ddc4513b2a8745270c21f54eba2043ba2e774168aa6a5f2837fe8bf37b434713

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/07/2026, 10:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
Size 1.6MB
Sample260704-msn8daev3x
SHA256 ddc4513b2a8745270c21f54eba2043ba2e774168aa6a5f2837fe8bf37b434713
MD5 1e1ad50b39d92b531cedd84affc82bb0
SHA1 5bcdc15e6a490f5af698e89d30ec3d667d521d19
SHA512 2aa20df5a0c740c7d39483675794d37a4fd1c2c63668273b93e1f26a789784dde8b837eb6aa06ac0b0275c87417707483072db49ba1ed1f12b822c04e1e2e43c
SSDEEP 24576:P6DQSagCFts/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:S8S9CFtsLNiXicJFFRGNzj3
TLSH
T17F75E043B6C08031EDF615360DB49BB95A3E7D214BE759CF93942ABE5A30EC18A34727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2716	elevation_service.exe
3384	elevation_service.exe
1744	maintenanceservice.exe
1324	OSE.EXE
5236	PerceptionSimulationService.exe
5136	perfhost.exe
3816	ReFsDedupSvc.exe
4324	SensorDataService.exe
2372	ssh-agent.exe
3484	AgentService.exe
2836	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f7fd68843a2495a.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104109\java.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e57d9d0da20bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001b415c0ca20bdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009450f70ca20bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005610110da20bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3096	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
3096	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
3096	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
3096	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
3096	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
3096	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
3096	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
3096	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
3096	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
3096	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
3096	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
3096	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
3096	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
3096	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
3096	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
3096	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
3096	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
3096	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
3096	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
3096	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
3096	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
3096	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
3096	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
3096	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
3096	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
3096	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
3096	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
3096	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
2716	elevation_service.exe
2716	elevation_service.exe
2716	elevation_service.exe
2716	elevation_service.exe
2716	elevation_service.exe
2716	elevation_service.exe
2716	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3096	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeBackupPrivilege	3816	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3816	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3816	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3816	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3816	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3816	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3816	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3816	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3816	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3816	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3484	AgentService.exe
Token: 33	2836	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2836	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2836	SearchIndexer.exe
Token: SeDebugPrivilege	3096	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	3096	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	3096	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	3096	2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	2716	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 1260	2836	SearchIndexer.exe	99
PID 2836 wrote to memory of 5508	2836	SearchIndexer.exe	100
PID 2836 wrote to memory of 1248	2836	SearchIndexer.exe	101
PID 2836 wrote to memory of 4868	2836	SearchIndexer.exe	102
PID 2836 wrote to memory of 3800	2836	SearchIndexer.exe	104
PID 2836 wrote to memory of 3500	2836	SearchIndexer.exe	105
PID 2836 wrote to memory of 5836	2836	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-04_1e1ad50b39d92b531cedd84affc82bb0_amadey_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3096

