 7ad843bce9d2640f8e11d15f35c3ef83
SHA1 293f8fa7e53d1d6a52d3027d8db618cb7f6cc714
SHA512 90571febac15a47b75c68dbc6b20f024edba8f105872e53f0f7fd42e12928161434e84a5e8a00cb359e35ab5acec8f30f54d4d1013fafe3116f0f48c151fb923
SSDEEP 12288:fb4TosSqhucX6NmEfJn+VYLlBD9rL0Xp55mDkSDj9sQCpluE/pN:fSosXhn6NmrVYLlBZ/y8DkSvuQCpv
TLSH
T118552319BA1DC2EAFA29E7B7C40A70CC53087F05FB27951BE524396B43B2CCD68155E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 9544bbaf2ee07f0d6cb677e83c4d712bd3cb50284bbb21b81260554f06e79fe8
MD5 d5c2249ee1a7f8807340df23b15c1b5c
SHA1 f897e22616469ae64e69a1573af89411c089916e
SHA512 1597201134c189ef557a9e6026b19d91f7ae325e9b48e2363bedeee6e26f6621caecf0871612df7efd31d3a84dc814b7b39b7ef872a025511e41314389385d39
SSDEEP 12288:Pl4TosSqhucX6NmEfJn+VYLlBD9rL0Xp55mDkSDj9sQCpluE/pN:PAosXhn6NmrVYLlBZ/y8DkSvuQCpv
TLSH
T13B552319BA1DC2EAFA29E7B7C40A70CC53087F05FB27951BE524396B43B2CCDA8155E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 5d52a430e6b909c6cd745f4f7f1c19c34a57b91765cf8175647bd53e7e1e7388
MD5 cf67513725dd59ea6ea3ccd915e5a256
SHA1 7b8b1ed98dfc30e640a3aef544df9a0db1dc0bf3
SHA512 af9d8464607f1a0ebc7487f80818b5531aafcd4b5ec6ac1765ed1015512dba103a1c74b687907273b67d8945cf5e7944ed4cab7d5bd60883dad936afa05723c1
SSDEEP 12288:HVg4TosSqhucX6NmEfJn+VYLlBD9rL0Xp55mDkSDj9sQCpluE/pN:dosXhn6NmrVYLlBZ/y8DkSvuQCpv
TLSH
T1A25523197B1D82D6F975D3B6C4167088E3287E15E733965FD6103D6B0BB2DCCB824AA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 43c3810ae8910cedfa640f3e649c7f045b30827ca4891000b69dfcd6bda23dcc
MD5 5d42291c966d3398d0982f0a385071f4
SHA1 9571b0a08c2b1e4215b06ec7feec033956f4780c
SHA512 5a7c58635f39076fa34fe2ee272d676a2db2bb303b84d94dd34944b85cf37a480b0aafb1787228232d2a9b1a1321b8a077d044beaafed9477f9ed81cb82d93fc
SSDEEP 12288:544TosSqhucX6NmEfJn+VYLlBD9rL0Xp55mDkSDj9sQCpluE/pN:5josXhn6NmrVYLlBZ/y8DkSvuQCpv
TLSH
T163552319BA1DC2EAFA29E7B7C40A70CC53087F06FB27951BE524396B43B2CCD68155E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 f01364783aca6471248466d6c26a4167fc739e2224102a86242124f9b3ebc2ea
MD5 4d48a89f63a8b7d3b11a2d943cfc7384
SHA1 c3c4c28e39f825b3f305bd308233d0f8afefc3a8
SHA512 ffaed38431229aaad87d02a145f24f1b409c0403c5d093f49ca4d53994fc7906d18788a828477bf3a4a1b58f7dbc835cc295d7ca84c36b57b838e3fb39e57677
SSDEEP 12288:xP4TosSqhucX6NmEfJn+VYLlBD9rL0Xp55mDkSDj9sQCpluE/pN:xOosXhn6NmrVYLlBZ/y8DkSvuQCpv
TLSH
T119552319BA1DC2EAFA29E7B7C40A70CC53087F05FB27951BE524396B83B2CCD68155E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 271659f3d14cc4a808ae100111efcced694e5d59d73e61e8431e4a7863ea4e50
MD5 6b41e324d5ec9087722a5d7dce86ce77
SHA1 ea4de398ce822c106e8020b78a0f0f760286da13
SHA512 b995e783ddec5e6b6594f9187ae7c96265775d66eb7a739f0eb65e231222b7ae4d67769435862f7cf347a1d3ea1f5a1a7c1ddad5229a5294269cf854ebff2e30
SSDEEP 12288:tT4TosSqhucX6NmEfJn+VYLlBD9rL0Xp55mDkSDj9sQCpluE/pN:taosXhn6NmrVYLlBZ/y8DkSvuQCpv
TLSH
T1CE552329BA1DC2EAFA29D7B7C40A70CC53087F15FB27951BE524396B43B2CCD68154E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 0c6dc007387367785cf8ecb0dcdc13a5f3ec4eff1400c78fdf4dc46b0a6238eb
MD5 4b5a81627878487e5a5a4766f34ed801
SHA1 dab7820fd980a77b3c172dad582121f38aabe3f3
SHA512 397757bb8142b0780da12dfaef5222119450b719b0879848530b67ea400ed54dd12f2121f958b3e0aec5c6ca7132cd04d2076444c65f820b90eb4c9237cb4793
SSDEEP 24576:VZMJzFVSOyosXhn6NmrVYLlBZ/y8DkSvuQCpv:VZMJzfUxrYpBZa8DkSyp
TLSH
T11A7501A9B35458F8EC67823EC8159846D2B27C1A4B70C61F13B4366B4F737911C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 3a8cc8a8a7f41b10983dd3bdb2e481af0d0e3139db58b857d7373dbd442238ed
MD5 db8346e8feab55c143d77fc67f48da22
SHA1 afbd8e62ffff68f8f5825287f45b9fd8695eaa15
SHA512 d46264e92533e9c5eea94bdf2f4d435fc094a5f5d1de82355896c0cbecb9c1a49cf3bd70e6bd61fdc9ef7010d2cbb651083864a6171bcab9c280f864173e89fe
SSDEEP 12288:ba4TosSqhucX6NmEfJn+VYLlBD9rL0Xp55mDkSDj9sQCpluE/pN:bhosXhn6NmrVYLlBZ/y8DkSvuQCpv
TLSH
T19055231EBA1DC2EAFA29E7B7C40A70C853087F05FB67951BE524396B43B2CCD68154E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 260c1bca47c8ee1b136d2d8d6cbe4d1e1aaaec7a972c7d28122de74f83bacd89
MD5 d14a5c5b3848b33fa6bfd90f0fa9c37a
SHA1 1baf9b65fb51200d5c4e2dcebe912ade8ea983ff
SHA512 f2442594ad5e079725c2b5b3c4cf86cdf4e1c166b19178a1916b6f1f27e465ead7df1b0a3c4485241bfea519f48418d017f610607205e5c2814515954bddc07a
