8ff7eb0cf62d2cd05343f24724a6f31447a2fbc30361650d20c2441bd78f9f86

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 00:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Size 1.9MB
Sample260723-asktqsed68
SHA256 8ff7eb0cf62d2cd05343f24724a6f31447a2fbc30361650d20c2441bd78f9f86
MD5 06e1df4ebbf7dc50a56cec45eab7d467
SHA1 c1c35aedb74f4ec90149dd4556354bd89cbfb291
SHA512 3854b0f76f1b48513dfc7d02545dec1804f8adab951c00e176ef06b7aad9eb720c441fbdd86941ea262186a410df793fe13c82acbe3a3481f983500f8803612a
SSDEEP 49152:7cABQwHqLgsQfkGsKGzKl++eRxCm3fGrdkjsl82ot4+Ej2EkCPRwqVjDmg27RnWm:oLgFf42kjsl82ot4+Ej2EzvD527BWG
TLSH
T15395BE70F9808026DDE152F186AC7B66046DE864077499D7E3C40FDEA6A43D2AE32DF7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2060	elevation_service.exe
5820	elevation_service.exe
4216	maintenanceservice.exe
2712	OSE.EXE
3736	PerceptionSimulationService.exe
2892	perfhost.exe
5712	ReFsDedupSvc.exe
2136	SensorDataService.exe
1388	ssh-agent.exe
1236	AgentService.exe
2972	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ff96adfae62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c7cf7ab63b1add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000257016723b1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000046374a723b1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000475b6ab63b1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ad7341723b1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ba5408b73b1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000750783723b1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5676	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5676	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5676	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5676	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5676	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5676	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5676	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5676	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5676	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5676	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5676	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5676	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5676	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5676	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5676	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5676	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5676	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5676	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5676	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5676	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5676	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5676	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5676	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5676	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5676	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5676	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5676	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5676	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2060	elevation_service.exe
2060	elevation_service.exe
2060	elevation_service.exe
2060	elevation_service.exe
2060	elevation_service.exe
2060	elevation_service.exe
2060	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5676	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeBackupPrivilege	5712	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5712	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5712	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5712	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5712	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5712	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5712	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5712	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5712	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5712	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1236	AgentService.exe
Token: 33	2972	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2972	SearchIndexer.exe
Token: SeDebugPrivilege	5676	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	5676	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	5676	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	5676	2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	2060	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 3684	2972	SearchIndexer.exe	101
PID 2972 wrote to memory of 1108	2972	SearchIndexer.exe	102
PID 2972 wrote to memory of 3880	2972	SearchIndexer.exe	103
PID 2972 wrote to memory of 4240	2972	SearchIndexer.exe	104
PID 2972 wrote to memory of 960	2972	SearchIndexer.exe	110
PID 2972 wrote to memory of 4348	2972	SearchIndexer.exe	111
PID 2972 wrote to memory of 5760	2972	SearchIndexer.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_06e1df4ebbf7dc50a56cec45eab7d467_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5676