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2716

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3384

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1744

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1324

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5236

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5136

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3816

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4324

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2372

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3484

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1260
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2639994890-966400312-4246138405-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2639994890-966400312-4246138405-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5508
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1248
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4868
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3800
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3500
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 63d49f1c15460577c04ea1e5df6bbf0530634cb3aa66b64b5a82c6760b1fe28e
MD5 8170afd12d10bcd7cb08c5d6ca354cc3
SHA1 b253f68f2c8cbeb931b15288a2ff70fdca17e52b
SHA512 1f6046aee06e0c7e593b05b08c63c00acde95d185bd473bec16cc1c5a2d97d62ab1257927f66f550055c412a4f00d7cdcba1c0322b832c600e5c16c147402cc2
SSDEEP 49152:ab+632BuPkFKRrdE6ohdstBhuXjfS4LWxn9LNiXicJFFRGNzj3:M3q6mjB67wRGpj3
TLSH
T113D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 e0980f6573a627149c9e21e2e21c8c24450cccc6fc0377b1786020e08783602f
MD5 020d6b54a115728b5cbd7ef448bc0f82
SHA1 6f78d396a432840e06cdb7cca740bd4611108a03
SHA512 34661209b3f9d4f4b22ddc56b3efbf11553b88987f6eb098ba3cc85a361182a348c439c1d4a063ded7a7c1c72eeb8007050cf640d2f786df13a95c505f625c87
SSDEEP 24576:sXYfDtczAu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LtcTLNiXicJFFRGNzj3
TLSH
T1E675012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 50046cea177f921c375f2841d0d92c1c931023e596b3713c83c81ba54a5b0da2
MD5 dd581f57deb2e2ed36f3583435563b49
SHA1 0cb081086a2d3bf8d3fdf4f2ea631c8f5d492052
SHA512 cefafaaf7e07abaa822a8b1d6cf04b046bc8d9de71b33dec7ec783e0af579f9af25b99b4fadddd53f4066f69d14692ac1584bb79478d9e8618a9f2f263d4a302
SSDEEP 24576:p0Le5ji0hmxhrMl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pPji0AzYLNiXicJFFRGNzj3
TLSH
T1E5859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9721a80bb638d724e899e63eb85e5446a65eec277145ead276aa043fb87bb7e8
MD5 29d004c2d5df044c90d57717481e8947
SHA1 7afc99f2657412608d8783f04dfacd4f23c9815a
SHA512 68c4cae815770852a193bf94786cf0a8b93a3cdc2ac56aa64d62034813dcbc4fb39413825b0076cc223534c682ba7a2407402ca3a20919c62c243b025da94161
SSDEEP 24576:Oa7/ezSC6vUyD/aqgrvWj6q8wyuj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:J/ezSC6vUzPv+HjysLNiXicJFFRGNzj3
TLSH
T176756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 727e78adf5c0273c4d11e5157dd86621017b77ad6de16de55d2584c1fd294297
MD5 238b97e015e0d157a9d8ab2857a2bb6f
SHA1 0208fed486f989111afd6a2f42e2325935abab4a
SHA512 0da4e03c738ac20fb491b71935c6afa60d5e5d3c6daba1ee6f0a977e1b3f5739969e080a81c61fbab1104778430bd7b45a831aa613c199b0883351e8a87401d1
SSDEEP 24576:jVbqPb88hv/l+BK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jVO88hXl+4LNiXicJFFRGNzj3
TLSH
T16B559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 ef2aedc793d11df3ffdd6390a0033fe156ee13d8791f7d1f76c981a199a7fce4
MD5 170c19f967f91bcf02e7c59185f573d3
SHA1 447e724c545f0d98570896d469fb37bf6bd9e8de
SHA512 fe56d8e2ac9347f183b8c622fff11a08987ee1ac7ad1b664a6f56f6bf30846d29497219709f9f539178ccada516a132d6b3cdce365c4880bf9ea721c0d7c259e
SSDEEP 24576:GGh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XLNiXicJFFRGNzj3
TLSH
T1995523D3468854B1FBFD003A867A5828B5845E2CCA595DE2D2543E5EA13CFEBCF38123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 e0c27b1060c7f67eac0768a91584475dcf7024740918d7ca017d74cd5551a16f
MD5 a1a24853ea7292243445380300cf38b5
SHA1 f88628f5d70d7eee2d53aa9397ced124c0956533
SHA512 0f983bf8134d54587f0b3cb00f6ad92b4843df4cf58bfde6fb6c776787d5b2d36a74b78dd2181584639566f3355dcc0c9870d5d2fb9410f1cffb2d6e905be82f
SSDEEP 24576:3JIUS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3JIUSLNiXicJFFRGNzj3
TLSH
T14A75CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 9555fd4eabd9e7e34bc3d9d6b52109c5b30339cbb75758ce56865169ba49d489
MD5 f61ac09d504752faf6d37b89dc0499ba
SHA1 04fd18ba56e9675af4264d0725d146e7c9c0abc5
SHA512 6765f1a8bcfce848ae6fe9f3f8ce6d3a695b8b4c8aa4ce8ff455657fc02fdd7d8eebd25c196f17cb2180376bafb5886832c9b52c80901365a2acba84a6b04312
SSDEEP 49152:9QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH8:9QvGAdlCEL8c/WRNw5Cz7wRGpj3
TLSH
T1EC266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 b845fd2c6be84773db1e82b2ca98d5fd77b5a79561614b0c007f120840c8b7b9
MD5 d3f2f72526d7af720d40c46dad988a19
SHA1 1cab790b55d3a7c2b837723745a946924e9c8b75