SSDEEP 12288:tG4TosSqhucX6NmEfJn+VYLlBD9rL0Xp55mDkSDj9sQCpluE/pN:tFosXhn6NmrVYLlBZ/y8DkSvuQCpv
TLSH
T16655231ABA1DC2EAFA29E7B7C40A70CC53087F05FB27951BE524396B43B2CCD68155E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 058e09e833634796b9fec69d0be89eb39fcb7aa33d9a1c013abae77d85f50065
MD5 e46f0bebe7b8315c5776e9cc23fb5d4e
SHA1 c6c67dc23b0b1fabbd1d9bcc178504d918766704
SHA512 cd6c223b3175d826fe35341e2bdafa3ba44b68c52e41c559660004a1fe99d9ce1d2f61aa58d9986909395b7d266a7b43dda0daf6d49977fcc5225e54eb331ef8
SSDEEP 12288:1yPz5L8X4TosSqhucX6NmEfJn+VYLlBD9rL0Xp55mDkSDj9sQCpluE/pN:czymosXhn6NmrVYLlBZ/y8DkSvuQCpv
TLSH
T10B65120B776521F9E5369339C8522545F3357C329B218AAF53602A7B1F33AC4AD3AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 5e991f26b267f2c7e2a0880eca6cad3dfe17960a5de9747bb802249e53b0d5e5
MD5 7dc17250286d83df1e016d457f261441
SHA1 62ee85d741ed1f1ae57490f6539744b501eebd0b
SHA512 f836d625c8d4f26eac8846cb62f0858f6c890f4591179cf57539690456bf4a19e1daa55fd8b7e20e8f7543dde50265c7618d83ff711b5fb21db8cfb4b85a992d
SSDEEP 12288:Oa4TosSqhucX6NmEfJn+VYLlBD9rL0Xp55mDkSDj9sQCpluE/pN:OhosXhn6NmrVYLlBZ/y8DkSvuQCpv
TLSH
T14255231EBA1DC2EAFA29E7B7C40A70C853087F05FB67951BE524396B43B2CCD68154E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.2MB
SHA256 e6210d40764f0014001e7d87cd2a8cba12e8dce19af0f5b719b58c43bd0352d3
MD5 f919710c27049cc101f1a9c167d5bc6c
SHA1 f5735a175c3a83cee68713120f8b72b29bbf0ef8
SHA512 21fae56b07518bb86688c80f0ab8d24a19e46b95aaeacf6501d61446e90c1f8140e62c951332622cdf47152164eab1a3297e391618ff68ef349cca50b9aab9e3
SSDEEP 24576:U+wvtk9RX6wkyAICdLjJyKQamCZqmjBjK8w1D4SF2VMUUhmQ57:WMnYIVqmCZqCBjLiuMU+57
TLSH
T1A045E129EBDC44E5E1B7927C89B7460AF6B178591B31C2CF025A536D0E33ED4AD3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 6321d8687286f924d460ca786ba977489fa0e7e7cd633453744315bf8a030f9f
MD5 beb05c36b57f553057d77cb1aba3a8f1
SHA1 9f9a2cb728a59430c7fd61ce0abef7e106c8ca06
SHA512 55224ad592a04ebbfea315666c4504d76e8d9ad595ecae9c6142e208648d42a5567345b4e8f4f476e63c509e999d8f213cb444946f65516b29bda0ff8d542ddd
SSDEEP 49152:PYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK02xrYpBZa8DkSu:BySzPrpBZa8wSyp
TLSH
T1B9066C96A16841D5C1B9C1B98B0BCC1BFB7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 f6f284cce57b6177688fecd1fa32a503a005ec17e4a2600e8f97fb671c148954
MD5 4486c77f7b8617fed4391bc1f889827d
SHA1 6faad7504a72afe00679c98c2d15349b10fa3760
SHA512 3fbe9f6698f23b13ae1a071a4181f9be277f44a054815f1557c88b26b2517760060c9ebe9c2e1be1264ba3c436a56ef9858cd4faf65ac2adaf2fc6170e21f72a
SSDEEP 24576:m47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYiosXhn6NmrVYLlBZ/y8DkSvuQCpv:m47JUQjairIhCnDHUPfF/mxrYpBZa8D+
TLSH
T16A65AE1EA3EC01E5E1BA927885154A5AEA71782D1F32CACF1270437D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 b1dba04491b376ed6737642215f572bb6033cb8011cc1cf7953bc4a46a724874
MD5 d2c31a44c9695bc91e3d9606318525a2
SHA1 c8dc8c6d9e94b2e1a65209847d4ac7873b54a7c3
SHA512 21119748d27179c0d5e4064c9ee605071b731610494c0d0fdd4fb15dde5a6d41b442b173aa253508477f3d3a0eb588f3e7c24ccaadf759ea91bc583cee1355ed
SSDEEP 12288:QksfK4TosSqhucX6NmEfJn+VYLlBD9rL0Xp55mDkSDj9sQCpluE/pN:axosXhn6NmrVYLlBZ/y8DkSvuQCpv
TLSH
T1D6650119E25842E8D06EA27AC7065140B3373D2597E2D3CB92D0F93E0F769C4ADE9B53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 e02cbcadef095a9679c24b0557677e42c2c009c6ad4ffc8889d7533b4f033d48
MD5 321f833016fcabfd602653a887134d8c
SHA1 531e53b40e4ab9bb6c8b50eb9b073305bc4864d0
SHA512 b4ca1f782d4d7ff02b4d7c7fd28c0045d9071b0ea5e30a88f4ba98e9b545206525c84c04dbe05fde85619be700c4a189a55e85b9420424a8fe878ca73d83a496
SSDEEP 12288:LgCSU3fQs8Ap5qhr1xCmFuvIQ/H8a+CjIoHbY2B+:LgZUPjq7xCeuXbjIcbYq+
TLSH
T1F9351710766ACB4FC66944321E33D1CCAB707D51EE04AB0373C98B3FD576659BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 ca13d0aa4d7281bf87c215dae7009925770560aa749d5351aee49f86e654897d
MD5 69440bfea5bd91f5506cbdf2ab451197
SHA1 00ff00b48d5b12c4a3ab143a83ecf24d7bf21671
SHA512 d310379df984199c9fbecc646007bf55e623362232c152c131b92e4e167b2f70ae6e1ee18b8487c99d2cc6ac5e1d057ea1e2ae2501e05b70c5f3e70ed4d6f6ad
SSDEEP 12288:KsMY0Fjghhhbzjdtt1KyiRDvk2/niRDvkjaqGk6mtds:KsMbFEHNRj1biRDvk2/niRDvkjikji
TLSH
T15D750B40A437E78FD1BA603207275B8C6764EC07B7096F22B7C9457AD86BB11B0B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d924f90-ac88-4209-a19c-e1563f6a8080.dll