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2060

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5820

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4216

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2712

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3736

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2892

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5712

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2136

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1388

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1236

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3684
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1108
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2844 2868 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3880
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2856 2824 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4240
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:960
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2856 2824 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4348
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2844 2868 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5f07215173ba1e22944cd937bc331919c69d1b0bf795fcc3f1b96726e992e72c
MD5 2f6e2d5d13c3432cc6c526fff93cff1f
SHA1 d4253f057270bfb720584cb2c62589a0f9743258
SHA512 1c465869583b1c547e91304a59b1650dd44560ddac8c29db561b627927bfd6d2a435def2332a32725ce0cee151ada7e7c2996b75bf54e877dd8ba8e58fdf256c
SSDEEP 49152:Qb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnJDmg27RnWGj:63q6HjBCD527BWG
TLSH
T108D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 4444f778164755b7d474a3445c9849eac6218baab25e279def4e373e05a0eb71
MD5 fb8a3ab9322b6a464a159f7f5ca3f472
SHA1 e4bca699373cab56f9c89f08ab80f623f0e7dad3
SHA512 7269225f427db53a1ca5a9228ce6883c359b05bcd1cf071051ca0a6bbedb6e2057b2fa32083e87b1f5e5e83620a009f043d4e111d9813731eaae5a349a031568
SSDEEP 24576:UXYfDtczAVMsqjnhMgeiCl7G0nehbGZpbD:TtcTDmg27RnWGj
TLSH
T184850129B3E408F9EC67817CC9A2C516EA337C554760E68B03E499795F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 bb7f4faa7a31ba2aec5d97bc40a0051d187231c4ffeb361b674eae31339eb68a
MD5 86a601207e984b01a71580af29c30316
SHA1 d0319db0617a01d0c984a9a4cbf4ce306ba84db7
SHA512 3bc03b7437b14dd75a055374b1d5bd4f61d97b998b081eeac5a00aabbcec5b91da79698f240c72ab1071bb6eb7ecebc2967714d2be3f04e3473b48cb58f20926
SSDEEP 24576:A0Le5ji0hmx3rMuMsqjnhMgeiCl7G0nehbGZpbD:APji0AZMDmg27RnWGj
TLSH
T108A59E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c69083ba7398714cc17145af3ff47cce97e04664e6ec4ac82dcbd9912badb7d6
MD5 86b51b15c7b623be5ef41d39c6c23033
SHA1 f534cf57ba73b237732a18940fa4f525b96079b7
SHA512 d0ef1c894ebc192100664486e1bdc6feaf89aaed6dc64c27296e4078ebe9c360b9b0a0aae4729f90906ba49c9703c89cd6b3aa5fedbf21849ee2ce1a5c903705
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWE6q8wyugMsqjnhMgeiCl7G0nehbGZpbD:+/ezSC6vUzPvxHjyYDmg27RnWGj
TLSH
T167755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6b1f1d69c95feda350c98e8b8a8d739d5c6dd6bf84eca33d1843ed7540728246
MD5 338cb07a7dd397c7604ddd5f4b3ba5ae
SHA1 94bf13f8b7916f0025c5158043499f298390a361
SHA512 479627299806bbdd681e4fcc320c6221ec04a0365f958377d4d8e0451bbf321d76455e21e6589952e5350256325a6a94ca2de527ad51b6cf154dd3d20750aa9a
SSDEEP 24576:2VbqPb88hv/l+6RMsqjnhMgeiCl7G0nehbGZpbD:2VO88hXl+tDmg27RnWGj
TLSH
T1BE559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 83f4a1a0ce7e1650ba5280888c7be982bb20236fe57d809994a2b77cb9b55b08
MD5 380dd3f65a187ab14cc01296e289ad8d
SHA1 90ed2fd3798dfec2254931bb181314021296dd45
SHA512 267fb515c0d1e90fc1f85b6ce9e8fe4e5c1770b21b09a21e3317b01646769bae79ef8ada3411426bf912bed8f5e7cf29ed026f075add3f6e278bc0e85c67c349
SSDEEP 12288:wX6MXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wX6MsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15F6523BF965C50CAEB7608B5C3E9F11EAC137E56982008436A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 86f79d56dd7eabaeeeeffa492d0a94e1d099d25ece9fd75192d5c619f69097fd
MD5 8728261d6b92d0f24263b4f89bd2a985
SHA1 f978fcb5581e48002752fecf39920d1811494d81
SHA512 39ede03b60d8d62f4e8ace4a9b894c9725b35273ab72fb2717c3eb528ff55390c49f2510c0643c6378d4bdd5f7370342f122bd27fc3524e554a626eaea6d42f5
SSDEEP 12288:FeBNUbTVO86U5MXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:FJIU5MsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14D85CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3b338f9bd67d76ba662554fc7d6e4f38d711a14a6977698fc17ad1823bd18602
MD5 2d19b3c8a288e456421b6c430054d052
SHA1 c1803e2549047f90178addd9368234668a1c5efd
SHA512 2308dea85d2cb729ce7cf4da079656237842e33f256c103bd590c7852c491640cad5c9aa6fec4b8a9d2b4ea660fa7cd52fee04e05c0e7f5941447ee118ec5bc3
SSDEEP 49152:TQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THh:TQvGAdlCEL8c/yRNw5CzD527BWG
TLSH
T168266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 6aa105ceb6a0602d29b43426485b55b82f28fd5825b65da3bc09f13dd02bf839
MD5 426259b899e954f678e14964d2fecde7
SHA1 74e0c88551baabb39158c828dbc43e29c15ff5e0
SHA512 bebb777381cd97a741e0bfb918ea349ba1ea4ec02e5f8f23d175e0a4b49bbd687f8497ffc81e52ceb571803d97adc6d68bb5bead4de55c25101bb5aa8e7f6006