SHA512 500d81b074676bd106b42d075fd934791bde6fcb714b12c8a44b31f9332127798baf5e845bfb8a2f994d75def9ca8902b76fe55be6842527bf3d59612b754d1d
SSDEEP 24576:ifewsAjo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YljoLNiXicJFFRGNzj3
TLSH
T13D75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1fee177aac62c0ec0b91704206f0ae3d3264a1b394a70b8b3045e4ae35de3b51
MD5 4adb03792d453c1f6950d46784a81cda
SHA1 2ab3e53611a091f1b7e9ab59a3d72b924f5312a4
SHA512 ab4f40390040e979ad6d0585282fa1519f1b6c15c5c5f3dbe569ad75f160745dd20f9453b9301be08c537714639f1f566ecac0d1f05c44546edd7706ae982b2d
SSDEEP 196608:ZUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH8F9:ZUEtQevvqc2W1cpV20I32A9
TLSH
T1F6474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c473a0aeeb86422fd1e48329fc0fe3226d0835b8e5e6d25fa8f6f0ec01aefd5d
MD5 e50f64f01695441e07f9c09511aed45e
SHA1 9bd9daa9bc7ed2f385b351381dd3504ef6696d0a
SHA512 c7f9df369f0e006cda68cbfb30b57378633d43372f2ab8339b0f58413897eb5eabc7d94565c64eed03a3ba4f8a6c571a1bf997dd87c984491f3adeaf9aab3c05
SSDEEP 49152:64CbRquA/m2yL5zLfFiV+XenmE3/zILNiXicJFFRGNzj3:6xoq2Vjnmn7wRGpj3
TLSH
T185D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 42522f64e9e0ae37ce129750312f157976c860e1d9d320536ac06df4ab13c6f6
MD5 ff36a82508ed765bd151dd8124a6b01c
SHA1 26ba0ebb180ce3f068a0027f4e08402535c2e9f9
SHA512 8eb198d291252899e076878eb911f58d9a76b55039cb2e4086514c7b078f13c94ca4f90ed3f6c55a7b168d154a0ae083e6bf10ad803c509ba0096c7468062cfc
SSDEEP 24576:yAhGL6IFoiwtA5l7S53H/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:yAM5Foiq53LNiXicJFFRGNzj3
TLSH
T1A9359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 3e06b4da6f1167a800323eef448c4382af61201483622d8f834237b2ce1b255e
MD5 8b1f25ff7f0acd7d81b445f09371841d
SHA1 462c97d1e8babed1839af2eebf517f6cfbee2597
SHA512 ad583d134923709a8f225c83a79fbb6e6ff8fdd683fbe174d8f734c66777f19c0181bba7589d10a3bc5421986a71ba0b4725de4fc4d71cfd16898e78860b02b5
SSDEEP 24576:dwuROWM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dwSOLLNiXicJFFRGNzj3
TLSH
T12F65F18632940CF9E9BA41398657C036F7F2BC152A25DB1F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 dc3f9c678aaf272dd5ad71a204e53753a633f4a6a72f0fc666eb09d4c35cde33
MD5 af0b39e7b0ad4d97c0647855d3587909
SHA1 66b76f487259db8d9360c3229a18429d312a8187
SHA512 75dfe7dd3747de15afecc3d0112f3149f5c7bc5857e22c656ca2bf1a4f6461a3f10474ed7c19aee785a8ef23c50e1fde83cf409beb46e991d9dce19f7098e5f2
SSDEEP 24576:nZuN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oLNiXicJFFRGNzj3
TLSH
T1B655129622C820F5E2BB413DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0df508efb397e845399c65a0255ad929721179b62ab6f5e70ae8a5256b0b86c3
MD5 fb39af7afb8c0cbe3de5a58e2ec0e3cb
SHA1 4d45f7f16f7aae1fa911c8d17c316963b02d7eda
SHA512 1fd651139906288335d6d15dc27c702adba06478a184be03f1b92acc291c9044f6860236928e7199db35449bc489e79dbe038ad4c96c8b3e654e59bdea7db9a7
SSDEEP 98304:fQRQyi36YOcPDLvw2gAf+PN327wRGpj3:uQyiKanX+PNKF9
TLSH
T195667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 bd1c70d01da00b8307313fc1a5a9186e17e0b040307753e946672ca26c700612
MD5 0198b456670b6745a91f9ce62aa42822
SHA1 60c36499feffba31fe71a1ab2410a14ac4dd9e59
SHA512 82f087fa77d1b899750c8110232c170f5aa57e2251020eddc93c8d95fb86ba09fff7a471b004db6b8e0fb6ec6936a64618a3aa448e12ab1ec223b36c9caf203b
SSDEEP 98304:IQRQyi36YOcPDLvw2gAf+PN327wRGpj3:fQyiKanX+PNKF9
TLSH
T186667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 47c88cc4228032782319ade86541e4be5919f0dafb069da7b8c69c33e59e4541
MD5 725cacc8f3fb234205d87839ff3685f1
SHA1 f29f0a72aee8745a0ae5ab870fe5ef9bcdee614a
SHA512 4d63458084a436c946be2b97f4d17f7bada4c8d1407f4fa024fcc6cee55d651c808824272b5ea834ee6df4e334f34c52073d2ab27ddced1b1defaf3030b3d37c
SSDEEP 49152:l68Qg55nhkeWu7PNU3/YLNiXicJFFRGNzj3:zthTRc/Y7wRGpj3
TLSH
T191B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 bdb2183e8762573bf5614d98b22e5704eb225bd6a8bcfb91f6de48e72c3964a4
MD5 d264ceb142182456520fd4207630964b
SHA1 3fb8ec1b9d08a34af9e274d7d22f671d3853e808
SHA512 d0d7fce88ab6abd72f2ac59db24d90720b1900c6e6dedb370f5157a0b7b25646c405538dec6a8936bf8e4aaa3e8a6266a809f60d8c66d09f864fec1c1405fc78
SSDEEP 98304:yy5112gYy5azzVvU69nLKnhZh7wRGpj3:7LIHRWhDF9
TLSH
T14F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a20c2ece435a1c59f2e533dd5cae154e7084bbcd9d2f2da2860ce236351beb5b
MD5 088438c48af039aef23455ef4a9d8855
SHA1 999c6c50b6eddb45600e42e2172fa01f908286e7
SHA512 cd1c39a5ccb24d29841bb99c184fdb97460967f9ffe5785dda5ca58017ecde3326cb713358bed829c7294500108fe7b18eaa652cc425d397c813d8c182ab6cb9
SSDEEP 49152:tB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gleLNiXicJFFRGNzj3:zu6JmIxd2de7wRGpj3
TLSH
T1B3D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f8ce0b751f2cb7b87a832b212de6818c59b252e0ca286457713f1642c6e6b9b4
MD5 78541541f4e58006a05f9f5a3ed56522
SHA1 f20f503f7a2eff26fbed7b5760050b329557736f
SHA512 448e9f55e32d9fe5141f9b24eaf7c866bf9a5dfdf7146ce81a2fe3798e6b3326b615369fca0d5aa1399dcffe67a27d5d9d0daf05af8632a54c7b3c49428d4824