Path C:\Users\Admin\AppData\Local\Temp\3d924f90-ac88-4209-a19c-e1563f6a8080.dll
Size 469KB
SHA256 c427bcf6b065edf06662e0540e3e9a21c07095184e7bb9d05926dc3b79fc3348
MD5 fe6f58fb55d9a93502528c3c9bb13a3f
SHA1 516275dddbc9e2f056342201b03a0931d93a6239
SHA512 7f45f187d6c3156b89e2daf0c2bfdc60a59140ff94f8255fa672422abc43aa1252b0fe0fa0a3ef675f9e71c33b26424597c015db83dec7f5e20ee8769c61c619
SSDEEP 12288:KptzeTYZP443n/q6LQX5uNllmSJIbbEcgSZ5MQUszT:KptzeKP443nCuQKgSJITgybUsf
TLSH
T14AA47C20B982C032D57F01315938E76915BDB9710B3D45EBE3E88A3F6EB05C1AB35A67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6cb74b8c-510b-4404-831e-0c30028233bf.ini

Path C:\Users\Admin\AppData\Local\Temp\6cb74b8c-510b-4404-831e-0c30028233bf.ini
Size 170B
SHA256 473d48a44a348f6c547aefd2c60dd4b9de0092e1fb94a7611bdd374783ef3b2c
MD5 2af9f69df769f876f6e02da18e966020
SHA1 5d21312d9bd23a498a294844778c49641a63d5e2
SHA512 a4705e5491cf03867fd46e63293181bf761d04fe0cccb86e373dd567c68d646634f64ef95d5b910d2266468b93bf7cdf6f9acbf576c6f42a4ff6c3caa09d2274
TLSH
T16EC080578015685198519714D07C45299CF58FB357E2F5720101540D828D3F754D8471
MD5 SHA1 SHA512 TLSH

