87abac2e8ea225c107fe751c408ff0eb97ce6b9e7e3db7472a0fb3970bb6be9b

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 17:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_97b4faced0aaccf0b5ebe8393345d3c8_amadey_elex_luca-stealer_lynx_njrat.exe
Size 1.1MB
Sample260730-vt9jpscg98
SHA256 87abac2e8ea225c107fe751c408ff0eb97ce6b9e7e3db7472a0fb3970bb6be9b
MD5 97b4faced0aaccf0b5ebe8393345d3c8
SHA1 9610d562b8048a2a9deab8cf9df8cb8fa73a2e82
SHA512 5f0b70697b47384486c8a40fcb958f7a87d9a07b47da550845c84c2dc9492ef493dcead91d09f76a6bd94a8b7a1f58c441229a37b058b24f6f540f173f675cd8
SSDEEP 24576:fe/OTcdhV664zIMStnZd5W7ylWtKDhr1VibHHufeZ1H6IFrXQ:rAN4zsZ3W7fK3Vibn7ZB98
TLSH
T13735D0107AC1D036DAB335B02ABDD272586E78301B7556CFA38807791E715E1AE3A72F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4288	elevation_service.exe
1628	elevation_service.exe
3316	maintenanceservice.exe
4972	OSE.EXE
2832	PerceptionSimulationService.exe
1652	perfhost.exe
2404	ReFsDedupSvc.exe
6008	SensorDataService.exe
2508	ssh-agent.exe
2128	AgentService.exe
4476	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-30_97b4faced0aaccf0b5ebe8393345d3c8_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-30_97b4faced0aaccf0b5ebe8393345d3c8_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-30_97b4faced0aaccf0b5ebe8393345d3c8_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\be93735ce62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-30_97b4faced0aaccf0b5ebe8393345d3c8_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-30_97b4faced0aaccf0b5ebe8393345d3c8_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-30_97b4faced0aaccf0b5ebe8393345d3c8_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_97b4faced0aaccf0b5ebe8393345d3c8_amadey_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bf1014b94720dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006017197a4720dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4288	elevation_service.exe
4288	elevation_service.exe
4288	elevation_service.exe
4288	elevation_service.exe
4288	elevation_service.exe
4288	elevation_service.exe
4288	elevation_service.exe
1628	elevation_service.exe
1628	elevation_service.exe
1628	elevation_service.exe
1628	elevation_service.exe
1628	elevation_service.exe
1628	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4168	2026-07-30_97b4faced0aaccf0b5ebe8393345d3c8_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeTakeOwnershipPrivilege	4288	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	2128	AgentService.exe
Token: 33	4476	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4476	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4476	SearchIndexer.exe
Token: SeBackupPrivilege	2404	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2404	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2404	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2404	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2404	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2404	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2404	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2404	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2404	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2404	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4288	elevation_service.exe
Token: SeDebugPrivilege	1628	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 3532	4476	SearchIndexer.exe	101
PID 4476 wrote to memory of 5772	4476	SearchIndexer.exe	102
PID 4476 wrote to memory of 1760	4476	SearchIndexer.exe	103
PID 4476 wrote to memory of 3596	4476	SearchIndexer.exe	104
PID 4476 wrote to memory of 3180	4476	SearchIndexer.exe	106
PID 4476 wrote to memory of 3552	4476	SearchIndexer.exe	107
PID 4476 wrote to memory of 4176	4476	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-30_97b4faced0aaccf0b5ebe8393345d3c8_amadey_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_97b4faced0aaccf0b5ebe8393345d3c8_amadey_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4168

