f08caa2db91fe60e473e5304bebc7a703abb238c51d3f119fd11156be15b8aad

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 23:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-28_0337a804177baac7bd50132c3c51aa7f_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Size 787KB
Sample260828-3cg25athpg
SHA256 f08caa2db91fe60e473e5304bebc7a703abb238c51d3f119fd11156be15b8aad
MD5 0337a804177baac7bd50132c3c51aa7f
SHA1 20a704650734e5b93a1b49bc4a86f95561d39834
SHA512 78372aeb398517e1de6e202905e9a79a6d2b49ab9729ef8778ad0c8b53054fa5361954631decd303dab27659ccbdc833a59cd01a512d81ce506d44dc3a1921fa
SSDEEP 12288:nr5A62A+xy4rvx+aFbYAhdPZUh4uUmZpM1j7+kU0I6S+1kxHBmO:nr5r+I4rvxLtBP2hLjU1jqnPH+1qHBm
TLSH
T17805021274D280F1E5B7493048F5AE715AFEF9310E359E7B27D8173E0E74192D22AAB2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
6088	alg.exe
5064	elevation_service.exe
4628	elevation_service.exe
372	maintenanceservice.exe
3388	OSE.EXE
4120	GameInputSvc.exe
5512	GameInputSvc.exe
5068	msdtc.exe
2192	PerceptionSimulationService.exe
5996	perfhost.exe
1104	ReFsDedupSvc.exe
364	locator.exe
4840	SensorDataService.exe
5268	snmptrap.exe
1828	ssh-agent.exe
5368	TieringEngineService.exe
4356	AgentService.exe
2312	vds.exe
4580	vssvc.exe
2332	wbengine.exe
4340	WmiApSrv.exe
3824	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-28_0337a804177baac7bd50132c3c51aa7f_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-28_0337a804177baac7bd50132c3c51aa7f_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\934bf2abc618523d.bin	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\javaw.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-28_0337a804177baac7bd50132c3c51aa7f_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 55 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5512	GameInputSvc.exe
5512	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3452	2026-08-28_0337a804177baac7bd50132c3c51aa7f_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	6088	alg.exe
Token: SeDebugPrivilege	6088	alg.exe
Token: SeTakeOwnershipPrivilege	5064	elevation_service.exe
Token: SeTcbPrivilege	4120	GameInputSvc.exe
Token: SeBackupPrivilege	1104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1104	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1104	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1104	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1104	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5368	TieringEngineService.exe
Token: SeManageVolumePrivilege	5368	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4356	AgentService.exe
Token: SeBackupPrivilege	4580	vssvc.exe
Token: SeRestorePrivilege	4580	vssvc.exe
Token: SeAuditPrivilege	4580	vssvc.exe
Token: SeBackupPrivilege	2332	wbengine.exe
Token: SeRestorePrivilege	2332	wbengine.exe
Token: SeSecurityPrivilege	2332	wbengine.exe
Token: 33	3824	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3824	SearchIndexer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 5512	4120	GameInputSvc.exe	98
PID 3824 wrote to memory of 1412	3824	SearchIndexer.exe	115

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-28_0337a804177baac7bd50132c3c51aa7f_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-28_0337a804177baac7bd50132c3c51aa7f_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3452