SSDEEP 24576:tUewsAjjMsqjnhMgeiCl7G0nehbGZpbD:2lj8Dmg27RnWGj
TLSH
T1F695E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c1466b85fcfeb5bbed79d76e6ed1292f21d845a7894cf61217372b1b8584d3b1
MD5 e82af3ab63feed82bb7cdf4f1f044224
SHA1 1d565c2b503835cf9a5bcc6db94285264efd7dff
SHA512 db81d3c0642292882a1acdbfe5dd74df4888ebe3d8fe9120d76487b2100bc97de9fe03f028028935d57ad0a865b998a8959236d6a87d72e0529086d32f3b7975
SSDEEP 196608:rUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHEVQBWG:rUEtQevvqc2W1cpV2EI32LB
TLSH
T1D3474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 62f0bd409dbdfbabb35c36a515f476164ca80884cdd4bc6a4e6b0079616a1868
MD5 93440256b74d021353792c45e81247c5
SHA1 0cb1b31f1639945cab429fd4ee5d4d9dd1559ace
SHA512 f9cbf985c7a7a55a8f4281d7c4e6df928387e83313635903c2b5245fb5ad3043ad32a815d91e53174f37134171cdcf69ccf4af7745bf786bd1fc28e901daf612
SSDEEP 49152:zCbRquA/m2yL5zQfFiV+XenmE3/zcDmg27RnWGj:MoqtVjnmPD527BWG
TLSH
T134D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5fca4fb0ea297e826674f24278f4d61805d1adfdff994d4e654091d816c38440
MD5 0700e9fc33688268cc407d32a0f761b2
SHA1 820010a5092a5f7f09ddc99bab94e60df0ed9f06
SHA512 e53fcee8210c7d0f3b827536355a58a09d79b1f79748d42e05c81bd782d90a8bbdc124d6a8cc3262c5e6fe7baf9e22d2c25ba6f2fdda9a0a017de62eb2e1767c
SSDEEP 24576:AAhGLJIFoiwtA5l7S53kMsqjnhMgeiCl7G0nehbGZpbD:AAMyFoiq5/Dmg27RnWGj
TLSH
T1B7359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 0fdf0d8db8493566454caf85608c9afe8f3493c41510a4e2aa80bec0844307d4
MD5 7c5299a7a63e99c77cfdff5fa9fdea75
SHA1 c85d50c14cd3ba2fdb0f1721cb86d6da9afa2285
SHA512 4f59674a8b192191da5d6c5ac16c89eb682d1d6ceb1956c7bb2453ceba3135347f955d78bf3b6734ea078dec8fe4fcb60864fe52db012020ff14f666183ffd90
SSDEEP 12288:/mw5HEjsChNzBFgl0WDm+CAMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83i:+wuSOWnMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12885F15A72A80CF9E9674539C697D136F7B3BC122A20C71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 db4f291ac8b5c0ba3023d139764d1ae0a9492f15ef69b2ac365eb71486f02afe
MD5 9ca199e28064a3e9a6f7f801066638b7
SHA1 4cb5b0d51325a0a4245d66f3f6c4da7e870ab742
SHA512 6c5950207ffd716f33e4fbec05ffb6e5feeb5e63510be1c5f369fa44ea3262d8b155733ce6c8f176443b49569c0af0f30f2e77b84bbb2a8ec5c507db2bd5ae95
SSDEEP 12288:rzZ1IyTMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HZuWMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E27512AE239820FAE163417CC5E5D609E7333C66673003CF16665AAA6F739D44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3bb9e6933cdcb74b899675f0edfdf6f652ecab492acaee490f68e2905d36107a
MD5 0dbf1f44936a96a25cc3c9f586b168dc
SHA1 e57920bad5b657471abdc920d804bd52c7c2887d
SHA512 0eefaaae0d93e5fbca668b1a54335b94cb61d1d46ea939dcb713efee2d288cb6607cbce3740f76d2f2c95138a659c1236ea5db7cf7a8b13eb70d3e135ed02e76
SSDEEP 98304:WQRQyi36YOcPQLvw2gAf+PN3mD527BWG:dQyiKayX+PN2VQBWG
TLSH
T198667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 91a74bc96beb535f7a9b168b07d90c6b0e3db0c36ca8ffb3b8c9b695885d91ed
MD5 6305f48f55ff3cdda9449698ab79a16d
SHA1 9427049e5b4dbf8a8eb2cf2bf0003bc8770537f0
SHA512 3c8ed0155e6a871053d5d2d5c174d084b6655b8cfe9e0ad1e6b0cc578afd31b677a6407afdb1ff21270729d127c00780075cbe8742b64daa0320e34c021570af
SSDEEP 98304:HQRQyi36YOcPQLvw2gAf+PN3mD527BWG:WQyiKayX+PN2VQBWG
TLSH
T15A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 fd66b95a3c9b4c191980527e603cf7f0666f2b063f732340804aaeedb6164b62
MD5 3098aca5594fc1329f7d5496f8f3e971
SHA1 065cfc6e5f53ee910ced7401a3d5b700c345c245
SHA512 059d4fd647b9a80d0d7ace12685c0fb283dfd79f3c702d4e500c128d77d43c684377671f6caa607e9d7531a04a70a8630804d0845a5c8fca3e5d873f9ed49079
SSDEEP 24576:YwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0mMsqjnhMgeiCl7j:+68Qg55nhheWu7PNU3/MDmg27RnWGj
TLSH
T1EBB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0e72c8ca33a25b78d24688b8e9c3da2710a0ec6d8d8aea44061576d133321190
MD5 7819e116ccef8e8167b5aad2777a9ab3
SHA1 87d0ad849c53bd1cccbb9968f0e707beae6809d4
SHA512 4fcf07ead7ee548735395f89862de7efcc51a54fbabd0e40c51e913d1045a7c33692f3037c7ddf716fea0d405f7153d98a4c838ddd4231b53fdf89c729a3b3c5
SSDEEP 98304:iy5112gYy5azzVvL69nLKnhZ1D527BWG:rLIHmWh3VQBWG
TLSH
T1A4167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 df3c458357a795e6a1f853ac301ec9b617520652eccbfae35272e04cc4b224c6
MD5 99f88c8a67f95f426e331f14efa55523
SHA1 51e3880438e7003f4a9bb1a244311c259816db02
SHA512 a5ef9322d1907b8d26263e86b5a8d0e1790e8f0019f30acc76a1e5db15ac77582714c9a085f9f4c9fb5fa2c3ee5018e055d1fc532c825c76a1deb163f0db6e6a
SSDEEP 49152:SB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gleDmg27RnWGj:gu6JmVxd2deD527BWG
TLSH
T149D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c56854fd47db768fa82fb4e29ad5b5378d62829d631030f41f253fed331ef692
MD5 865592462b87cfd4af13b7e11c461e3b
SHA1 7ec92a254e30f5b0573165d57776b7c472bd2d04
SHA512 1dcb43b2cbe22179c239cf350762d51388a7abcac604b2e27033ddd515e7fba787e6bb8376be5b7f067f7b959112f0bcff8e44fbb36e78ff3c66185ab73a1b1e
SSDEEP 49152:41hpsNoJpF1A6UU44CwH7R4xKDmg27RnWGj:4mifPbRPD527BWG
TLSH
T1D3B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6febff371c37e22d71f3e2e9154f8c809a21bf8a2c68150327cf896741c01062