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4288

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1628

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3316

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4972

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2832

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1652

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2404

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6008

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2508

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2128

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3532
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5772
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2932 2748 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1760
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3596
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3180
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3552
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2932 2748 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 46fc20a0400f8070b4b32f3e86eb36c71af62abbd1b7fa998f788ee282048a73
MD5 4b4342d5fb17d140ca08d6600b120eb9
SHA1 015258f568fa0711d9c82b890029ce344e6755b1
SHA512 a5df67bb3c55b4447d3ae78ff4923858bcb9042c516ae8f55bf41fe317ccfc2252552fc4fae90ba7081cadd4fedd44846fa92119de186910838e1477e61b38eb
SSDEEP 49152:sb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnD3Vibn7ZB98:W3q60jBQVibn7P9
TLSH
T1EED59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 7f0514385214bb233e1704398a1b702218709db3b650138be15b925762fe30cb
MD5 d2c5794ef7f1699379fd05b64a7ab04f
SHA1 c03896cc70222a47fe77eaa5b77ec4deaec28689
SHA512 d36d600103b58df99f1bcd3d39625ce4e5454927dec32c079f8ebe0959403dfb24ccb3dd524fb30ddc5cc836d2fd804de7e947fff154e84aab0bc99b67336786
SSDEEP 12288:R1XLsswWkxy2lRq2czAIvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:fXYfDtczA2Dhr1VibHHufeZ1H6IFrXQ
TLSH
T13C85012877E408F9EC67827DC9A1C501EA73B8954750E7CB03A49A651F333D85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 2935357df54b19c5ddfdb2966084492bfb9a081622986ebbb3295a943d9aa8ab
MD5 a077c3096224df98c89feb53615400c7
SHA1 65dd7841fb92c35bd54f873fe5db3b193c16d371
SHA512 611694350e58104a748c25a83fe9755dd1bf77c9abef865a168253dffa4cbbc15889256bc18c170b7dec51df096b5c466dadff718ce5b9930a2e11655ca2de2e
SSDEEP 24576:30Le5ji0hmxqrMLDhr1VibHHufeZ1H6IFrXQ:3Pji0AcA3Vibn7ZB98
TLSH
T17D95AE15F6748375D073C0B9C5D2A68AED7230865B308ACB4286D77C3E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 149f772975dcc078bb161a2a955b7c30476997cf6283d45ce94cd31b1b257796
MD5 3e41b03c22ee888cbe2a9b74e5e27fbb
SHA1 2b2ace37c793be61d6416062c05ad6290bac0c15
SHA512 9152a2bbc76f9cc16d5b6f43362479d917ad3a869ae62b2aa590233efdb8d74eced34dc56f2e1b72b61bef7f45386447e9edad12781ab0a0db4555f3f5c2891a
SSDEEP 24576:aa7/ezSC6vUyD/aqgrvWr6q8wyuxDhr1VibHHufeZ1H6IFrXQ:N/ezSC6vUzPviHjyU3Vibn7ZB98
TLSH
T1B5755C15F5788323D0B2D0BAC5D6BA99FE7230865B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 0c3eeb6b25f78e9463f295b4bb72866b06eb587517bd3450a373be87cdd969f6
MD5 326a88e7433f219c40ed602a6ce6d86f
SHA1 e50158b3f789ce271cc8ff62894cbd99fcc584b3
SHA512 7f0f68e41ee77199257663fda104eeba54774039d2efc59464f3d2794835e162a4380bbc3b2bb0fd8d6b06be4797c6a1ad92436e44a62d63495d32660142f28f
SSDEEP 24576:kVbqPb88hv/l+byDhr1VibHHufeZ1H6IFrXQ:kVO88hXl+u3Vibn7ZB98
TLSH
T163559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 6fc7f85992dae121c8b0040372e2a18f8a8016e065f92f7b024d2a39f7b36c72
MD5 779ff72e8015cfe63db56d2ec3b96cdd
SHA1 8588442ae80996827f96eaeb2985633ee78719b1
SHA512 1d279092b35f6dc37ed57fc4303d241e897d84390a25b48cab2d7bd44544e1ef741a3b5152e5e0ba6ad48b80386eaf9fbd0194dda726cd6b1f234eb38ec1b6c8
SSDEEP 12288:XMBvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:XMHDhr1VibHHufeZ1H6IFrXQ
TLSH
T1BB652318BB68B0D5FDD70B71B3ECEB40FD67FDD8480A1686C325BA9024352E8D6152A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 55eb6b38b66ad74d0eb28af378bc2737c26b64fe60b22887a71732a93f57d5c8
MD5 7741ce7f1aaf553766e7afbd13edafa5
SHA1 8c698ae9cbfd27ae1c4c0fedd5c2e20f9ef49501
SHA512 26dfe6c06008348eea7df24f48a72251f7b0c14334b2630897fb9cc46f64092c01afe62eb0c4b9d7b0cb85b92d145170f8fbbd15dfe4c1935be9a8b48914f8d7
SSDEEP 12288:ZeBNUbTVO86UMvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:ZJIU6Dhr1VibHHufeZ1H6IFrXQ
TLSH
T17085CF3BEE28FCE2C67A4DB95791C600E77278704F12A3CBD165820E9E235E45E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 91141bfe652f78dd6e81ecac740625bd39dd873cd53ea7696171c0fb3b40bd51
MD5 300bee40ec0cb748d01dcce1e5a1cbd1
SHA1 b1ce66d9ebcd63d8ee2be6f0ed6f5ed9ef428164