SSDEEP 49152:v1hpsNoJpF1A67U44CwH7R4xyLNiXicJFFRGNzj3:vmifPqRn7wRGpj3
TLSH
T1EFB5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 51b7a0da2ca17c50d15ee0e8aa7b5ab0b84a7a860f3670301afcc073244b1fce
MD5 d8f2bc31c15535170a9c4a5e903c1d8b
SHA1 e4eea42a83cfb144fdef39ff1a3a493b9623e03a
SHA512 6f94c97a288442dccf865b3803862e57f12ad5c588c6c0e93ef95d9b4d514f183ae2ec7e9c5dcbd32e47edaa6d91aedd47193a09a2082cd21da8c459cc488630
SSDEEP 49152:TSuZQIY0Be2KkRVtOnks6NMHqNLNiXicJFFRGNzj3:R5dKqi61N7wRGpj3
TLSH
T17FC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0c73f69acb6e505c9699affd5b0eb16988bb1537cbed3fa9b485e4a641d4f6b0
MD5 84b32ac9e5a9e802059daf1880d906cb
SHA1 dfd8a0d9882fecfcba033f243db39e910ed6f379
SHA512 07a001be7b1d348bffa3e9ef8e063768994e55305416e720be8776d403e8efccf04677e0250788dbe0582bc622220aeca671d4f0a9599ffb5d5d3e56dbea4ce8
SSDEEP 49152:ohtSn8EApI0figjgiDn0AP5wuLNiXicJFFRGNzj3:5X2iWphr7wRGpj3
TLSH
T1B395BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 4e82eb9368443d4574d565cfc8d848f853b46d7d737e6710150d3372d1c2a2f8
MD5 caeb21f0e1da653591a17feaa0fb7f66
SHA1 4da05e901ed3e5b20dd94467f77ff8082cf05ae3
SHA512 afcf6f724a0a11fe7bc1e98fedebb16fec00d74508e426b8089cf87227b5f8a6a549294717f3e35a1ec5fbb1f17863277016bd76f574a37ba8ec7d7157d9a20e
SSDEEP 12288:JFiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:JJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1905523D3558955B1FAFC003AC6754428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 2c5693fea14db935c8b0c9d4ad4880b9a284284900649cde4905bee30e90b853
MD5 bd256245fefbf2583e578a969b69e627
SHA1 ac83d22d7d7db6d4759bfa6e8d95be40e70da8ec
SHA512 46ac1e5954dcccff71cbd9c70165d2de722091e91eb6e10224175fde8d1f8c4e32045c44929fc131482122107806d052555832fed551495c61a8a772cb3b375c
SSDEEP 12288:viiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:vk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18B5523D3548955B1E6BC003AC6754428F5885E2DEB5618E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 7189e1a31534cd997ba9455e237c4f327d3da4b098368246a269054fbabd5138
MD5 fe96b2f7675ba11302476163f479bbbd
SHA1 3cf19bbdca7ad048de61f9e16bc7e4cf385f4508
SHA512 1e9b3c24b984eb77cc6468b0a4d83aad41ac4128a9b8f59f4d489a2b68d151f7366a7e4718ab5b3df33925605a403aaefaa313ef2e804e79193133212634b030
SSDEEP 12288:+IiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11B5523D2558955B1E6FC003AC6764428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 c13d5c1e251ded15090717106830097a8847d307f3eabdf40fda327f3f1bc363
MD5 6cd799fb708d020d329e3d50b194d57a
SHA1 88dfa56cf703f5a929fe627568353fee8c2577f9
SHA512 94ba85f37a64a5eb11f11fe0a75d8e928d33c5c69caecd5ca51df23035bfb7703bc304655343a3364881f4a2618ac92ba4e323961da67780488904c7ec1610cd
SSDEEP 12288:LVTiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F2552392168900F1EAFD8039C6764424F2A47D6CD7325AEBD3003D0E5675FEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 409928a6bd79b4694945c8e4b864f738f6d8f3fd485004af0ad5edf33a5e3c57
MD5 e9dcc6274e8ac14ae15d7713299f13b4
SHA1 dff7fef1f23cd193f9eceb0bcdb5c029af5cae3f
SHA512 aeea78ce18e98f26e5e607027c1a778fea1f2ff828048265be42e4d61ad0c68ec51d64985e528e2d302589c68aa45ee75764259ccc30e9baa4a70ee7b901b2d2
SSDEEP 12288:JriJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:J//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DB5523D2548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 5c47ebb4b24fc13fa36a4e02ee169c218247d12273b3ee95e71b1b38dce5a20e
MD5 0f403840ef8fe7f7eada0452a5705b35
SHA1 51c8539574141511a87530aa63713aa8ba0e5646
SHA512 4d1fe9108d7f5d7cb2f1a8dd327e6750be5d3e5d07a82dcca8c2a7e7ddfa0260a6d307db0b81d1ec12bf71ecfb2b810e2910edb22b3d1dfd7740bd54e85da1e4
SSDEEP 12288:LGiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Lw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14C5523D2558955B2E7BC003AC6754428F5881E2DEB5619E3E2083D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 60976d85a6bd02e3177cd5228dcb4ebd97cf601a007f1fdfa72e0351673e80fd
MD5 414796a0f101dab73c7111212d5a71ca
SHA1 18e26b2317c3f84489267e2b8dcad4e8703b0d55
SHA512 e988ce0d91921b53de64fbf61b49e91a31409fb5dabcb39a5899c9a4b19231d3b772e287e72cbe22bb656739f7e6c1fe7079a3daf888fd0e19e9970aaad827f1
SSDEEP 12288:5aiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:58/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D35523D2548955B1EBBC003AC6754428F5881E2DEB5659E3E3083D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 bee67dd01cae63ca2bc1ceb04f0ef47cc93f9863689231e44ec85b765cf0fbcf
MD5 027b1ed3a3ffb8105ffaec075da55e6f
SHA1 d32be590f1fe3e6497d7c1225e8e7278c9dda9d5
SHA512 96ff73be273c716236e4a747c583a96ab7b2b45745bc63cd41e2d3996ce43216cbc721034f10ae691ba7a2cc8eae950318cc02f2eb2c5052d73d43133e978ea9
SSDEEP 24576:SZM3zFVSOE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:SZM3zfALNiXicJFFRGNzj3
TLSH
T1C9750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 23d347bcef04ef2c06ed507e3f8b0b0a92e8742b4bd73f3969ec32702dcbd59a
MD5 4f6ad46040e93fcebc5c38392a7ea4ce