Submit Download

oahbsfev.exe

Path C:\Users\Admin\AppData\Local\Temp\oahbsfev.exe
Size 227KB
SHA256 ae41ca999c5d2262c9c53b10e31a12ad8efd1fc2a4838439c4c22eed139cf583
MD5 6373cb5249e37921d5b4d9d21a0eb0c0
SHA1 12e2966695fc02713bea033ed5d0d071a1e69588
SHA512 3e94facd640d8657050b69f3ff04f04f81a6d7eea6e5807903694abcabbc130f879b5afd564de6b5920aed1ae55e1907f3075dd621040afe58c8e2339529c03e
SSDEEP 3072:0ApIdTf8t963HQW77+18x8TlKbjDzdKQP6AENmJgvDJE6Kc:0Ap8Tf8qHJ77+1NTlKbjdhP6PK0sc
TLSH
T108346B38769300FDE266827786524911E6737C110F20AA9F0F94B32DBF37E996D3AB54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

um_uninst.log

Path C:\Users\Admin\AppData\Local\Temp\um_uninst.log
Size 488B
SHA256 3a543e31b8ddbab3e5a993e90ebf27af6a711c30d81ba8c28e55a6a13adecb64
MD5 860d02a31af89f0ab664ddc6a3a39dec
SHA1 f7bed314e6d16cbad59fd7c5c0f190f869b8412a
SHA512 7f8c04f647d20018a9164ae7bfe941d814c0bbfde804c49c888f78eff899aa47e63d0248584b1ca311e470ba52e846af13b9a0281591ecab725957ce9254674c
TLSH
T16FF0541C3DE9C8658B7300611078060DDF44F36531A26322DC23C00CFA4BBAF394A436
MD5 SHA1 SHA512 TLSH