SHA512 c19497a7838c9bba1cf42e38c363a1424c363f9216699e3623affb7b555b48898349851146b4b0850dfb3021ac3eb6f39535f255b6c2cd763207d32b579e103e
SSDEEP 49152:2QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3TH6:2QvGAdlCEL8c/RRNw5CBVibn7P9
TLSH
T17F266D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 4243b4d0a90b325bda22bada4754cc7fcd3c1cc1fb804cc9b85ae1b33ff2d105
MD5 17e37c096b81643274a0032e392767d5
SHA1 6bd2b310a4f553ddce95066f31ccf3b3625cd34f
SHA512 ff81a84b6cd4c55e1ac6a79f8ca65ddf02208bbde6eacec12b8f76c130e49a0788a2433aaf26a807bcf866dd54009c997ca53201a287489407568aa9a04d9a4f
SSDEEP 12288:IAwSfxL/2Dc3+DLLmt0LDQewsAjyvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGv:trewsAjwDhr1VibHHufeZ1H6IFrXQ
TLSH
T1E385E031FE74E036C6BB0DB21B35D706687DB9604F511AC3E3A88E9D59302D22776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2ce6d3ba37a57ad4280faf93109a4d1d4601e60416df25be17e6b67863e422d1
MD5 d5d2c61ed02b25355976cb1cf6910dd8
SHA1 00de1a4dc4ad288b30082dfa698391f596941e49
SHA512 6ff4c3c04fbc8697f64506c7b47105a97acb246cab09591c099b7fa822bd3c35f4ad4f7d1dd94166335a566f59ce3d6e64db5a7d2e7b6bd296b2e746a0d880e0
SSDEEP 196608:EUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHaif:EUEtQevvqc2W1cpV2RI32aif
TLSH
T151474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 558dd8e1c4bbb2c8a7046a6dfd4b72a76650ade44721775e2493c9c1476308fb
MD5 f121f3f19ba62e8ed7b39e665342c00d
SHA1 7c9b72e1dde4a1aa58e50ebc8a1efa3aaabfee98
SHA512 32c271355ca1247de1c9544d0c375993626ff8386c5f1f3c82e63972ca476110f81b1d6bb7ecd07e7b73434424358d880df13613392c1e9e6c9909a0937b4955
SSDEEP 49152:VCbRquA/m2yL5zQfFiV+XenmE3/zQ3Vibn7ZB98:CoqtVjnmNVibn7P9
TLSH
T1B9D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 11803af70b0bb1c99fec250f1f6a4bebb9d4caefa1771d32dcac9c30b39d3039
MD5 078f915562dac6aace88207c002556ae
SHA1 dd088f2f671e47abd999e5cdf5d38dfa5c0d4371
SHA512 ffb6e7bcd73bf20c6c95210d192fd0a79abf6013bc914861adb3d47870e0c0c82bc612986e3f1be45c555a6b02a52f66b357a86cf626f58de57885046afecb4e
SSDEEP 24576:pAhGL2IFoiwtA5l7S53VDhr1VibHHufeZ1H6IFrXQ:pAM1Foiq5l3Vibn7ZB98
TLSH
T160359D80E7F955D4F5F3AA7899B69170EA76BCA95E31C20F2160C11F1E33A909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 f85cbb42891640892282e52f6c529bbb7b84b35ec9dbcf639672a3da4623396a
MD5 cfca2ab035c01038b175b57f8a21ca75
SHA1 80074ace6c433b56b17e4ad188d612c872e34457
SHA512 e6c3c3dc12cb1eefb6ba665e5ac446e9ca6a6d66297795f90c80512ace2a88fd5b3fd62f6d7ab9deffe6c5a96bcda7b878be96111b582806c51a0dab4002c8db
SSDEEP 12288:imw5HEjsChNDBFgl0WDm+Cjvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:7wu2OW0Dhr1VibHHufeZ1H6IFrXQ
TLSH
T1BC75F14977A41CF9E9A786398697C531FBB2BC412A25C70F0360C65B6F37360AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 43f76a880a22dec538c49d291b6d0307ca3f6263730d4737a3e39c551a758277
MD5 3b73f6a048e1cc2659fca48f52c5ffda
SHA1 f56c8ce7e0cc0f0ff253cbe3a0a3214b74f5a4de
SHA512 3a8d4ee7eb9248af52363aa38af2b5b5dba1e74d39d70492e54a27bc886c8d3538790a9b05d6fc15eb994d97e6265b3b158237df0ddd6edafbac6e4640b94b6f
SSDEEP 12288:lMZ1IyCvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:KZuzDhr1VibHHufeZ1H6IFrXQ
TLSH
T19E65125933A870F9E5E34739D6E49A40EB72B8E5172603CF032586A52E33BD55E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 af9cdb3c32ddb5a20f2de4f51ebec5b2d30c4e36a796cdee00e4479320a8c8f7
MD5 e3632643f29bab9c0ddc498f51689524
SHA1 6a693463fbcf304ec7a1cd7ed10d2c6d169dc499
SHA512 dc5312b405fd7d988da1ab17d14d615aa12da93ef967ccac5f677107a3f3077dded06a7809a8a95ade1f57dcb5d4a89bc03f4cc1bb31dde7cb5c0ff3e8bf0ab8
SSDEEP 98304:PQRQyi36YOcPhLvw2gAf+PN3EVibn7P9:+QyiKahX+PNoif
TLSH
T114667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 60c8f7189c4cc8a434a3f0bf8f168b009124fd7e176dcc075930534dee5d3c54
MD5 7c7bc30d5300377ab6c05e7eba348ff7
SHA1 5b439ef785e3abf1add0d5a6204a7a2ba098f8e8
SHA512 b52a4f2d9633927f8860cd03a5c7efc64a1cb06e2c591b5dc8d9599c733b9522244bca15e7b087ba15b15474465daf58ff43ce43dd5be802b4f7f5b0288c5213
SSDEEP 98304:bQRQyi36YOcPhLvw2gAf+PN3EVibn7P9:qQyiKahX+PNoif
TLSH
T112667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 65390d73db0339d9f71a6e5c5f61d5f4b78aff12356ef036f91bb14dfcc7a177
MD5 876c3f19ca90f587573c82a3f4a5c794
SHA1 d494e2ba2d5dbd7af3c1efbe57ee0d8a321049bc
SHA512 25d06f956cee12bdc04ad3a3fa0ae27ba3dcecac3e3b089afa073e7ed55e145979d919670b67647d445d30662955ab4a19c3d9851843a5ffd4958450893ca9b6
SSDEEP 24576:zwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0DDhr1VibHHufeZE:L68Qg55nhceWu7PNU3/A3Vibn7ZB98
TLSH
T119B55A33B2F600A9C44DE1769F4A872196D27C758FE1E3DB851172061BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 42e6bd5927f7fc03c3ea19b870d4d47609673d8d92a5c851cbe4737ddadfbfc2
MD5 5d85f7b1ee21b7b58f03f6d081dbad4c
SHA1 9e6b332df2946a84979bea6a22b69279a2f79cc1