SHA1 9bf62527a10cf410ef272e75b7a0f8e55ba29e73
SHA512 70220675e25a295a07c9c8de1d4f276f15a8bfd8a5f3116e552a7ccc9522fbf60fff45813a360c7fda35b736cf08500e5cd9a04cea2dafa3830c723a6f491697
SSDEEP 12288:gRiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:gd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1235523D3548955B1FAFC0039C6754428F5881E2DEB5619E3E2083D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 f6997841b6ec7ebdab2d53e83e62e5c21e77070424262db9c4166fd614272db8
MD5 8260749fbca0dfab1bd630600559095f
SHA1 4f2cd90608df0b72809a711ba8d16ed53976f315
SHA512 1cd06ddce88809a085ff16b9d321ff8b3e0a72c4d4a42104d7cabace16c3f2d02926a3d2e56666bcc6ec9dfbad5b5410ae54672e4425b7e6f7299cb9bf67c976
SSDEEP 12288:1tiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:1x/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CA5523D3548955B1EABC0039C6794428F5885E2DEB5659E3E2083D1EA238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 e2fda83ba8223f3af4e67c311976a19c2ffacb49c42523a24a307bfe5a59d4ae
MD5 77e0615c16e1e7b2009482469f68087f
SHA1 5e35b81b257bf23fbefa6e787d4186bca41a18f3
SHA512 2876b8b3bc7a8ff2a370d88f0f0e3c156071e6ad54a65e797ce59c761e0a65294430f6236d30f38c22d0b1271bb4e0de88396a9b6325d6f6c5771c8d86f08359
SSDEEP 24576:Szy4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:SrLNiXicJFFRGNzj3
TLSH
T15E650247629530F9E17A8139C9620911F3B57C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 44ebf1348ca87798c6e5bc2978d151c84e52151e83f99567541a676aa02891b5
MD5 6c3a9a2817d8c5e69e5bd6856436f67a
SHA1 0adffd1ea2f82d8f5e8120e1b16c86e1d310c7bc
SHA512 193cc3d0556b1e5c743705168525c8c92a2bcd43475094cb215fbecd2085b304a7ee7702faf2c1deccb072abeb5ecf27e16f8bdaacada86eb52af9c1f9f5bbfd
SSDEEP 12288:2RiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2d/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1965523D3548955B1FAFC0039C6754428F5881E2DEB5659E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 e12c440b8b948f5e90135a2663f0acb60c42bf72f161e82d7a7373082b1e99fa
MD5 aa4b4371a8bc3f414bfd18de7cbcaf7e
SHA1 842d4662e823251cf2305c3dc721e12aa88e6eb1
SHA512 2db6e6b9983efee77cbec16ce51f78da38c807d742de112311efe21423ac44860babd1ebb99dc262bd98b6e92f1e3fa5dcf2a8932768f6ab7dc2af9d06a969c1
SSDEEP 12288:3RiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3d/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DE5523D3548955B1FBFC003A86754428F5881E2DEB5659E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 8ceeac9181660026230ff66dae5518c764cb9500280e55a43a23db6a288674fa
MD5 25f2850aec4222c0d99513143ebf47b3
SHA1 2b52c71a9067c10574854c8bfda92c0dc3d72088
SHA512 b11e0505f57c4563d27dbd5c921a77b269c049468c464854d310407ea61867b3c2ea281e2f9502555c64f35be3c0063c3d2036b96d69317209b953514c818d24
SSDEEP 24576:szy4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:srLNiXicJFFRGNzj3
TLSH
T135650247629530F9E17A8139C9620915F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 3b7b8dbb5167722fae75c8eda86f95481508b70790ebc7803dd1381b9a853694
MD5 de28ca8b534b5d752cf022e3bdbd44ec
SHA1 98e0c9f94d68c391e9a55ec180013ce2552c8e35
SHA512 981a4416e667fff3bbb070e852f637833742c4b143a66141c97e8b7def39f62f51ce5752f0f509c002f31cf90769fef718c12828423844a8825ee49b2bb52c9e
SSDEEP 24576:eT8aLl3z0zDq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eT7LljjLNiXicJFFRGNzj3
TLSH
T10A7502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 fcb18d58f7312c20d122e3a1053a0ea315d03770dbb9640a3b0e9c6ddc3a8bf1
MD5 b80211ae62138c8776da1033861602c8
SHA1 d54759140e2a341678193e39cba56a418f346848
SHA512 a6487ef4a2f5824d93491af3765b21bc908ed31c888a9f0bfb82ad44e1c0180472a70f6d588e4e135dc51fc3d4ae3e4d4940f526a5778bc07bee6b01c535cecf
SSDEEP 24576:W3rd9CHKy7GZW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4rd9CHKyaALNiXicJFFRGNzj3
TLSH
T16185CF90F3E414E4F1B78A3589764511DAB67C5A5B31DE8F03A8261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 d66773e8dd1671f2e288f4b44c33aefee522e1e18826c99cb2e663b186e069a0
MD5 7e98c933839966237596f650c58cb3f3
SHA1 97afbbf6eaa771edbf764144634f790bf9339458
SHA512 876499153827b3b665186e74bb86abafea73f958479d9d2993c395486f1b0fa800b2cdf394a296c39a4b5e512eaedbca32bb3e83eb4b3bcc5cf121245c6be26b
SSDEEP 12288:uoiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ua/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11D5523D2558955B1F7FC0039C67A4428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 c582198a26c486a6bc6f9c08c31b5bb638bbb853a55251f92367b178728397a0
MD5 9b21b2f5721bdefca11aa215660125a8
SHA1 1185b310afaf513c80106836d4d4dbad31e0fa18
SHA512 26294f4386d12344269faac22f5ce7b1aa8b29146fec7aa5d1abc0b37fef53d80ddfc6da8b2c98cd1839ae5f15f3d015dd0490e7f6d8b4f51a9752a2df976fc8
SSDEEP 12288:guiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:gY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1825523D2558955B1F6BC003A867A4428F5881E2DDB5619E3E3483D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 817716939637304d98ca38e62707d2e09f69db32a57f1cee5ee1e687e10623e6
MD5 c209eecfeee3a629e93a0726f8a5d59d