MD5 d2798e1e26423081893e329878423439
SHA1 57d80b45f008e7d1514970dc3047a46a83166f98
SHA512 d08f78ae17ce32004b8a3e18c42f1ed35df1993b76d05e50d9ab78507cb597ce4f89aba20edce734f44e481275653b104cbb096b1638a7d0a842dfcc254e33b6
SSDEEP 49152:DSuZQIY0Be2KRRVtOnks6NMHq5Dmg27RnWGj:h5dKTi615D527BWG
TLSH
T182C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4562fab3411908bbbe2d379b7b8277435af88831d5897c5eae5208682f3f5c0b
MD5 a2c2e2247d21df285f5e130234db9848
SHA1 6a5e361097fe9571cba02a0bc4850d3f20298d6f
SHA512 270715ba3c412222ef07e3f75081ae29799c99747b3ded9c48a40f05ac3554a2e4a3d95471ad9e0506e0e35415a95043ae3afad9135a5c017fe499644e734439
SSDEEP 49152:1htSn8EApI0figngiDn0AP5wODmg27RnWGj:EX2iyph7D527BWG
TLSH
T18F95BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 27302e3e62e637bd0111e5eac822b20a470a9745d82424b32a4445eb7a076986
MD5 5153143819519e3c18f3f838bcb705f2
SHA1 47632dbb392f09fc88000770afc02d49c288187c
SHA512 d10a3d4fa0764e4de0e2bda029049ce3cb3f2d17afffef8ae522a9eb770fcb2357ddf79ead64bca3144f23a7e3f62866b4c5053e1296869685a731945d14a15d
SSDEEP 12288:NCMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NCMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17A6523BF965C41CAE52248B5C3E5F14DAC073E5BE92004937AA77CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 1f4146b90cd95bda7025f94851dcbd38eef2708911471a6371347b637c871561
MD5 7737fab0476e490875f5adafa9daecc4
SHA1 03b4db27bbaa8a5b9fb902f9c412f8acc7cb41ed
SHA512 9305dfe0cec7950c3134c88a5227005c4e812607aeeffd7fa439ff7fe2dbecd2c113b04df25d5f2d1b450b47b7e7f43adb56b47c6e35e1217f70c5d0d2a34d69
SSDEEP 12288:pfMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pfMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1846523BFA65C41CBE52648B5C3E5F14DAC073E5BE92004837AA77CB9FBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 72d11d680eafc204068359b7f8445b105eaabc751b425f8424800666252032c8
MD5 894bd1e0ac9b1395a25b59d91fac9086
SHA1 5fad2758f71f94c36478fd69c19fb1a8f37d6fee
SHA512 6aa3eccaa43bf2af9c5e4254c89a89faf63939f0bfb951cb27392fa4cf225158b66a56aee9701f3e6d032f3b7d1dd497aa0cda002a2666b4d6595b7b242f5c10
SSDEEP 12288:whMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:whMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10D6523BE965C41CBE52608B5C3E5F14DAC073E5BE9200483BA977CBDFBB24584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 d73fc4229165105f42e10c7557b674eb7876ab3aa36a2732550c78ee7259b908
MD5 bc520e40adda11878f43563a671020c2
SHA1 6deb9dc7e3df2a3fa2eae2019996fd5070b846bc
SHA512 8220ff6f76ea4b3e7b38e16be8a164c3b0a9e41435ba954280200d57d78cade83cb57c80959f647e1e3570f2bb89cd484d2a24c6c567a5ea63b6dafa503ff366
SSDEEP 12288:hVEMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17375236F675C00C6D83285B4C2E5E11DE8277D96EB3005DB6B532CBDAFB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 23f071c82a5763336719266b018677e2fd34b1e0247474b1a885a25a3b7d4f47
MD5 4856e1a4844becafc8dc2886588e2d24
SHA1 8cfa6f1778ebab8b6041a0a24784351d0824800d
SHA512 629f5a880095b684cf21619b3c107b48d97f9c003c709f1603c9175ed19ee0367a1b982ca6378a626334292a4eefb8b2f0a49da653258e8f4723bd15cd04f505
SSDEEP 12288:b8MXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:b8MsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1746523BFA65C41CAE52608B5C3E5F14DAC073E5BE92004837A9B7CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 6f99989033eb2b4e3ce3a49c1dc5c2a1c773124e523e8203474d011108e64885
MD5 481f2c78c3720a87643c2470afe48ba3
SHA1 9cea22d586790e28a4c30dc80860beec23d7c5cb
SHA512 3c1f279e1090c9bb720ad56caba3a87bb67b486d180f470418dff6f97a9290d28c440d6a90c5e376734135ef8827343991afbe7e4a49bb7dc8f1a5a4c9bed580
SSDEEP 12288:fLMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fLMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1216523BFA65C41CBE52648B5C3E5F14DAC073E5BE92004837A977CB9FBB14684B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 1b86f25c8ef8f1324079eb699acc9c0e51debb8c19d0452470bb4f9da77d75cb
MD5 bc920a6aa794ff956e056b4ad0d79da0
SHA1 8c86231257dfbc9dc269062e9a8ca23af1a5f983
SHA512 2bd27b64b6bfe84c5ee3548b81cbf49216e68519e0567dfabe937a1cc5250c3bd0ace95ff2b70920bb4d72b79c1bf235ee4100509a595f3856156062c179ab67
SSDEEP 12288:a3MXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:a3MsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D06523BF965C41CBE52604B5C3E5F11DAC073E5BE9200493BA677CB9F7B14684B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 c3865900dfbea84947ff68eb302cb56246cd0177250c6263ac4ef4ce9945deb4
MD5 6cac5347375b61a1b3ed4b1cff97a7ab
SHA1 cba6b6b6f2335eab1e31a5d5a1356c1a5fe15f95
SHA512 bdb39fc2569d35e9659b36d306cc1790268f2c5e271118b82f1a31d0914b4f890c17803ea887fc382ea5ecb4160061849808c8f92529ae9a7ed57e2c6673accb
SSDEEP 24576:MZMjzFVSO/MsqjnhMgeiCl7G0nehbGZpbD:MZMjzfkDmg27RnWGj
TLSH
T1858501A9B35418F8EC63813EC965D90AD5B37C5A0B70C61F13A4366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 11ab797e0892f4c6a502b377c7baf0a80d31caecf5edf79964aca3ec170e5010
MD5 fb83135aa66a21c4648b13d6196ad5b2
SHA1 03a7725cd621037d336f68c50ad2ab3a137f5f59
SHA512 74bd1fee8710096146b57065f5c85252228bc7a2f309d32b58a2df212b97e8f8ec5dacbe6f94b3fe9b53047c180259015a256b987ee716b1fa567a31dabd34b8