SHA512 a09bab7eb726ecea2e5d29ba1854792400bd501853732e94fce1f284ee07b33269eda77e498b19c904bcfc44aad9b02f704b7652a721a0c8058286767a44c705
SSDEEP 98304:Hy5112gYy5azzVva69nLKnhZXVibn7P9:aLIHjWhzif
TLSH
T1D2167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c8a34af7ba483e3aa38f2a6ffdd4ba9a5a0c1eb60e089404353c2ee86f8e5d88
MD5 ac384ad063d5f29cab0f2a3252adb0c7
SHA1 b0dd9c9d8fa446ab209ef39b377a533f227ded9c
SHA512 af4aa5bdcfae5c8f7c27609bb2aa4ed62a44ac83a4b2d83319e2edbcacb662505acfee892a6b9d1aab6784a843b2ee977cd56bee9b080cc2b5b9e0055890e089
SSDEEP 49152:SB+taZ3usBWOBr4tEG20bqx0z+n217aau1glL3Vibn7ZB98:gu6JmUxd2djVibn7P9
TLSH
T154D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ce910ee74369978c029f3ca0aabbe2d8eb0cdba7bdd90c7e2d937354007af647
MD5 4e65d29b5453e45f2bff8ca60979d5e9
SHA1 d03cae9b34c31c5b004a4ae71eb19d867b040544
SHA512 5e485ca64e170c104dce760f5c0607ac76d76d2e59660e894ed937342bf96badd4b6a72a7b46aead6943472158df1d45a9b6b599c2ab82d1606c83063d15d481
SSDEEP 49152:L1hpsNoJpF1A6BU44CwH7R4xa3Vibn7ZB98:LmifPkRNVibn7P9
TLSH
T153B5BE13F2D900E8D05ED178875A9232EA62BC450B35B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 808cedd1d46baffdc03f4ee2d9b26b141f3fc41bc76e63b7de19085227a78689
MD5 56613ba777edd8d69f9c492b83b5e91e
SHA1 0d0e77633eee6225288211e022883ca631e1e03b
SHA512 b6b3dd8af019f6ddb4564fdda1e62172607ac9c81891d3d65677bcf18bb6352565d74322fefd932ddc494a511658fdf1f5b890ee9576b3a8d9355011dbbd8aba
SSDEEP 49152:xSuZQIY0Be2KNRVtOnks6NMHqz3Vibn7ZB98:f5dKvi617Vibn7P9
TLSH
T16EC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c1fa2cc68f9db90f04ae612342eafdadb946e992df3fdbaa17038b26e5219188
MD5 7816ce4c2e06a51965ae7d39f753af72
SHA1 59d2e6aebda9eb20ab0e37f2b71f059049a26f80
SHA512 34235d3671e5c9a065ebad2d2fa947021556eb47774027bfc3d9499aa803403593fd7baf1756f999fc9dd2a8a239ec32e54c4bddab11764db0c6b36e3292987b
SSDEEP 49152:+htSn8EApI0figXgiDn0AP5w23Vibn7ZB98:fX2iyphpVibn7P9
TLSH
T17795BE13F2D900E8D05ED178C7568632EA62BC150B39B6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 86dd741df979a23b72ed20445d4ed1e61ea219efc93d530b2a44d1644049a986
MD5 d9c05495f9c0a05e0b7c64f203b6abc5
SHA1 d21b470bcccfd98f9e77b70bf18a2cb9fd9770b5
SHA512 6291ef240c565c9c207d096649b61a506aef7ffe4e0e425dabb59b38a3ed567a4c08bd750b9542eab5ad8b8bfc5dc2854b4ad20bf61c631f8f8449f1ba3e2cfd
SSDEEP 12288:TZvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:TvDhr1VibHHufeZ1H6IFrXQ
TLSH
T1B265231CBA79B1D5F8C34BB1E3ECA780FD57BDDC580B128AD31A955030353E866192EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 5c2541e83d17b9cb5ee8d8bc6fec9fcbdf19f1ecccf011a8b510340eb50e620a
MD5 01cb9eb695b89476919efa3733631586
SHA1 7272556e04fd92c86bf216391f264f05b511154d
SHA512 2afa9a5f28c556ce98fd3c3ce76caf239f1bd1551ec67e91d98df4c8e27dcab6f426b3eb6e84f725dfdd393044f226aa307ee0a4465c4b8c05a9deb057ebefa9
SSDEEP 12288:vOvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:vMDhr1VibHHufeZ1H6IFrXQ
TLSH
T121652318BA79B1D5E8834BB1E3ECE780FD57BDDC680B128AD31A955030353E856192FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 221c807b66cf37768f90380d24bc8c66b56a075acbb9e565a42becdf76870aca
MD5 367421db73c3b921c38b72e4f16f3cb1
SHA1 88c7599ce89bd0cd2b7b97f56cbcfa170689c487
SHA512 45f8031328fea2e10fa5ab1254af1e2aa867e5136f8ff1a6c5d986aa245a225269b6b53afba6693ee6780c69290be0b75a2d297dc97f1b38d265280d08aa1be1
SSDEEP 12288:NEvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:NCDhr1VibHHufeZ1H6IFrXQ
TLSH
T1B3652318BA79B0D5F8C34BB1E3ECA780FD57BDDC680B128AD31A955034353E856192EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 3ca9eb43bc5bbf74b46e68c77d607bf25401de380d24382dcb45bf9cfaf2bac0
MD5 8308f8eef566f55d785f7b82ffa4288e
SHA1 574ff72846b33bfbdfd0f0be79260deafc5283a9
SHA512 a8e6446b7f50490512b8e9302c59b73365d6a7459e7441dbafb4a4c2304293f157dec503ac8da215e9572ab1ecc1e9185f4ea88633bda582f40ed1c80f94476b
SSDEEP 12288:hVHvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:BDhr1VibHHufeZ1H6IFrXQ
TLSH
T1DF6523187B7960D5ECD38775D3E9A640FEB7FCE8980613CF87114A5128313E86A387A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 affa8401b122f357ba3a690e3bcc9e0ddc30a55e02cb92456733df631fd012ff
MD5 49a86b038313173d3d8f501cfbbf6ebf
SHA1 3c94c2c5fec778e2cbd9ab1f42772359d391d9e5
SHA512 86dad5694bedda5cc3a8a60fee8fcbf61e441bd88a2492d87b36b00a53175725bd456ab0e1bad2c75c15f350ec3525c85b0b1e7b032f850ee27bd5b8f6a19286
SSDEEP 12288:6Pvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:6NDhr1VibHHufeZ1H6IFrXQ
TLSH
T161652318BA79B0D5F8C34BB1E3ECA780FD57BDDC680A128AD31A955030353E857192FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 23213cd3f67d0a47c6134b4699f3f28e72d05bc0e68eaab1a33c3c9b058e47a6
MD5 af9c170495356ff4471a1ee5b822fc94
SHA1 b750d505157fd53a7e6b2a402d50629383c92362