Submit Download

240737812.tmp

Path C:\Users\Admin\AppData\Roaming\240737812.tmp
Size 20KB
SHA256 1497fae280d9f02dc034ebd46e1bf7f34b1532a8cfc23344e961fb8d557da4c4
MD5 3be88a065bf244f1af3424eb5b07300b
SHA1 986df14211e35fdde483960ae12ca78c137b04ec
SHA512 9984b9aeea6a9a928634e5d336f564fede0acce3048a5a9a3d8a4116cb68266a93eb3cdf54e762ba0a246489b28504703186f647fdc4809884f989201f13f8cf
SSDEEP 384:4ox2IoapFETpRL4biUSHRWif8U9iU6VzCnjrSC/2T5/KmRLpM9HKSxay7WD:4QpCTp14biGiVS4jrSb1KmRLmKSAyiD
TLSH
T103924C06F2E231F6D0B2C2724B3723228F35385697A2D6EFA39455253E22FC16677746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 5f92d1879bdd6c1d3938d9575f7b57f626ee64f9c5e38970940867c8a3f80d00
MD5 9f2c6b4080a586c51b0ac87164e81f53
SHA1 54ae3a4d3e459ccc8ea7fa562b01693c5777b3ca
SHA512 f7242cd680708b4e678914dd823275edfa0761940cc33963cbddbfd700d91d3b5473c9b38ba794c06811eb4b174b4dbaee241f5fc6aa20db89d1a9f46f936141
SSDEEP 12288:Qz7C4TosSqhucX6NmEfJn+VYLlBD9rL0Xp55mDkSDj9sQCpluE/pN:OZosXhn6NmrVYLlBZ/y8DkSvuQCpv
TLSH
T18C552329FB1DC69AF939A7B6C41EB058630C7F14EF11849BF51039AB42B1CCCAC355A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 5e7d736ca451635539100a282d5db4b792556254bb996ddb72ae255406888a41
MD5 fb58e14c367c8df5b9982f17337fed02
SHA1 275fe903f68213337e789cd629beb1a3f96e094e
SHA512 4362dfe35f602874f4f1e032b63f9b5460fbe902f63ef8d6ba7bc40b6c93d8ad84d438db0a00962e14f44e64da57d49b451b5da69917ffd97a9b8ae385c9b04c
SSDEEP 24576:1gb6bmBIi49WNNFpg1rSvFv7bYnosXhn6NmrVYLlBZ/y8DkSvuQCpv:1gb4mBIBhGFwxrYpBZa8DkSyp
TLSH
T13E65AE1E22EC02F5E0F9D2B8CDAA4417D6B278164732D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 2.1MB
SHA256 e0bd112b43c1dbb19990ddb5dd5a5da3a38c53463916e80df6724c02bfa0f19c
MD5 993f6e7143cfdd30ff2c481e2b3b9309
SHA1 b34c4728571e79efc148b411cf5e46dde5fc3f26
SHA512 c68d0acf963e4c1aac1b360087ea45e75ff43dce28cb88b2b35a3242154def3d3a29847cd21055d691c7232ec26810e96ac67b3d3c1b8d823afa52ac128c9886
SSDEEP 49152:1gb4mBIBhGFwxrYpBZa8DkSyp2qmCZqCBjLiuMU+57:1tspBZa8wSypjmCqC5+uMU+57
TLSH
T11BA5DF1E22EC02F5E0FAE2B8DDAA4417D6B278164731D2DF1151422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 832KB
SHA256 2baef0c80e31cbe6bef4fc223a6bffc119e46e9cb40600145a2cba9e7a00501f
MD5 513c1ac3ee86519b1a9cc76dbbed32fc
SHA1 d8d651babbad1b0e151bb479167d444d6b27ccc2
SHA512 92b73f273b82c5eb4acaf7f8089188ae28c9da3006868cba3995db3a74e9f9540fd076ddfcd089fe0026f34c332685a296e9ea79f9335ef33f043993e8eed4d3
SSDEEP 24576:tGhdLjJyKQamCZqmjBjK8w1D4SF2VMUUhmQ57:tG4qmCZqCBjLiuMU+57
TLSH
T15905231827F4F969D8B683B455B6A929B93039515B1426FF0CB9913CCF223E0F936C5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 85efcc26faedc4eac9c5783b0c70b0fb0b6505358f7014ccebdd1f883f02da07
MD5 142b210ccb7300f5630b9ffe12ec4263
SHA1 26156872ebe20ee1b92bf5b5c3f8cacaf2a6cf97
SHA512 85698438dccc19e5fb6e1d80222fb7ffef44b85ef2f18534ec7ea143df334c286dc53a8a4c30380037216dea011bfa8c2302a22ffcaf6a196fb80377845106cc
SSDEEP 24576:0G88u8FpJqH1nzria7/myosXhn6NmrVYLlBZ/y8DkSvuQCpv:H7ZFPqV6a7/1xrYpBZa8DkSyp
TLSH
T1EB85F165B7E502F1E47BD138C94646A3F671B8250320EBDF06A88B561F33AD54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c08d6ce8cf398a37a9ac6735b3aa582cbe8b8c13c294432f1160e49b3403ed38
MD5 551235740d381c37d83768b8e7a156af
SHA1 87bb6154ac970802188c6dfe9c8f6fac0b5ec898
SHA512 23531e67660a0a800d91b32d7bc62d08712c3fdc99c2c528e02738dc1d204f1d81b4eaaca1c68ff2de0c639bd228da90e941e09f89889fac08ca5cbda10ae293
SSDEEP 49152:OBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjkxrYpBZa8DkSyp:RG05lO43bSpBZa8wSyp
TLSH
T1A0D5CF6E62EC11F9D1BBD17CC986460BEBB23815033556CF02A486A91F27FF4A97E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6c9bac17eb32297ac4c95405aaaea3d9cd54c227c1b91f2816b1053e87ab111e