SSDEEP 12288:+GMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+GMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A46523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 b747b5afc4ae2998c10fd270422274d3be87df058514bdab628e23ac80d1611f
MD5 fdc1a0e7f6d3d90773ee4d9796f33226
SHA1 9b48184011b7c889ce05a9102e35532382a7db8d
SHA512 802045eed1a9a4603c4158249ecfa56ae4cebb110f438e33fbd69f7a3d42cd347d6588e2f5e199b73fd65493066fccd9c746e39f233d2760b390bf39e35f8d46
SSDEEP 12288:bqMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bqMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1316523BFA65C41CAE52608B5C3E5F15DAC073E5BE92004837A6B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 8e72e1919c7434adea5325a9b7a7b88872a0cecbdfc2b7085d83174b598dfcef
MD5 9363dd6c7f7e199be405b742a1e67ed2
SHA1 48c7e2e98483c9b5c0e4789bbcb688075185716c
SHA512 aaeda644bf472179260c1224066c53d03ff06cdb959a45ce7cb56f8b0f80eb093587fb1f5265f9a17688b13451915d13a68bd2ea7e30173f889d87e733a81f01
SSDEEP 12288:DyPz5L8TMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uzyTMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15775125B73A530F9D1378178C5A29A06F7327C3647204A9F17A116BA6F736D08E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 a6c5c53427b53e20b0b060978fc2f1e0a8f8176b6c93b7bb4246fe6a0b40785b
MD5 b3b182fd2a41016ed6840af76a983436
SHA1 825fd81dee27333e184eaee65b0f7ca132600c24
SHA512 23d87bed66fa6311f101986309b47afc29b161fa9e9add3bf594726dcfec64373607df32936d065df0ea12c9f5e2c00dc3926e1f7efaaec7e254d073207bb875
SSDEEP 12288:TGMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TGMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14A6523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 092a91aca120ad0b1d4ff8699cecf8f347cf20fc6c21db55467261495516cfe7
MD5 5c07bc903191f14f17000a38a9fc161e
SHA1 0c5466df4a8b476c23ef2a79e681c8abde803cf5
SHA512 d69c623a4139f55d0415812485cc00ce09f36ac0f4816b6461d8599918094931c2ea360e9bba04630189fdd0f254e984c12af432691b531ed3bce947c3fef288
SSDEEP 12288:IGMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IGMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19A6523BFA55C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 82cbe3ade03822ca2dcd0b4e46c80438a7b5f1ebe58d62b53106a53b33a9f251
MD5 120d3dc88e6ca0d2901549baed2751b4
SHA1 4db87be26e0d19b770a0dac461450dbae64c5f97
SHA512 ed10502ea5208e0ef5dd4378327bdf627df2bf868bbbb52374be0f2e6061d4cc244ab78062033ee2acf545a94bc0ccf7a70a8a0e76766013fb5b3d5cb9ffab08
SSDEEP 12288:1yPz5L8TMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:czyTMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A375125B73A530F9D1378178C5A29A06F7337C3647204A9F17A116BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 5c9e59fcd5dc3288c30c78b99320220a03f5138331f41323ea70b4bada10a5cc
MD5 43e4607d07765ffa742a39f50e432ab4
SHA1 44e365a6da41e1f0006131bfd602e04804d1c1d4
SHA512 c16bfcfcfb31c020b4417011bedeb81f5ffb336cdcff93f80110be9a4ac157ce89bacef2955229b8e9ff2f9c34ba7686fa9a704d4e8056a191f3fdec0ebccddc
SSDEEP 24576:xTYaLl3z0zDxMsqjnhMgeiCl7G0nehbGZpbD:xTvLljDDmg27RnWGj
TLSH
T1E88501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A53A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 1cd89e2147270240348f1f6418902e7ceccd962d6c2c26edfdddb1a0e0faff84
MD5 0c921d50972ec40d56001b81e73d1835
SHA1 1f74ed965f2a4d210e1ad12ff01fa478dd02a5cb
SHA512 653a81b573427f47372be5d8b11cebec701c08a077d15fec9634ea581da57bd6d0e1353ba466de3cad311a6576d5b5748e4e4cf857e841df00694e06586c0d07
SSDEEP 24576:j35d9CHKy7GZ9MsqjnhMgeiCl7G0nehbGZpbD:D5d9CHKyakDmg27RnWGj
TLSH
T1A295CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 7773c01eeb4d88e580ccb68c6544a195771b115fd21a55271f0fcf4a2f8e9b8f
MD5 b74f24769d29a012a7575ac6e581e80c
SHA1 f8ed5f8034596210120c31c4ed02986275d44da3
SHA512 52dc5a6f41407a89d84500bbb1125ce54c63f6d40ea1179521f79a8251a7e774c8abc327baf40648eb54b5b270bab7b97fa225e73970b41be2abcd35835a2cfc
SSDEEP 12288:NBMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NBMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1106523BE965C41CBE52608B5C3E5F15DAC073E5BE92004837A9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 1958956592955a299a168b16f267ebada410d6852b65430bcbc6fe95c9abdd1f
MD5 a00fd548e00c1f14eb5cd2642968d2f6
SHA1 1de162d3a18181432d4e10e83d1894b5dced4b16
SHA512 3768a5cdf8cf21dfb1e2034304df3c84b1fc0d574b17ab587a54264f55850a82c5fd61901687f1149ac8f24091f03e687e578ac9c1697c80c6173ce163b735fa
SSDEEP 12288:mzMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mzMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DE6523BE965C41CBE52648F5C3E9E10DAC073E5BE92004837BA77CB9EBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 0f03b342862df9a39d39b890c9250a83bfba7ad34c03fac799592fca0daa4641
MD5 840d247ffab6d30b5a8815bc40c4dee5
SHA1 1e49651d9fae24ef211562d0946b34f99de45465
SHA512 9859dc5f57765c139a3079acfba24a23bab775b21ba507a77f9d4df3218bd1339a703a13fd3d786b35387f48ffa7d22ca029c1680d20e243aab06c7f228abf0e
SSDEEP 12288:WYMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WYMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D86523BFA55C41CAE52608B5C3E5F15DAC073E5BE9200483BA977CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 a3277bf66263cfe6e8dfe6faffcad8a879c837a4e76402415f334081c118bd32