SHA1 5500f0b136b9c1fcd676aaf17e6373c07c0c87c6
SHA512 66ab080b76117d2f5ec1c5f3a12cf3d016f9e9d05da2347e0bb2a85b8fa77c7c5b03b64358c20599c19e1a839ee098ef324703d48bb7474b4f2cf2b61fb04e82
SSDEEP 12288:/PiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1875523D3548955B1EAFC0039C6764428F5881E2DEB5619E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 c418140801a8068928c87e9656dfbc41b79c5948d60f0f67e73a10fc9fcec14c
MD5 1525db4865e81feeaf42083bb0e36447
SHA1 4898f4b6c1ed9f2881d9df7ccccd25eaa175d29b
SHA512 b93ade2ab37500992ef9089305a1ebfe70554a2ff64556d6bf65067eca26c5b185341a14e1a33e442d6cf4218fc60fe01ecdb5c27a9fbb4ac927f9789b8a9ed1
SSDEEP 12288:wRiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:wd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10D5523D3558955B1EBFC003AC6754428F5881E2DEB5619E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 118fefc52c2882e40902712320cd4bc040232f7a7f844dd164e131baa6ef7713
MD5 befd323daaec19984c1a0405752775e4
SHA1 71d4de013c013fe7ba14d0c8ede3a33a13b91e63
SHA512 6fd88391b43e855f88a0329f25b5b3458f29d02a7567ac9e1ee9570c65d2ecc2423e014b9261871d86d2369049ef6ce37ce71e8ce87528293580e439f6bc390a
SSDEEP 12288:FoiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Fa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E15523D3558955B1E6FC003AC6764428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 f0b203b0ee2ba7f631cbff864341f26f81defbff6ea0196b23808f477c3d8478
MD5 65ed26d95c3d517dead862dab315f3db
SHA1 fc80d1d1c9fad55d24f9e16fd9310718ad2360b0
SHA512 2f403ab9e41aae83f3c66ce5c947abd89335b8c1ae4d906ebf6258268bdcb8e327fbea30cfa4d975e2b8c8eaceaba984a6f3c77874b98eb5477525dbfdf1e5c1
SSDEEP 12288:iJiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:iV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C65523D2558955B1EBFC003AC6754428F5881E2DEB5659E3E2083D1EA238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 cbff873da3345753d565a5671bd2404242fce656250c55e5635159dfc82d4257
MD5 72dc82f8d96dab6b54f4c70ecb85f836
SHA1 b28c40a1dc9a5f1d82aab6202fe3d4ff9f0abdae
SHA512 65e664d827adb485c3d830f69ef63b7b19676cbd265a173376125d3a7e3a8de0293ec4bd6287d425eca8d71f908ae85b67a2dfe725637a8e6af93303efae6d1b
SSDEEP 12288:SriJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:S//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1425523D2548955B1E6FC0039C6764428F5881E2DEB5619E3E2483D1EA27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 83ddefa78225aed8dd1b41fecf2315b84b52a19846c6d0e26f0e036599332c5a
MD5 6e366dcbbe5fcef341999852e4bf24d7
SHA1 4347d00dcd7081a4bf9961a2d8bb8bb08d52b3ba
SHA512 e62d01bdbc8366a2993b030b5a094370fd6d473005f7559b5f91df3b049479ca00f98473ab9940a9b4650e256e6665f5a1fe1d613bdc7db12d0c28e0baa4b380
SSDEEP 24576:mfwvzk9RX6wkyAIB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1MnYIBLNiXicJFFRGNzj3
TLSH
T18285DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 5165065d7dc8668ca5f7e25ae87c12d29938ddc4359ba2e3c12c33cea0c69b0d
MD5 e24f10f15a3b6657a84c4fcc8a6da12c
SHA1 0d8d3283d2eec0508c3160e0765a057082c9a904
SHA512 b40e2c2b32118f8edbc3724bc67c1cd841b2e46fec3d364dc099253c2bb432eb5d4210f6a3b1a2d91dfa47acf3c28a9c47f309f80161d84d6b34b68de249ffc5
SSDEEP 49152:mYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0OLNiXicJFFRGN:pySzPW7wRGpj3
TLSH
T111066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 4bb445536f4b47c13b6ac0ccbdf18196c531d3f0ad6a8694fa29e9ab193e1127
MD5 f6c41459d1c240bd31dabe6c9e140ce1
SHA1 d6476573ea2f899a68c1b621fa63fe1e8918f23e
SHA512 e0b61defc60ced7e5832d5ee162874bbf74536883b9081d3273d754316fa987c7d8e2cbb0e0e831e4512d2ccf580cce9dbc876c49dc2835dfb71b98d5a6cf916
SSDEEP 24576:147Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:147JUQjqirIhCnDHUPfF/eLNiXicJFFS
TLSH
T1C565AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 8ce589fbc8786792db8801c4a3163d391d4d18c0eb538b1452d1889ab42da659
MD5 429413835f70745590008ed5dec772d1
SHA1 ebc6a29e2f49623a6aa39d88ba6a463835651e4c
SHA512 dafc4355098804b9a06827e4916e60e9c32624b273fd2117a0a7fa3dd043bda3115dbc4830b45f39e446e829cf2332e3d06470cf95133e3cb5f4627e0d10a1a5
SSDEEP 12288:XpsfhiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:YN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C865F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52C0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 956KB
SHA256 8c6edda896fa046779dd3dcdf87e67176992fc75b2da38495ff329f0861e2248
MD5 7aff932e47e8a734b9ad08eb70558a38
SHA1 7f5bf9608f58e17d9035add44cabb2bf4e82e457
SHA512 4589aafd5193bb5cf21f6ab320e0415ed89d278feb93fa4df34e638d803c227d729df1e305994b395505d8a291cbddf2fe8aae7c4b17ce2515cea152e5f92879
SSDEEP 12288:2cdtU3fuJT8ZPQ8WRXwXnR6zaDxERMoHputGHpLB:2cPUPUgZPQ8WR4R6eDxERMoHYYn
TLSH
T141250740B666D74FCAA980321E32D1CCAB707D01EE456F0773C9873FC576658BAE6292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 4791fb05204a08db91fee2322c7a33fc7cac243d8fff2602203b7b1e91fb5151
MD5 b064cdcfd83719b11d3b028b26948c7a
SHA1 e835deb6c07d13ea2300f427bc8d62e0ef17bafc