MD5 4f69053eb7c974af8572a2b72ead7fcf
SHA1 a5e909cadb47e892206fcf8b74d4548d74140a6b
SHA512 551cf1691d568e9e815b0beed93d254caa6b93d041af7eb00354e60bf9b313a154fdd2236e4cd05e6d990d179b27bc581d2924387fd9334a6312e7dfb88f276c
SSDEEP 24576:Ifa5POZ3dpuWVM50JicR2hG0lasx2+47eidnkosXhn6NmrVYLlBZ/y8DkSvuQCpv:wa5POZ3hJt2pasx2+m8xrYpBZa8DkSyp
TLSH
T18965AF5EA6FC01D5E579D17DC583461AE5B1342253329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ed02f5e8271dc6b1831f9ebee0fbad6c3168d5dc24c9e41a67f5066c7408ae93
MD5 50e42e676cdf77f8c29a6f5c9eca530a
SHA1 56beaacf3f28e97cda4a2d0189459272d741ad1c
SHA512 762f4eaac3cdf5510ae826ef63235697ece5e671584bb2c2ab7e9c16da84c916bb73e736f045bbc7edb8ad060fd91660a32fe796b69669389a6fb76b1de09be8
SSDEEP 24576:RNcwHdjbyQ4nLC18lb/EOjowL7FkqosXhn6NmrVYLlBZ/y8DkSvuQCpv:RNc/zEOVHFVxrYpBZa8DkSyp
TLSH
T1F8858B2623E901E4F1BBE1BE89779546FA71786553308ACF0291851F1E73BE45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\System32\Sgrm\SgrmBroker.exe
Size 2.4MB
SHA256 5cb4152f0c7bc5f637c194e06a215f57370b99537ec2136685d77054cfea9a68
MD5 29ae750ba3643e01a01d0ee65ffbfe6c
SHA1 7d3c2660edd426c8014c05e5912ed293c90e7d93
SHA512 51c6eec8ed58e729986d0e2cfabeb487fdbe7367b756c7a99eaa7b14d1a9b74bed31ee6c7530a43a3b0ed2508621ea6059d965aaa4145dbcd1cc29825c4db3a8
SSDEEP 49152:6DVHeBIAAHxrYpBZa8DkSypYqmCZqCBjLiuMU+57:rpBZa8wSypNmCqC5+uMU+57
TLSH
T155B5023DEB5C04E4E47BC2BCC6639906E77138A9032266DB05A491BA5F67EE47C39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 948KB
SHA256 112ee97fa29b8c626095a3c9bc035eff6d8c84be3ad50599c9c8a9f9f6078900
MD5 4bb6e287d32cbba17b791ceea0ef9002
SHA1 f1f55123121c6b708590609fc4d58372c944e783
SHA512 0a302ea5750ea0d35a21d973acee0a758dac5607aa8806951e55869e9c73efc5917c6bd9e9904f148c6a9e5e61980d6939a318b3e4f7883476456cf9db283e11
SSDEEP 24576:36DIjdLjJyKQamCZqmjBjK8w1D4SF2VMUUhmQ57:36DIqqmCZqCBjLiuMU+57
TLSH
T11825121C237A91BAD0A7D17DC6A30515D6B2B4B187111ADF0AA8C17D8FA3FD8F839E44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 932KB
SHA256 0f6b5a7a7e3cba0611da29fa22a3bd17254d5a6cb6407be7c8202bc2dc2b9bf0
MD5 5b4751de8ecd9d39373bbce6a638a818
SHA1 0b13db2f47d99e54863355e73732b63d3dbd67ad
SHA512 5f4364594c14acac9007541f5f45f1e61ca306f0d1424ee12e888cd154e4a8774f8c07a23dc85807a32c4fa7471061d6b80bb91c71e7bc3c52e7d12715c12726
SSDEEP 24576:4tyGdLjJyKQamCZqmjBjK8w1D4SF2VMUUhmQ57:4tGqmCZqCBjLiuMU+57
TLSH
T18115220063A4E5A9E9A643B496B796649F347C219B1017EF08B5E23E9F327D4FC31B1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 804KB
SHA256 ce7ce8809a4a3769beca9c610a7c4b3834ace68fe5a931043ab4bdc2726c5a30
MD5 fc44f56d903d6425c9ab3e308fee6077
SHA1 2c7f62d26b981c304bff103e94aa8b8c54b58365
SHA512 5089fb756c895c135194663f6b429940777939fd2a091d7b016094da13b05996ce76d7857dd33aff8d1282c6fa95381b557c2e74be0e76a6f7d68c317da0eaf3
SSDEEP 24576:4RdLjJyKQamCZqmjBjK8w1D4SF2VMUUhmQ57:4IqmCZqCBjLiuMU+57
TLSH
T1C90523485764EA2AE88243F452BB6E189A3429665F5426FF5C79923CCF223D4FC32C5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.4MB
SHA256 ce579197acc760c51f7631310bf384bb546f0a16c86c46685e72c16114ff1457
MD5 d7a735c5caa466866a6259b568b0bee5
SHA1 e7a0f05f7e735aceb91d00fe110ed2c6562ddd27
SHA512 559b483ee7f0a720c5da948e20c7880562fde878d969ef14a5fea8344367aa33329c40076ad703f6dfc57721a84d72f28232e6371a8bdb1ffd1f7b63701c2e1f
SSDEEP 24576:A5gZLoTfaidZKdLjJyKQamCZqmjBjK8w1D4SF2VMUUhmQ57:YgOTrZ9qmCZqCBjLiuMU+57
TLSH
T14865AD1D63EA09CAE2B2D275D9721493D633B4315772C6DF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.1MB
SHA256 73d16efa947a50aff30a3b51bde0dbc4553c1b22bb02deca78a4ff7e967506c1
MD5 96a4e20645d543c8963c6ed7e9ca00ea
SHA1 14c36be771253aca53f8c2fa2e37d904d1940523