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:6088

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5064

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4628

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:372

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3384

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5512

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5068

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2192

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5996

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1104

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:364

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4840

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5268

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1828

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5368

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4356

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2312

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4580

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2332

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4340

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3824
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a4f38f2dceb20753508b306ac190c35258ff0016db0b7102265465841443f486
MD5 66fe1912ff49aa6801954a786f06f36b
SHA1 122779d2d18cc8fbb908f0eef65eedb61f955b5f
SHA512 a0561784ba584e3a3de445d673ef234d311a9eece24febceb81126a383c5aecdf55ad69d333cf5feb386125987bd05aa97a0ea8003912b15bad1ae00c0f2bfcd
SSDEEP 49152:7S8632BuPkFKRrdE6oh7stBhuXjfS4LWxncFUwnPHUWBm:y3q6gjBgwnPH78
TLSH
T112D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 ec1a729878159d47032132a124eb859c614b6388294aed14823147ccdc1224d3
MD5 7de740cf5ba2e63ba3f71bb78175a324
SHA1 db0387dd893d04cfcb73070f7ed9e32b8fd0f4b8
SHA512 098507100d21e8d13cb083f5c29aea19306e4c83822fff3d05bc6a02862bfec743d4a466a6c13e2e86f4cd13ba99b3c3bb891f474aeaf53eeea08733f8d7e887
SSDEEP 12288:71XLs2pclxp2lRq2czAMYAhdPZUh4uUmZpM1j7+kU0I6S+1kxHBmO:BXYEA8czAMBP2hLjU1jqnPH+1qHBm
TLSH
T1AF050229B79004F9EDA78138C8A28511EB73B8614774FB5707E4997A0F333985E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 e1dfcd1d0af95be16c5309bcbbfa813d684636c153bb5fc7448fd92f3e53af00
MD5 2752026a72c661894b144f8947eaa5ad
SHA1 418e55d0207c1a8fc7e6b48b88e7ce91d2d35c70
SHA512 c820bb474c5089548dea01c58d6844e97e9ccb315b805d7d1350faed1463791c92bd2ae0c508a3983e7ea081bea9ca0c5ccbab7c892a57d949333753d942e4c0
SSDEEP 24576:A0Je8DI0BSxOrMRBP2hLjU1jqnPH+1qHBm:AwDI00oBFUwnPHUWBm
TLSH
T1D445AE16F5748371D073C0B9C5D2A69EEE7230825B308ACB4286D77C6E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 fa8248c5e6b181357ac6112ddac9142874440bbcc23508700f0773eac929af2b
MD5 706d5106a471bc5123940e62eb82ac9a
SHA1 50be5176ea5b50fc36540ecf386a7a888ade5196
SHA512 16928098103b2273f6eb65a24c2b372bb2c5ea2a5d5484fbed61addb2667aac6d69f173cad6f242addf6553379d018eae4e9f1f3472e58bf7e702a5bb2a0a4e9