SHA512 8f40edbb24bb4da597085c7cf7f9e56ed7fbbf32ec1f54a1727775a9896ad8e2fae52a9e21e79f053ecbfb59f642636faee4892f0fa8613a89a88fb7765c72d2
SSDEEP 49152:GfjGApC4ot6gpc2Xg5sMu5hr6u6nNavg+wa+m2TL:epPA6L
TLSH
T17575FA809137A38FD1BA503207269B8CB764DC07BB456F22B789453ED85BB55A0FA3C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 e6806efa039f46f2c42b3263b92fc8bb4275c57af1a4c3a8f8b91031beff77bf
MD5 4b30846e72e6bd2ffa9f5271ba722df8
SHA1 a65109aa76c5e18f0a59c79d90fa99c4bed906b9
SHA512 ef53f3e4f3768499f8eba83f8e32863837ccec693fc85fe4f39dd8a78229c5641d42367fa2b676d264c7982aeb8342e475d261793d2708a1ed9bfff61d72ca62
SSDEEP 12288:lF7ZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:TF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1465523A3568C59B1FAFD0039857A8434B5497E2C9F1598E3E2043A5EA138FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 452df20d8dde38e29056d83e08dd83fa631ba09a59e054242d8b7c92e5fc4633
MD5 edb6287e2981bd101dd1af5f9546bb1e
SHA1 cc1b3607f20128e4b5845e05298d89aab53d9b57
SHA512 42e2f28ce5efe8b4fdb4d440d7e6acf72c36dc54d3d9e9c8b7676766d75302a10d8c56a0a2e05c823c4f370c18b0fb2bb6f1ffdf067167fa8173df8819ca9725
SSDEEP 24576:sgb6bmBIi49WNNFpg1rSvFv7bYj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:sgb4mBIBhGFULNiXicJFFRGNzj3
TLSH
T19C65AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 bc1c9f70959ddc8ea12a21bd8554c0ce277e83fea513b66e481e46c81796bc7f
MD5 3ee7727380ad844c8c25bfae87d71a24
SHA1 563744af980f94883f02280becf2eb9752bda726
SHA512 ecb9b3f37f96a51701695e3aa71e0fdd88387c6cb5ef32e2e92789f56d4ff27b55d4b94ff42b61abe526e8fdfd2973bba9d191ff5783dc339c000c41f270ae6d
SSDEEP 24576:yG88u8FpJqH1vzria7/mE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:p7ZFPqVya7/bLNiXicJFFRGNzj3
TLSH
T17D85F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 8c6d740e3393c49212e6ebef66a42e06a3267bc0c8a8d8f06f5c6696fb1a8f1a
MD5 b72073f0bcdf2f80968d4b1709a4dda9
SHA1 2fd7110ab3954e92fb744c0ecccf22640abe0937
SHA512 4b5cee9475e1cd55053306ef3ed81e593e20849ba14649c517f1a60479f08c680cff4181c3d8d408c842202f6b05ca34e86330f63b6a887bbb3cf7e0be86a5d2
SSDEEP 24576:1PUr+NQA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1JQALNiXicJFFRGNzj3
TLSH
T13665F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 40223769d6789e8a4716ba959f52b06f14423fd991a23537b604db6404bd1cf9
MD5 156625aeb505af9e9c5178da3d2e2b4c
SHA1 74d32b4e5d54288196bbe78c6c94df430a0ca0d8
SHA512 dc023354426274bf88500917b8ed5e8d241ee46acfabd8886e337e374ba26785580b9dfd60939c0e390a4c1ca164cc59ca8e6209a52aee42dd433ac635aade9f
SSDEEP 49152:4BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjwLNiXicJFFRGNzj3:TG05lO43bZ7wRGpj3
TLSH
T184D5C06E62EC11F9D1BBD07CD9C6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c378cba8579cacb71b6587ac599abcbdccf629c7c28b947705efda9a4e0228d2
MD5 2254ba02ad93b1bdd7e680ee7271dae0
SHA1 cd94106983307c5dc1acaec64926d2ed694a1fb6
SHA512 5d520a5dec6c68be8d1a51988515ef24c84658a8bd4c30d5ef0c5d6f1cf8dc77385cb03131055e8ffd4d2fc4b80c802cc11a79395b28026b99ededf497e43dfa
SSDEEP 24576:Xfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnO/TwSfVcYG3K/cJHlnFR+IGNe8jg:va5POZ3lJt2pasx2+mYLNiXicJFFRGNf
TLSH
T13165BF5EA2FC01D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 8606130f21a437dbbcdf71ce0189b8eb0d88a634751c9e6a345c6c59ce270286
MD5 475beb3327c81e0f3803e9f26935d5fb
SHA1 9a3c1ce701f445f329551b12224b81639832f829
SHA512 7e56f43e51b8e655aad51c552142d6226636b7df01482d8ff975c7c3f89ac2765f87c0018b55b7e005fc41f3012f921fe817d9500b8421397b4be34f52d571aa
SSDEEP 24576:3NcwHdjbyQ4nLC18lb/EOjowL7Fks/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3Nc/zEOVHF7LNiXicJFFRGNzj3
TLSH
T18B858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2174af2c35cff46538667281fbee613ef3d9922bbec52de4f80cd8feafd7150f
MD5 67d59a870c1de3410d82a89659880d00
SHA1 ae452874ac8c09bf8dfff9f2e432cf4155ff0a2b
SHA512 aa72c54f302a443180937f1ba7c75d2c0eb176ad75049756a34cc52a48366633b037c5d3b6eacaf913b356fd4e08a9fd8da7eec3b59f344fc0ae5b09b3684a0c
SSDEEP 24576:RzkNvNnaFeYhJNtmZBmi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RzMwBtOmiLNiXicJFFRGNzj3
TLSH
T10955AF6EA6E846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 40517b6e97886bc634c30e22cd5bc9ea98f467c9b347e8ad22ec2fc2cbbe8713
MD5 0c3748658e00151392ac6c9e0c160923
SHA1 cb30a160253a44047e8c1455bd20d6aee61d294e
SHA512 39b10303e27a370504ba392447d4f994f9bc39bf9b47389f4252f3a324602e4e9a9cb94d8b3addc5a3bcdedf443437c22fa1173bc785c7f775951db1a6241300
SSDEEP 24576:WD3FHshBIYQgAp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WDVHeBIAApLNiXicJFFRGNzj3
TLSH
T17775E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1324-55-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1324-277-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1324-61-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1324-54-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1744-38-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1744-39-0x0000000002290000-0x00000000022F0000-memory.dmp