SHA512 e2e416a809b91ce93ebd04de0f7b4133ae35be51168962cde949e5f413af15fc34274e6abd03047e3d6524d0637823091da222254ad427c82f0b499ff12cb93d
SSDEEP 49152:7gb4mBIBhGFwxrYpBZa8DkSyp2qmCZqCBjLiuMU+57:7tspBZa8wSypjmCqC5+uMU+57
TLSH
T1CEA5DF1E22EC02F5E0FAE2B8CDAA4417D6B278165731D2DF1151422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 0d0f8d3abea6ea17af9dfd2e46d00ff13b107a3a8f91d773b4f5d1b0dc2bd046
MD5 6c1dbbb3f975eeadf21612ca3a02b1a4
SHA1 bbdf6abaf41481cde757f91678bb4d7f3cb50c38
SHA512 4908520c424f72c3273a6e7e8cdb2df514845a745079f19267b6214410e5a40266d1a14e6101929207970b8286944b9cdae35a29ad7b3e345ec3820011a0c4d3
SSDEEP 24576:ATkNvNnaFeYhJNtmZBm3dLjJyKQamCZqmjBjK8w1D4SF2VMUUhmQ57:ATMwBtOmmqmCZqCBjLiuMU+57
TLSH
T1B175B02EBBB846E4D1FEC6B4CD238516EA727461073253CB5290C13E4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 542a7f50276e4bdda25119a6e0bc50a3c08ea4594b7b61fd1c58d8b5a0c3bb7a
MD5 38c829cbf56626f526b9051c222a9d6b
SHA1 7e8a3f714fd10953f0e6fef62ff610e277eab425
SHA512 c51d7b08789973aaa378b142f0f18db2a3a7917f7a309d23315c61b8c3addbb177c15744b20517f17310bf67fecd33c6a5b14f279c71617f36534ab47e7252fd
SSDEEP 24576:1PUr+NQ+osXhn6NmrVYLlBZ/y8DkSvuQCpv:1JQUxrYpBZa8DkSyp
TLSH
T16565E12F66AC18E5F67AE17DC9469209E731B8625712D2CF02A0517E4B73DD8BC3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 2.4MB
SHA256 73bccfbf331342a9fbe950d11b3ea6e5b2f1996848e415ede8cfab57d9a5a56a
MD5 66664eacdd9da91fee11f87112607e6c
SHA1 911cfbfec3f1b49f7a4a60d1ec014105d8ba7616
SHA512 681d3252a1069e94d3b29e562d45ebf3537d575e6b1460bb4e33a7d7d341799b16a61d2650d5a0bb14ce73fcd3ce82f3eec24e5247e553c9887ce6017f073d91
SSDEEP 49152:NDVHeBIAAHxrYpBZa8DkSypYqmCZqCBjLiuMU+57:mpBZa8wSypNmCqC5+uMU+57
TLSH
T160B5023DEB5C04E4E47BC2BCC6639906E77138A9032266DB05A491BA5F67EE47C39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\system32\TieringEngineService.exe
Size 1.1MB
SHA256 2795a9c044c99d0408a94093dd78d741af2f78a618480305f47b35f22fc27f37
MD5 2625cca2d5ae61af7b67623504d3c3d5
SHA1 8a1fe06e328967705fcf28d50cf460bc9a8c5f04
SHA512 a36285daf4fe7287a833617c69cc6a982afb15eea3bf71466cae6aedeb1280df38139e1943642ffc25ee0c8801ab03344200ce330406f82b9b0cdb9f7a03c789
SSDEEP 24576:0JnJPbzB4SedLjJyKQamCZqmjBjK8w1D4SF2VMUUhmQ57:0JnJv6SZqmCZqCBjLiuMU+57
TLSH
T13935E02DD2A810E9E4B7C2B4815A1A59FF31386D2F2569CB19B4D5343F12FE0B939F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 796KB
SHA256 1bb96d02b08ce78bfdbc7a6a4c87a96f27ce1b068ad7426963564c23299a1a90
MD5 93b31d78ab5c99b19884a74904f3a632
SHA1 c052e6cf16ebc911366f059cffbe42205882e6c1
SHA512 b13489f0f52fbc1a73221f8724cc8071bce493e65aaef9290b2bd059b4f2a3bd2c10deb39b9eb1c1f75a01ed62248080bac7499e3d3a7f3218ac545b220450ac
SSDEEP 24576:KTdLjJyKQamCZqmjBjK8w1D4SF2VMUUhmQ57:K6qmCZqCBjLiuMU+57
TLSH
T1670523005764EE2AE9C243F052BBAE1C9A341D569F5416EB4C3E622DCF623E4FC3656C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 940KB
SHA256 b58b198b6f28033a5712e2f771b6211abba87f1d21df0922d82ea36a89179a3c
MD5 004edba517a789a8455e44bc8e0407db
SHA1 72f69656155ac24851ea041b6406b1c78d1453c5
SHA512 7ffad8c3a3cd74c1e645fef50d857dcb3f7cfdc603de601d09a497062b83d964464adbec26832ab32fdfb0613aa43ca2d9d5db9aef747d32a6fad65fd11b3c40
SSDEEP 24576:J6UqjpQdLjJyKQamCZqmjBjK8w1D4SF2VMUUhmQ57:J6UKqmCZqCBjLiuMU+57
TLSH
T14F25230D57D4E9B9E46643B0D576812986307C721B6415FF29A8923ECF32BD4F83BE28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2396-160-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2396-161-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2396-171-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2396-169-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2396-167-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2940-236-0x0000000002F30000-0x0000000002FB5000-memory.dmp