MD5 0b01f500ea6a16175a0f32c13211d9b5
SHA1 c581c6f8a2f45cb646dfb51eaace1290bcd32726
SHA512 d0bde7fbb3265b9011be987144c48747af70197d75a3c95f236b52430cc459018d6494d2b98b2228b768be38443622092f62a93da9282b53ba10319efd5d7312
SSDEEP 12288:fGMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fGMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1036523BFA55C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 10bdc0fc4a984567fbe9a68f1e5a07fa84dcbf6ade8d1cdd2589f008e25cb9c2
MD5 86d1e76e19a597c40f1b4a6e618339b2
SHA1 de6291b2c8def6f34c056d514c7f03e4c53150fb
SHA512 6e088e5fe0e07921353aebfe31818badf43e7332b4d784efea47617512ebeecee9a1d1170ad35fc7e7a3f033001e910b7eec05008014b613d94e1f344a7425c6
SSDEEP 12288:1BMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1BMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A46523BF965C41CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 0059185ec197930b2ba3e73d057167be48f714e2091fdd4dcf7aa3e8ad9ebf93
MD5 027ec3ee5005b4722fcec60378300607
SHA1 9fa22ce3d25375c532f0e74b260746cf82e2ba47
SHA512 5f5ab692ea3f3ea44fd2a47c0c9d8a6a201f9f3c0c2975534f1647d4e8af463d3eed19c956f35d9d2c439adb57b9d804e54e497d29ad47ed8b97952cf50be5d4
SSDEEP 12288:u+MXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:u+MsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1656523BE965C41CAE52648F5C3E5F11DAC0B3E5BE9200483BA677CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 81efd3a32fd6745bda2f7a9d1ca4e764a3d395aac5535b3a8ede0faa55538931
MD5 6a03b5f412a452de1e821d6fe4c08230
SHA1 56d8552fe3eb1d8cbe2228732a0cc2175b58cf51
SHA512 781bfd7edcbe817fa953d238a4ecb0afc090bcfa8348bb330359bf9e2074c8253c73bdf53d42cf5c183424801be9a8824c218af38a696925548c8ab31a200174
SSDEEP 12288:A8MXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:A8MsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1556523BFA55C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 2f72e518ff76a3ab20d027f2e5e80804a89e178757bb284e99651eccf8c3f034
MD5 6acd27d818922231bd4dc2559d6904e8
SHA1 ab41182d27b22f33548824fe856af59381bd9b25
SHA512 f9e71208338efe546375f8a5475938c3df6f5f597829ff8f0376fe9d6c4d2a6ed24ced8c391a26d77a1eefd723bbf4394ba6fdf4a5409d190ab4af30c4d55ebb
SSDEEP 24576:RfwvTk9RX6wkyAIaMsqjnhMgeiCl7G0nehbGZpbD:cMnYIVDmg27RnWGj
TLSH
T16A95D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 ed98682256d4f5f97f80ee2f2d66dd1f4220d2af6e911a4da6fc91c7b63f0e86
MD5 ad09ecfdc57b02e025f6e7b11c67d711
SHA1 2cc3beef563360fc08a9b28a588a232234b8efa7
SHA512 d2eb33eb7fed60918c0add656447d28bc54df52e84b4db7004be205ab8868b56f012e6fed7fe15d5e28dbb9e098b95ee13ea31df9dffc41dc50273dfa9ec5415
SSDEEP 49152:EYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0uDmg27RnWGj:KySzPGD527BWG
TLSH
T17A066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 1f15a668169ce7b1baf3d2407d96552022ffacf3de53b5d6c871162ddb5867ce
MD5 897a467d320a153efa114ffec0cd8a10
SHA1 cdf2b45b7bbd352e3738cef5ff52f79cf4897fb1
SHA512 06243014314eb4fc11b18e11f18e887989191353a174b9ebdee2750ba5078807adc0615342d7ba106c4179da5dd9013a1104daf96be6f55e44c84e420a86f94b
SSDEEP 24576:+47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYvMsqjnhMgeiCl7G0nehbGZpbD:+47JUQj1irIhCnDHUPfF/eDmg27RnWGj
TLSH
T13065AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 863a419d578e213b6fca63733b7eae6badafdadada4016be87c8eeae22498d4e
MD5 7383342996c6f563b44a4d61ac0ab49c
SHA1 ae481a99fd2d728888e4978f316f29b1ebc00cb9
SHA512 c87ff8339e0cf7a336754a609bbb3f417bc364b155bd02d32d1213020545dbf908052b8bb4b4ef17a1821c0c8dfdf4822492cbb970806edaebe695e5679b9af7
SSDEEP 12288:6jsfWMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1WMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C675012AD29802D8C06E5179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 425def7b6d38cf4bda0d80a28be9d9630eeb9d62b550998104441794ec015487
MD5 5507808e35bc6fa21e44cfefa87bdd06
SHA1 eae733d9292314d48c27dddeca16aefd868a4ef4
SHA512 36b666d7aea6ba5e67639eeeb4d49c4d8e59634b81763a053ca22ccfe4d0725bc993e12123f046edbcf8f56fa675e2f6db3d8310ab30fc1675e28508a43f86dc
SSDEEP 24576:Id/2UPHvi2ZmfeRRS6k/OEMP1JlYRibiq5:k2Uf6mmfeRkL/OD1J0GF
TLSH
T1CA452741762AC78FC6A940325E36D6CCA7707D01FE05AF1773C9873F8476668BAB2291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 86bee4154aafc5186c9535f146e995e3f479e4095c2d4d62c1aa361c20f0c7d7
MD5 c31a7570ccf61ad7936029d70f1b5275
SHA1 008c21e7f0353d8a9ad8643b5e2a71113a8aa7cd
SHA512 71bf7983b3a4c2fddbf32b8ee50bd9999dc3f2ba863983ccc0e65a7bb7478fb7296ad7ee9cd836b7d57db8e60b77eded2919d26f8673affc3843d8cecaf19a59
SSDEEP 12288:X6fpUxgYFHd2HdQHbUH1vskIc2DMLK0u7OUzHh3/fskyT6grLC4w9SyJs9SyJm9o:X6fpp6HUH6HwHZ/dKbwF
TLSH
T160552A41A5A7E35FC9FE9037463286CDAB746C02BB453B0173448E2C98775BEB5E22D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 5d7fec32db75aed2590459eb648e421ecf3035e7e7713dc7cf78044490ca0e83
MD5 655b471f26e96c64c0a3e1e66d72a00b
SHA1 f88e73b4e08d5439ff51f047837bfa5868727dc4
SHA512 08955750a943a3ca0a2dfb64e38ed096cc1c85f3e9c64df3325c4f89c90ade0262d4ebe334113403919bfc6c133b1642764892ac7d1d5b914a77f6d1d4c3662a