SSDEEP 24576:zgI/ezSC6vUyD/aqgrvW/6q8wyuPBP2hLjU1jqnPH+1qHBm:b/ezSC6vUzPvuHjyhFUwnPHUWBm
TLSH
T1D3756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 b849e660e49fb809a516216c602035eabb02cbe7ebecdfa2c907ac6ce1edb0f8
MD5 5c279e9ee3f1df343116d7ce975093f5
SHA1 bd95d590ee0593689e363bdbf1479ada4ac60c46
SHA512 0c70f21aa0a242eb576cb9f4a1b9def6f493c3f90bd72afb6a4420bd9cf19db619f205ac687a8b247cbaa18b437a46d05d2d72fb48011253347e912975e3f47c
SSDEEP 24576:WabHPCpADv/l+d7BP2hLjU1jqnPH+1qHBm:WaupADXl+uFUwnPHUWBm
TLSH
T180559E66F5748331D073C0B9C4D3AA9AEE7230425B318ACB1246D76C2E677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 4edcdedfd6f658a7bb460c80885018e81533fb2134643438febd1f7919df7650
MD5 e3f0b3f6d583815d2d78cde767364e01
SHA1 04145f0e9b9db41cca0f247d29d03c970dfe2d5b
SHA512 c36cc2d8e076c187af36be8c1c620bded8ab78d4e84356b2803e2fabacbae1056cabd84cd535335a292b7bea6cd65cdca14c3226de2d8f9165ba6c8eca97cd15
SSDEEP 12288:AigYAhdPZUh4uUmZpM1j7+kU0I6S+1kxHBmO:AigBP2hLjU1jqnPH+1qHBm
TLSH
T110D42397E81421E1FADAD430E0671F5546FBF531583E6E232E4876EA4CF412BE24B2C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 9e74023fccbd1cc2736967d4db86c632ca9885e39c1e344ec91e4c3b8476fd57
MD5 cc83eca95a83b46efdf701ec3730ecff
SHA1 fb9f8f4c7a85c5e107a6c6318b992cc7b3e6f7c5
SHA512 3473fbf1ec0f4e549379c8c16465282b3954624971ba5ce42276a95f27f40f8c19eafe8c6fa4b414e9f69412ac0e3a06b6916c7845c18e77a53233f30c4f371b
SSDEEP 12288:8eBNUbTVO86U0YAhdPZUh4uUmZpM1j7+kU0I6S+1kxHBmO:8JIU0BP2hLjU1jqnPH+1qHBm
TLSH
T1D415CF7BEE28FCE2C27E8C7856918700D7B2B4304B62A7C7D165824ECE235E55E7AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 017060568885210546f66b804818013790f9432ddb0b1c5ad6bf9893a49c2a46
MD5 842c2e70582d13ba83f19d6cb196daa2
SHA1 bd0db4203db8486151b622329aef36cdc6c0fd4c
SHA512 ff8c13b2f5430eb9891a211fb26b39a837c33b9613ddefdc5bad409c3e52bf1d6058e04cdb3474118371f13c370f0d4714ad50d0fec530f7df11aea6e8dc4a0f
SSDEEP 49152:jQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJ99DN5J8NRV3TH4:jQvGAdlCEL8c/9RNw5CpwnPH78
TLSH
T187367C656BF880F5E0A7E134897AC6B2F7B678520D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 d3cea82970bb2e70b1108d6320c88618b553d7273f3d0c860b0413cebd0b301b
MD5 403f616fb4b9fb190ac7d90d79058ba0
SHA1 857d2ea8465e0477b92b9fb247536b62e374a96c
SHA512 6134e85b4f381804f690201cdc1791f9e47be7d87302392b4086625edcd4c6538e26fda5293ca243b39d948098d8c0a6e9051024b1e4ce2bd46f62307173e156
SSDEEP 12288:dAwSfxL/2Dc3bDLLmt0LDQewsAjxNYAhdPZUh4uUmZpM1j7+kU0I6S+1kxHBmO:umewsAjPBP2hLjU1jqnPH+1qHBm
TLSH
T1CA15E031FE74E032D7BF0CB11B26D716147DB9204B621AC3E3A85E9E49702D26376A5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 fa385914c38b7b585de000a335eac28e853f6c8a43098119f24e5e9b5a4f4da9
MD5 12de6b46e3c96cbced1696737e5c9407
SHA1 3825bdc7557739ab65ad15e51f74a2189029ad7e
SHA512 a6d86d62fc2f2529c51bd6b8ce49948da25ae8ee1508ff209722a5d8e1f1a864fe4860689ce217e5dff59e35cda2723b8c323858c9e9e2172469a121e414b588