Download

memory/1744-50-0x0000000002290000-0x00000000022F0000-memory.dmp

Download

memory/1744-45-0x0000000002290000-0x00000000022F0000-memory.dmp

Download

memory/1744-47-0x0000000002290000-0x00000000022F0000-memory.dmp

Download

memory/1744-52-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2372-120-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2372-311-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2372-121-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/2372-114-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/2716-14-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2716-21-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2716-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2716-20-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2716-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2836-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2836-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2836-315-0x0000000002FA0000-0x000000000323E000-memory.dmp

Download

memory/2836-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2836-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3096-0-0x0000000000400000-0x000000000063E000-memory.dmp

Download

memory/3096-1-0x00000000023E0000-0x0000000002446000-memory.dmp

Download

memory/3096-8-0x00000000023E0000-0x0000000002446000-memory.dmp

Download

memory/3096-77-0x0000000000400000-0x000000000063E000-memory.dmp

Download

memory/3384-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3384-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3384-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3384-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3484-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3484-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3484-128-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3484-136-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3484-134-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3816-88-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3816-94-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3816-95-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3816-328-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3816-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3816-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4324-312-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4324-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4324-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4324-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4324-102-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4324-108-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5136-78-0x0000000000910000-0x0000000000976000-memory.dmp

Download

memory/5136-308-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5136-84-0x0000000000910000-0x0000000000976000-memory.dmp

Download

memory/5136-83-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5236-293-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5236-73-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5236-67-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5236-65-0x0000000140000000-0x0000000140222000-memory.dmp

Download