SSDEEP 12288:SO7OMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pOMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C265237B935C518AF93605B482EAE12D681B3E669F1004C3BA5778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f89dc1b3116fcb8fb2dff4e46eb6fc8bb34184674dcc79aa6820e42376e3d22c
MD5 c3dc6dc46b667b4dce8674b0f08aa40c
SHA1 a7d942b625f20b2c84fd819693cb9025722b2503
SHA512 9509cb4bd28cba168a6b3307152f0c9a5f93ea9fc5bbda7c6f3f92d83922c952394ed35fa42fe733368bc87cc2c462455a38327d34b421078180f75f1ced9845
SSDEEP 24576:vgb6bmBIi49WNNFpg1rSvFv7bYgMsqjnhMgeiCl7G0nehbGZpbD:vgb4mBIBhGFQDmg27RnWGj
TLSH
T11C659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 89fae8c408da00a7d84dcf31343e754aa216bd4cfbac0c141b1a5eb09874a759
MD5 9a3105c9e60ca1021ccb8735205cff85
SHA1 dd55703a3577e89ce0faa5e6d784be66a87a4238
SHA512 7674e6955fa265d0327f66ccaa94f695c31a56efc38b0b3d73af528584bedb2841b679c9e5cbfba8a39d0503514c7f7699f19b803cd68d534d142362a83fe2bd
SSDEEP 24576:hG88u8FpJqH1kzria7/m/MsqjnhMgeiCl7G0nehbGZpbD:k7ZFPqVza7/LDmg27RnWGj
TLSH
T119A5016577E401F1D477D138CA868667F6B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e939750ad3874074a46b1f3e05c0e5f3ebc7cef3ceca1a4eb7c24703f3d35ec7
MD5 3da8780ed60ff8e8be5552cc607c05ae
SHA1 d911c2dce7f1fff81d80981373db4aeb8d75f42a
SHA512 a8c750eeabf838c0dc2979841d727779c2747512d63a3c8323b3980afa7823a3e277c57d3c00c667b85c0683ed735189744b5a031248bd1d61ae37143fc53291
SSDEEP 49152:RBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj0Dmg27RnWGj:yG05lO43bdD527BWG
TLSH
T1B5D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 191492b4c4fe98c960a8295ffa9198874987b505f789508ce91e0a6d7b35d8f0
MD5 318fa283e680196ff92931e12b339378
SHA1 465c4ff169ff41e3d089543086db4bdfd537d718
SHA512 473fa7a28730523370366d47a4960a3e3f6e91be60731f160f15813251384b8ab8ed6a43dcd55dc191358d076493bb0ae5609d4baea607da8d152566151ee3f1
SSDEEP 24576:hfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn1MsqjnhMgeiCl7G0nehbGZpbD:ha5POZ3+Jt2pasx2+mMDmg27RnWGj
TLSH
T19965BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 dcec6b8e921fca1e05753bcf8ae2dcb32ffb059d37b3028eef96d054e8568c92
MD5 7b6ffc6cc1944a2120ffcdccfc0a6b71
SHA1 cde6a6f77aae2bc3589b8db126b0845ace1da088
SHA512 559a388b57cb19d93b0de04002225cb16fbb350a6261c02772128b72270bd199646940245af84959341ffe34b59a0c96e10c02a1daef070b340b3276bce7dc34
SSDEEP 24576:aNcwHdjbyQ4nLC18lb/EOjowL7FkHMsqjnhMgeiCl7G0nehbGZpbD:aNc/zEOVHFrDmg27RnWGj
TLSH
T1DD857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 95f7604a25fb869573d0d85ad87ea9e915b6727d370fcc0e11f39a4b42ad707f
MD5 96b12be887225e9a9d00e18912f3c450
SHA1 1b4a0d4bbe2de9d850705fd45a94e0a1c61ef7c9
SHA512 f9e7432e66e820dea04dc426ab0c69f5d48d22d7d94b5a9c7a06906e21c9722040efd1208b0ccae8d827453c663727b74d33b648b9ab44951f817806547a2b23
SSDEEP 24576:i8kNvNnaFeYhJNtmZBmpMsqjnhMgeiCl7G0nehbGZpbD:i8MwBtOmaDmg27RnWGj
TLSH
T17B55AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 b104866dee5b904796f6e3f4c12a8a6a335ef42453ef7d2f35ae00d42a0722d1
MD5 168e2ba126e2df9c4fe4078f6d7460bf
SHA1 cd303db9859bfaeb477085ed0d7565383575aa9c
SHA512 07f73f610e79a6470ca21e8f1ae71e439aff5130e2891891f06a89e7e61ac6e68d95d80f32ba5c4be28afcd80dbcf01792f9b2e0853804faf75599384a492bc8
SSDEEP 24576:hPUr+NQ7MsqjnhMgeiCl7G0nehbGZpbD:hJQkDmg27RnWGj
TLSH
T1CC85F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 85969708b094c337c1773e0820b8e9892c8d66aa60dd4657102041852d53f0ea
MD5 8605e890143b101b68dffc66a89667c9
SHA1 7c8f22f57b09cf30cdfda80a2bd26510de18b40f
SHA512 1feea58f5af4cb22378380e6ec4d2a9b6d6b61affb526ad3406b59c5321b8af2ac6f78288d2ad69b0e73e3b38915df4a166a1b7299fd5114fe428323a6121245
SSDEEP 24576:XD3FHshBIYQgAiMsqjnhMgeiCl7G0nehbGZpbD:XDVHeBIAANDmg27RnWGj
TLSH
T10095E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1236-134-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/1236-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1236-128-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/1236-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1236-136-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/1388-115-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1388-121-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1388-114-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1388-313-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2060-21-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2060-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2060-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2060-22-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2060-15-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2136-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2136-108-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2136-314-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2136-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2136-102-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2136-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2712-237-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/2712-56-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2712-55-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/2712-62-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2892-286-0x0000000000400000-0x000000000057E000-memory.dmp