SHA512 fc5d86f6523511216ca88be03cbe2030597049a27a634a00cfeb98c922107cf2faeab341c067eebc9dbb1dbc1dc9037f581e9d42e792b954758bcf364c05fcbf
SSDEEP 12288:+Kvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:+4Dhr1VibHHufeZ1H6IFrXQ
TLSH
T17565231CBA79B1D5F8834B71E3ECE780FD57BDDC680B128A931A955030353E866192FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 54838b638e10d8ee9bb3c39f3e0406e834f892b40977ea40e62b49e3b7e66c2b
MD5 a55f5dbb65a2fc66b7e1aacefbd84560
SHA1 c3cc8671000343464ded12f7ce7789327bbc67ef
SHA512 3d2382aa8cb44a0df1aff40c17f5a7c82e25ee151caedfefb9b3666c49f423f70d7a4ef15504637bbfebe429242c75f5c879c93f86b1588cb6bd97b0c3bf9164
SSDEEP 12288:jWvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:jEDhr1VibHHufeZ1H6IFrXQ
TLSH
T1B065231CBA79B1D5E8834BB1E3DCEB80FD57BDDC580A128AD31A955030353F866192FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 f3b34e99410ad5bbb059de6702ccde6eb5e8f3a44f08e3e5fa1e5f470204c923
MD5 1cabc7b21545ee6ab4f1162a03621fd4
SHA1 c7523147cce0b5427d93f05fb481d669949ff113
SHA512 22e59d6633d4190faf886fe8f09211db9aaafafa445be0ac08614c6980afd4c8cd9a54ecd00e664f6d53a17a520b41c427b0017dea3862eb0b54dcfeebfaf51d
SSDEEP 12288:jiZwbrzzFEoS2cPvyuvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:OZM/zFVSOsDhr1VibHHufeZ1H6IFrXQ
TLSH
T1A1850295B36018F4ECA7823EC9559905E6B3BC990A60C64F03B436675F333E11D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 80eeadb3bdfb7dbbd972461904c649a48b7bae0785e074b3036fcd9439e5cd8c
MD5 9a087f768908d3402a6f259be8f01d5e
SHA1 82ee3226cb79b04fba57a1723145b3d5b10aecac
SHA512 9f5a80d536fa94edb7ade3b06eac1e80a96c538f81dde75871964acdade009923ef2b91ed7b78dc6ed7c77a4e1991c33a6d05a8395a55fe0b84a1e154f423c80
SSDEEP 12288:1Nvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:1jDhr1VibHHufeZ1H6IFrXQ
TLSH
T1A765231CBA79B0D5F8C30B71E3ECAB80FD57BDDC680B128AD31A955034357E856192EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 96e2723bbced9480db0ce3c684ff66abdf7414c700786fa38e1dffa29ec682b1
MD5 23ade28bc89bb199635bdbf5656612ca
SHA1 be7b226a0f78f2079fc250b2ff62b46287f7169f
SHA512 621920a1b6e718ad72ac080d844fe3df21c0b3c1eb997099c6f26c40c78ca89206811c41b4a1dc7f39f85b48b550c0a1426c7facdac0e81cfd4fde4dbc2b91b3
SSDEEP 12288:1Rvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:13Dhr1VibHHufeZ1H6IFrXQ
TLSH
T16965231CBA79B0D5E8834B71E3ECAB80FD57FDDC680B1286D31A955030353E856192FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 4b7ca1aa934f90c20b82e55adaa6a84cd06246d0d6d70ff6591c997a16b87500
MD5 a9ac2f1a133bd10aae287126bff33bac
SHA1 dda8e3ad122922f4a7c0f7dfe8afcc29c2ba04f8
SHA512 ab3f2e36dd7bc6f9aeb127cd837319b427aa925587ad65d753deda4f56e9a6cefdcc3b58f352288b40e88a0c1d0413711bf73bd3e0a1a5e04315f7e0da98e079
SSDEEP 12288:8yPz5L8Cvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:lzygDhr1VibHHufeZ1H6IFrXQ
TLSH
T1D675120B77A530F8E4678238C9A55A01FB72B8B50B154A9F536447762E333E09E3EB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 29b82468cd5d7fa583081b6a2e0ecb46f6154671badf59df3de1da17625a759c
MD5 a79709f0fc2dfc7c874957ef9e283ac1
SHA1 088b8690e32485ee5e5d2d739572cdaf2bac35e7
SHA512 4e97ac47352f22fe6914ba658b310e4cc182a28c53e38c16670d60108684554611e26aedc1d12c1e7d6639e1d2fc296bc7c948b887fca6e38d077c7f82af7bbb
SSDEEP 12288:HNvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:HjDhr1VibHHufeZ1H6IFrXQ
TLSH
T1D665231CBA79B0D5F8C30B71E3ECAB80FD57BDDD680B1286D31A955034353E856192EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 57a58258f7f60e4eb04077f5513ac2c224e50e84cf18da8c336d9620a603cf90
MD5 af71bae80f4056c7d2e4887315c60a3f
SHA1 a6f08da1c6bfc423ff433fbc2f875fcb634ce598
SHA512 dd863648039766a33f536d6cf4e93933024d9d55c1d1016a2ea28d2a4853b4d3e324d1e521196dca0065474ce9b785f4a7d5959c0451bb793459775ad8ecfa63
SSDEEP 12288:DNvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:DjDhr1VibHHufeZ1H6IFrXQ
TLSH
T1EE65231CBA79B0D5F8C30BB1E3ECAB80FD57BDDD680B1286D31A955034353E856192EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 0622bc2e2828a06916ab5de68cf4e9590705e49c42c024aecc91728963b26441
MD5 60b47fcdad5698eb5ce9f95828555f6f
SHA1 dd8ca3363d5a7dfc3b9e3b59a0e94eccfb7fc863
SHA512 3296bf55dd04b93e8fd5d09a974fab174a997c9476c8d333f587914dd0c820b7ccc113cdf4b77506b658ac1a0c544db78afb72e43b3731eca0a1cadc4cff04f7
SSDEEP 12288:DyPz5L8Cvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:uzygDhr1VibHHufeZ1H6IFrXQ
TLSH
T1B175020B77A530F8E4678238C9A55A01FB72B8B50B154A9F536447762E333E09E3EB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 ebf7fbd8bbc61c5a39f4295d2cf6352efeb2cdfdf6c542e3935bcfb5bb25e50e
MD5 c95daa037b6121f39dac8841829b51f9
SHA1 025a8ebbdf9885c067f518e3c028e0e20161ead2
SHA512 dfe73fccb554e2c2d33dfa7365499616ae21d053df696e2772a82e5bf38efd3a6ba0642b8fc77f82605f9763b5c48743ce8c1c25ff3462d4b33bcb9f91cb6614