Download

memory/2940-366-0x0000000003A80000-0x0000000003AE6000-memory.dmp

Download

memory/2940-387-0x0000000000400000-0x000000000105D000-memory.dmp

Download

memory/2940-371-0x0000000003A80000-0x0000000003AE6000-memory.dmp

Download

memory/2940-238-0x0000000000400000-0x000000000105D000-memory.dmp

Download

memory/2940-231-0x0000000002F30000-0x0000000002FB5000-memory.dmp

Download

memory/3028-457-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3028-133-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3028-140-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3028-134-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3028-455-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3216-184-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3216-176-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3216-182-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3216-473-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3512-267-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3512-69-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3512-68-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3512-75-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3800-8-0x0000000001770000-0x0000000001830000-memory.dmp

Download

memory/3800-6-0x0000000000400000-0x000000000105D000-memory.dmp

Download

memory/3800-440-0x0000000000400000-0x000000000105D000-memory.dmp

Download

memory/3800-0-0x0000000003180000-0x0000000003205000-memory.dmp

Download

memory/3800-14-0x0000000003C50000-0x0000000003CB6000-memory.dmp

Download

memory/3800-19-0x0000000003C50000-0x0000000003CB6000-memory.dmp

Download

memory/3800-7-0x0000000003180000-0x0000000003205000-memory.dmp

Download

memory/3800-58-0x0000000000400000-0x000000000105D000-memory.dmp

Download

memory/4164-146-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4164-35-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4164-34-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4164-27-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4164-28-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4308-40-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4308-47-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4308-159-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4308-46-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4308-48-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4548-52-0x0000000001630000-0x0000000001690000-memory.dmp

Download

memory/4548-59-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4548-63-0x0000000001630000-0x0000000001690000-memory.dmp

Download

memory/4548-66-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4548-60-0x0000000001630000-0x0000000001690000-memory.dmp

Download

memory/4580-147-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4580-472-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4580-148-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4580-154-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4748-90-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4748-319-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4748-96-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4748-88-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4956-101-0x0000000000A40000-0x0000000000AA6000-memory.dmp

Download

memory/4956-375-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4956-100-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4956-106-0x0000000000A40000-0x0000000000AA6000-memory.dmp

Download

memory/5384-111-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5384-117-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5384-484-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5384-486-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5384-454-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5384-110-0x0000000140000000-0x00000001402C9000-memory.dmp

Download