Download

memory/2892-78-0x0000000000400000-0x000000000057E000-memory.dmp

Download

memory/2892-84-0x00000000009F0000-0x0000000000A57000-memory.dmp

Download

memory/2892-79-0x00000000009F0000-0x0000000000A57000-memory.dmp

Download

memory/2972-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2972-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2972-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2972-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3736-270-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/3736-74-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3736-68-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3736-66-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/4216-53-0x0000000140000000-0x00000001401BC000-memory.dmp

Download

memory/4216-46-0x0000000001650000-0x00000000016B0000-memory.dmp

Download

memory/4216-39-0x0000000140000000-0x00000001401BC000-memory.dmp

Download

memory/4216-40-0x0000000001650000-0x00000000016B0000-memory.dmp

Download

memory/4216-47-0x0000000001650000-0x00000000016B0000-memory.dmp

Download

memory/4216-51-0x0000000001650000-0x00000000016B0000-memory.dmp

Download

memory/5676-7-0x0000000002220000-0x0000000002287000-memory.dmp

Download

memory/5676-6-0x0000000002220000-0x0000000002287000-memory.dmp

Download

memory/5676-1-0x0000000002220000-0x0000000002287000-memory.dmp

Download

memory/5676-9-0x0000000000400000-0x00000000005F0000-memory.dmp

Download

memory/5676-0-0x0000000000400000-0x00000000005F0000-memory.dmp

Download

memory/5712-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5712-329-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5712-297-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5712-95-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5712-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5712-89-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5820-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5820-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5820-29-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5820-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5820-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download