SSDEEP 24576:2T0aLl3z0zDSDhr1VibHHufeZ1H6IFrXQ:2TDLljx3Vibn7ZB98
TLSH
T1D0850294B36018F8ECA7863EC9659905D6B37C990B60C65F03B436675F333A01D3DBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 5a446ea80202b048d5bf1a16cbfab8644d3592a2eea8d20b9a99652a3c423a69
MD5 5fcc5f566ed959e0f25d5821abb54ce5
SHA1 f28469c85f986b47a597fb564f26ca7044b04bec
SHA512 d128c802bfc7805e4f85197ad78acff9cc8a0851241f581cd7390cfa558b78e69cdca6fe1d6454699ed4cdc4d0303f03a23e1440c408193632cf8faffe8f10d2
SSDEEP 24576:u3Id9CHKy7GZ+Dhr1VibHHufeZ1H6IFrXQ:wId9CHKyao3Vibn7ZB98
TLSH
T15D95CF90F3E410E8F0B79A35C9769501DAB67C991B21DA8F03A4665A1F337D18E39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 51197ebddb58a60036b322320b68d341b67560a1ec8b79ee4ec7ad52e0c4b75d
MD5 a097d6d30a97bfffea60e36820029d75
SHA1 a3ede2306f4d1623ac20f43d3f09120430d52bbb
SHA512 0cb8e8f6a65fe75d1028d445a44fc8e18ded598121ad5a1b2a742056055792b48474f8a18d5c37eb54737acbd7274de837c9b8c69c7321fdfc51c5034d7f640d
SSDEEP 12288:Dkvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:DiDhr1VibHHufeZ1H6IFrXQ
TLSH
T1CF65231CBA79B0D5F8C34BB1E3ECA780FD57BDDC680B128AD31A955034353E856192EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 91fa6b9b913d48e2057812af1c8a58726324e37a757501c3b710f1ced77cef76
MD5 2fb5c4573c17e38252ec3ec15337aee5
SHA1 7963dc27eb45379d72322824932fd8f04330f10a
SHA512 10c12f740792af82cdba53527852225884241944b64a9d7ac949ea840e6c922e6bc91a212cc5e249c2fcca00690b292a6c9ca0e981168b41c635ca9e4aac956c
SSDEEP 12288:2ivt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:2ADhr1VibHHufeZ1H6IFrXQ
TLSH
T16565231CBA79B0E5F8834BB1E3ECEB80FD57BDDC580A128AD31A951034357E856152FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 da2fa82a7841f7a1d414288dc78421f6cdccc642fcdccce31c4f61179960c263
MD5 6bcecaac1404ad41da6eec709492e31e
SHA1 f0024715a5a7abd821161353680228104df7eee2
SHA512 b2079582e86e8b338ec9c4f7dd3a7a0ed405f17e6b871c514332696ed740378dd92ddad4d512f6a8254627383c016f7599fe741a26ee0bd37ed7661712d2c118
SSDEEP 12288:urvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:upDhr1VibHHufeZ1H6IFrXQ
TLSH
T139652318BA79B0D5E8C34B71E3ECEB80FD57BDDC680B128AD31A951034353E856192FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 5484654e25f2acbfed77812d0f4c6410784cbf3ac5e4f7275119bd9a375c1e3f
MD5 33d0f9ea9d2e546e73f1b51bd8e38688
SHA1 e4029d072780492a19a8fea40385e0d978ad9d5b
SHA512 7922004eb2b9c0b3c70fce36f78c8c879de466b4db19c241d6382c272bb9d7e48554687b0680dc75ab80a242e7e7be416c106727debea28f9865f9516f4d6045
SSDEEP 12288:CNvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:CjDhr1VibHHufeZ1H6IFrXQ
TLSH
T1C065231CBA79B0D5F8C30B71E3ECAB80FD57BDDD680B128AD31A955034353E856192EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 27df3895dde2efb2506283b60345dc9d7f2d9371cb1af655891acc9ac6d79c45
MD5 97685f47eb868b6eda34354f42c8269f
SHA1 6dc8ee1c174db83c4003f60f7ef43a0dc36ea782
SHA512 f97438c3f26febe8d19a3d6e13bc2a6d64c43665214236e64ae5bcc988a6392fbcc639d2229d62630db753e53d49eab53df64b310d3ec5dbf107fdab0984d793
SSDEEP 12288:fkvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:fiDhr1VibHHufeZ1H6IFrXQ
TLSH
T1A9652318BA79B0D5F8C34BB1E3ECA780FD57BDDC680B128AD31A955034353F856192EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 d16269ef52160a13aa3105cd175096d4384786bfbb928cc39cc41387e3af0964
MD5 d18a9c46db5a5c6c8501a8393ce05c33
SHA1 56a8eec222bb47f3a011325cb25acf47a967d03f
SHA512 00c9761e9b8ae31cf69a4749d71a65a0b701df4eda78ff0b962a6b4c6c9b7d0ce967fc6ad3e7ecb0f5de13f76c820ca9d6691485a6900f5db5ac6f2608dfc86e
SSDEEP 12288:41vt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:4bDhr1VibHHufeZ1H6IFrXQ
TLSH
T13165231CBA79B1D5E8C34BB1E3DCAB80FD57BDDC680B128AD316965030353E856192FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 803753dfcba6b751c9bea6feb75b1c9dff3918d6470b916dce543972cb983955
MD5 f1de53acf5d9c5fecfda619c61de80a2
SHA1 abc5875d26623be0e1b3efa18e997eecbf873764
SHA512 7dde3e3734e4dcb8b1d0e392a7f903de0c5019edb80a6aa6805a92e865d994a415b85c34095ff4dd09cf3641e81e43cdec4c7b4bb5408b660a5c2b36567f08b7
SSDEEP 12288:6Pvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:6NDhr1VibHHufeZ1H6IFrXQ
TLSH
T135652318BA79B0D5F8C34BB1E3ECA780FD57BDDC680B128AD31A955034353E857192EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 05de63e2cbfdc5effa644a75b1a4b6794d36cf129567997c4d2fde58bda91621
MD5 f31fe9ee5df59f3d3ef69a057d3db17b
SHA1 7f52e5a719aad8e53964fcf1d905d3161d012d7a
SHA512 67232882ed7596b00d0274c56a2a8c2bbe527b3ceaf0319737b035553e480798f9197dada5fd946b13614b9a52aa3ad11041b250849eaafdefa8f96df0956cfe
SSDEEP 24576:Kfwvik9RX6wkyAInDhr1VibHHufeZ1H6IFrXQ:UMnYIn3Vibn7ZB98
TLSH
T12195D029EBDC44E5E1B7923C99B7460AF6B178681B31C2CF025A53AD0E37ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 00dbd2dd8eff512decfe109ade7265a1d030874fb0a96871f764725c01b61580