SSDEEP 196608:lUEtQeTbvf2zlO12sJTv6Ja1cpVLyXFldPlbuJHIEPHI:lUEtQevvqc2W1cpV2XF32IqH
TLSH
T131474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 07c2eae88a8979891270a6f931b5d1ca0b1f1e973a229717af61925b64439125
MD5 90d2d9433ab652312b7d59fb6548682f
SHA1 6bf1cf1b6cb6865776805d38386dab6ed17dce80
SHA512 e7bcb4ed9937325d995ac0b9ca4f9edcd0fe7eedba3198ab670828d9c51b6a7751c9e4fe27a98e8ef1fd4564fa338dae947b15c944a61b8ba620a1945b7a1028
SSDEEP 49152:aIbRquA/m2yL5zMfFiV+XenmE3/z+FUwnPHUWBm:Zoq1VjnmywnPH78
TLSH
T120D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0bfc05cb9f875f5a544ede7caeb42fb2596f1fe94f7c23ab5fd1a19b9c62c2d7
MD5 83b6626b8828552658c493dd0d650012
SHA1 eb07447e3bc10da9711e55e946bbd608ceed274e
SHA512 7bc20175878484f559e880ac9215c63497e38273f120deedbad32f3206170ed7d6b2a7e952968fb8f34f4e205bb92a8afeefcedd01abaeeb243a17088e115132
SSDEEP 24576:RAhGLvQFoiwtA5l7S53OBP2hLjU1jqnPH+1qHBm:RAMUFoiq51FUwnPHUWBm
TLSH
T14E45AD81EBF951D4F5F3AA7899B68570EAB6BCA65E31C20F2150D11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 3089c94d479ea2d66b445458e093d2b39b4f5f204a13f04c82acfb3e3654e299
MD5 aa99a2c2d4e49a71bda56090f18dd97a
SHA1 75864ca884e525173ab37431c45bb1287c1732f9
SHA512 70aa685894552e5573a15b05d4b97695734d6e8fabd006a0bbfdd08f6ad10fc87d9982f45a92c12548ef40d296b75ec99d18ce524a9d947a94546b14753077dd
SSDEEP 12288:Pmw5HEjsChNXBFgl0WDm+CTcYAhdPZUh4uUmZpM1j7+kU0I6S+1kxHBmO:uwuuOWIcBP2hLjU1jqnPH+1qHBm
TLSH
T17205014A76A41CF9E9A78138C0578536F7F3B8112A35DB1B1B60C65B5F33321AE2E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 679KB
SHA256 d94e088b8ee48fb13853b3a9d768b9a958374d5e35b5074a236aa6c51dde2a75
MD5 b48667bee51437d6c1932395f77d87cc
SHA1 8f5824acb996b32aa07f8a1d7e4a7c95148eabf9
SHA512 56ed4f4130060c536a1f7e469290f4a62f08fe25eec3ae1e976f132ad0b5de293d9082d00b429d949c432cd83bd4a3f8544a24e016426a20c029e5970964895b
SSDEEP 12288:Xep1ISxmYAhdPZUh4uUmZpM1j7+kU0I6S+1kxHBmO:upuHBP2hLjU1jqnPH+1qHBm
TLSH
T1D7E4128B366431F5E5D78138D8E21B05D7B3F032273657DF1A5802AA0F726D69E3A3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c4c31eb408119b3196e39f0dc595f0c7e154ef452752ab29af2fa706e924a3b2
MD5 b90649a3a829e854be9f9d2c21577099
SHA1 eb2a521a52c27d3433538eb68b84a6d581b3ca73
SHA512 af3786f760d2d7b9f2e989be53e64cd362bffc9a8f4c925c675336c99a4d7c48761e12aecd96e904e4d39d337b6b0a7c387374547d6586da9e66ee3fe7d4ef87
SSDEEP 49152:P7udh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Ur:UQRQyi36YOcP8Lvw2gAf+PN3HwnPH78
TLSH
T188667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a84653204b2b2b3590bfb6dec9173a0c84e8c995678d47d5cf6d1472407f9688
MD5 e87db30252b5b87f55beb1d8c661c0bd
SHA1 8e10a006bc5fafef297675b9428176c52539b8b3
SHA512 ed4624d7ed2c02e455cede56da4eb79c53089d1e0db4ecc142e3b57c0db41e0b756e9ee21bdc2eeca687ff77cd3e9c70df233c7d38a4a3ad828c86359a70d099
SSDEEP 49152:P7udh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Ul:UQRQyi36YOcP8Lvw2gAf+PN39wnPH78
TLSH
T10C667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 4ad8399435618389069c37730ba4490c1e09864f5d434dd462f25c3805b4786d