MD5 d4231ddeedb26f349c2161683125d7e3
SHA1 e692c8c1b0aa4fdb2904cef7594519a404c44c91
SHA512 9e2fd111bc25ef70a229125584f8938dbb7773875c1b6721639cce4b34b3b96c13f76a17c2211d6f0faac2a790af7fd8ac1a00be33d8a4c3be0c09e679982773
SSDEEP 49152:vYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0W3Vibn7ZB98:JySzPkVibn7P9
TLSH
T1AB067C56A16801D5C1B9C1B98B0BCC1BFBB134490335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 27719d61e84a46ca6ea751cccc7f683697d01c9f69326b11fdb7ed5227882e22
MD5 94e01b5b147a2ceaf534f42b6fbba132
SHA1 360fd8e1f4f74fe288a1441854230394c73cff63
SHA512 8ce26b798c265e2837291a588abe31e2d1e6787ceadbaa01f3e7f5a48c13282b4883207ea23fc1ff4ea246577f87b1fbc1a45d9daa290c249ac925df88f7cbd3
SSDEEP 24576:W47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYcDhr1VibHHufeZ1H6IFrXQ:W47JUQj4irIhCnDHUPfF/G3Vibn7ZB98
TLSH
T1F065AE1DA3EC01E5E1BA927885158A5AEA71782D1F31CACF1270837D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 32040fc4b5fb622c47d14d18aae9e10f6fdbecc4c7743f564387e0ae10670125
MD5 4686782ae58b426881c9aeb2b0645c5d
SHA1 531bdd772f5f530dff4b22d95e4973fb97f006e0
SHA512 3604f62ee5d2266944ec7baa6178ed64ba8e07738d8f8e22dd2d5cd0e7e24d33618983f383032fcce25c92c57a0c5cfc52c704216c1ce879d023184a22b1c2f9
SSDEEP 12288:81sf9vt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:dzDhr1VibHHufeZ1H6IFrXQ
TLSH
T10575F009E2A812E8D0AF5275C3959A40F7237CA886E293CB53D0F53E1F362D45EE9753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 2ff3250be9f473ffbddab826e14c6c95d65a1ef71d855f3601b2e2227a78485a
MD5 1163effbc614bcf2bd10de97f6cb7899
SHA1 40fc97fa29fd842c8647575c614e7c752fdfb390
SHA512 bb40fc868d35ffa0566bd236a60653fb2c3c7bc8821a4d25a8cf06fe4d7a96a6032cecb662234612eb342c003a1c41941e6adc159c7b70c376d439123a86824d
SSDEEP 12288:Uv7lvt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:SrDhr1VibHHufeZ1H6IFrXQ
TLSH
T17C652318BB69B4D5F8E70B70A2ADE600BD1BFDE84F0541C7D315969034356E89E343AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1fc4aed5a48555d18ffa886fdb177fbc89677116fc8693a0c39975bcb281e25b
MD5 0dd17acaf081f4256311cb838a78963b
SHA1 918126d356a80662a9a5bc7e46820569f6ef8bd8
SHA512 4fa94d9263af0d023f69d7c80d0a94821c0bf379c839c78dc6d624748fe8126cee4a69cf2f861ecee6d648b2c323561e52d7df16e3985d6f45c97c9c42391d02
SSDEEP 24576:tgb6bmBIi49WNNFpg1rSvFv7bYxDhr1VibHHufeZ1H6IFrXQ:tgb4mBIBhGFc3Vibn7ZB98
TLSH
T1D8659E1E22EC02F5E0F6D2B8DDAA4417D6B278160731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 42306f8951f093c8a1b2133d82958806bc4de50b64222f64c9c1c8fcc7954249
MD5 526b15dd84644d214944ea4cecbf3b31
SHA1 4aee9eec8fda794c1cf9f4ff806b23decd2269e9
SHA512 293a6cd7215b3e289c232db860d07b74b6af845deae79930f9a148e6684d5a2a4dc1c231bce3c11a1dbb5b338aeb174a486408aeb0575f3213494eeb4ff68a00
SSDEEP 24576:DG88u8FpJqH1jzria7/msDhr1VibHHufeZ1H6IFrXQ:y7ZFPqV2a7/J3Vibn7ZB98
TLSH
T12F95F16577E101F0D477D1388A864663FAB2B8650364EBDF07A88B511F23BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 629f84a26e582b6a384230ae0089e94daa14a8225c40fbee1c39ae243a0e8822
MD5 de8204bb8237e732e57aafefce4b9f0d
SHA1 b04aadd848bb7a3d18e193afd7f73d636c1b153e
SHA512 b34c4aca9d56a608ed4feedfca81f3a276e180f88a70690983f11e83ee1cd50e121d97c6ee444fd88775ee99d8000042cec9d7ff10e9a092554f22ea1c9115a2
SSDEEP 12288:0HvUrBFrEjwaQavt/UGh37dPH1ibHDjufYtZxXfHQhYfRF4kGkXQR:0PUr+NQoDhr1VibHHufeZ1H6IFrXQ
TLSH
T1ED75F21F36AC18E5E677A17D85868709F772B4A5070292CF03A1817E1E27EE8BD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 21affa32758ead02895b855c9343a49d0e316f0d30e4f7b1a8f66702c14dd6b4
MD5 1c3a0deba2b3785fee439ed8e1bb5994
SHA1 ac2ffb2d2f06980e7a620cd9c0a8b5b869b2274a
SHA512 364bb9cd78341e59bc0f1cc52d8d15488eaf8e34f44aa82da48e12f401550aa7b62f281edff3468bd5c2fad13633ccd84d9608497c10dfdf0cf82ae07fe1085e
SSDEEP 49152:FBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj43Vibn7ZB98:OG05lO43b/Vibn7P9
TLSH
T10BD5C06E62EC11F9D0BBD17CDAC64A0BEBB23815032556CF02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c01b95669c788d73e02822c7409f46c4ddd7a2269d5407a96928ebfc8b38c669
MD5 d28848e24d26b3a643499348aa1de67f
SHA1 98b7203909550cebf39efce5eba3394423e552a1
SHA512 f9e242a24986ccc3e0c96d9fb7eee0388825d4c2f9a3f1af71f9790a5e8c89e2182ef8c253009eded01b1e7e6ec1c781b1952ff98d3e8aa7c6c0c24cd9f0860d
SSDEEP 24576:gfa5POZ3dpqWVM50JicR2hG0lasx2+47eidnWDhr1VibHHufeZ1H6IFrXQ:Ya5POZ39Jt2pasx2+mA3Vibn7ZB98
TLSH
T18465BF5EA6FC00D5D5B9D17DC583860AF5B1346553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 85098789b6a13066e6f99f7cdd32520e8faf49f5fe61c3ddbd1f6cd06d78ebd0
MD5 ff5fdff4f0d04477637b1961a8c668c8
SHA1 302be20da33c82d47c78aef1d2012ffef209bacb
SHA512 030bd10a41921d9923fd0a30713f060912071cace5a53b830336a353a253a295dcd28e382fb79c91ca2c45466f34df236684c54253e00bb00d3f8e2ef92f2fdc
SSDEEP 24576:QNcwHdjbyQ4nLC18lb/EOjowL7FkUDhr1VibHHufeZ1H6IFrXQ:QNc/zEOVHFp3Vibn7ZB98
TLSH
T12A858C1623E901E4F5BBE1BE89779646FA717869133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 58e7d86a20e10fe69e1d318fff8f8815e31a0efcb3a96182ebaa4721ab1e6143
MD5 0a102536ee05d2f5181fd3183ff0f8ca
SHA1 38d4c4e7f4d9a396dfcab32d57dfb295cea68997
SHA512 ba506219e953a6c61522638babfca8a56bd7b078e6bbe9ee22213fef74c3be0fd8c80d1a525c73c8feefc73d6770899b6d67bb9549539a7fdd1494dd78f67668
SSDEEP 24576:ZtkNvNnaFeYhJNtmZBmPDhr1VibHHufeZ1H6IFrXQ:ZtMwBtOmP3Vibn7ZB98
TLSH
T14755AF6EBAB845E4D1FAC6B5CE238512FA727461073253CB5390C13E1E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 0ee07408566ea7a823e081ee8d8bf54730aaa32809870e1c49627c609651a549
MD5 e2154bec5e022dd175791f87da14c7e7
SHA1 46d4b57e37a51728415e99c46497782af44c916c
SHA512 94d8d5f7ec8cb80ffae4d3b9019d294b06540a70ae07a286bbeb67c2141595b5832ff9b5f57a3cf8b8f04b571c4be5d25873d0e696423768cc2e642fc513f183
SSDEEP 24576:gD3FHshBIYQgAPDhr1VibHHufeZ1H6IFrXQ:gDVHeBIAAP3Vibn7ZB98
TLSH
T1A285E13DE66C04E4E47BD2BCD6638A06E77278ED032256CB029481B51F6BEE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1628-39-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1628-41-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1628-40-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1628-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1628-130-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1652-304-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/1652-89-0x0000000000950000-0x00000000009B7000-memory.dmp

Download

memory/1652-84-0x0000000000950000-0x00000000009B7000-memory.dmp

Download

memory/1652-83-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/2128-140-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2128-132-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2128-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2128-138-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2128-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2404-100-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2404-336-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2404-334-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2404-316-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2404-93-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2404-94-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2508-318-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/2508-119-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/2508-120-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2508-126-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2832-73-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2832-79-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2832-300-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/2832-71-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/3316-45-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/3316-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3316-52-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3316-66-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3316-68-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/4168-0-0x0000000000400000-0x0000000000522000-memory.dmp

Download

memory/4168-17-0x0000000000400000-0x0000000000522000-memory.dmp

Download

memory/4168-3-0x0000000000C40000-0x0000000000CA7000-memory.dmp

Download

memory/4168-8-0x0000000000C40000-0x0000000000CA7000-memory.dmp

Download

memory/4288-27-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4288-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4288-20-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4288-118-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4288-26-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4476-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4476-322-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4476-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4476-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4972-58-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4972-283-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/4972-64-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4972-56-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/6008-319-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/6008-321-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6008-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6008-106-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/6008-112-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/6008-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download