MD5 94e16e960ea684daedc4401eb10f8ef4
SHA1 4a0c7187d19c00486eb990da23a3025282b115ab
SHA512 2503ea66c6334793ddaeda955486331838a0e6f7ec941fe8087a812e4c0296ae4eec71859ef1c9793d5a06dfe7c01c1fcd3c7393d7a7d7729a6dc29d0c793e9f
SSDEEP 24576:cwvPrf6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0WBP2hLjU1jqnPHI:l68Qg55nhMeWu7PNU3/iFUwnPHUWBm
TLSH
T1D5B55A33B2F200A9C44DE1769F4A872196D27C718FE1E7DB850572161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 355363d703f0b2f7b12c80c4ba661d8c48ab2edaf446a7f6c269af1b5629cdd4
MD5 7162fa1376e00c682a4b48fbcb91e9c8
SHA1 bf73e36c5dc9e41307289a7f0ac970bebf6ea498
SHA512 d62de6946b7701a96d988266cdaedbd6daddcba027fe8147ab5502b5c18e7bfa553006e21e28cb43cc74acaa6200034d7a130be5acbf52a8a7995d1dd045cf4e
SSDEEP 49152:23aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99v:ny5112gYy5azzVv569nLKnhZuwnPH78
TLSH
T11A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 8ed5bb36b406fb40584ee6faf10c1ee9662cfd59d070afd7892a815df97770d6
MD5 f22246af6c169fa143fa8bf522be2dd1
SHA1 363b9ffe1dc2c26719adc48afc0781014561d938
SHA512 d92e543f5b53fd90cb601ff69d95141f98724002890078687e6a30dca5df94c9939439dd3b97ba3f62e6b6eb29b983a112e20e1187f8081f3f24c54d87812904
SSDEEP 49152:OI+taZ3usBWOBr4tEGp0bqx0z+n217aau1glrFUwnPHUWBm:du6JmTxd2dqwnPH78
TLSH
T15CD59D13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ef2ddf95f7c75391c364d13a116bd74b9d9032ec59202ee74071ea9cff2c15ed
MD5 d7904e6b3b173128f783b77d948cdeea
SHA1 0dad82f67df7fcc5b5ec6d2b17f32ee7ef1b51a5
SHA512 2eba92f9b4effa2efedc16f845445e6fa9c1b983f8f6e0489d04ac2670567165937e4a5e1d243c44cfac534d132c6c12fbe7ae86890f29efe78b9c2c06a54a7f
SSDEEP 49152:g1hpsNoJpF1A6UU44CwH7R4xOFUwnPHUWBm:gmifPbR4wnPH78
TLSH
T199B5BE13F29800E8D05ED17887569632EA72BC460B35B6DF0A90B7961F7BBE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2f1cf40ea02f9e2f936091dbfd8f3383b35398bada428538c2fe66186bfc5a9a
MD5 ba85c04f3df298b0e312ad7301f9a032
SHA1 13ee40b08d58e656324205fa1ca33e014bd9347e
SHA512 018da907c9c5674cba67426d643c52f848ea388c7eb7959037cfe35c66dd949829ed535b2d7852a704ffe35b5e8dba378429ed6c2d165361e06fe78cd3d3aef2
SSDEEP 49152:8SuZQIY0Be2K6RVtOnks6NMHqJFUwnPHUWBm:+5dKoi614wnPH78
TLSH
T18EC5BE03F2E901E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e140b1adc5a9af49d047966eb99d36c65a9182cc399897a1288820f286f9f597
MD5 1262713684b5ba59f72a3fd2bdf37c14
SHA1 461d623ba16f86f3269732f96c74f0f2a8f01d10
SHA512 7cb8b5bec3da955def23677961e057acab488a379f72e965da4621a5a914e5807ceb19f49e6b40130f1c1bfc2c4492f01f9973fc5be1e1518abb8e0b54fad3cc
SSDEEP 49152:c/4Sn8EApI0figTgiDn0AP5weFUwnPHUWBm:KX2iyphQwnPH78
TLSH
T116A5BE13F2D900E8D05ED174C7568632EA62BC150B39BAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 602KB
SHA256 2aa04b00e3f89a84b3c14fe4a9f8fdac9a42f20a02a4abc00b543fc8213dae87
MD5 ef0f1102f0015bb340a3d9b166a213ef
SHA1 6d056f73a9653d2eef558c5f6dfd95b8564993f8
SHA512 e1e8614340d3eb9f3153532d66b1519e0abf0da1a998dc20a7dfe95d6d27329f71a925f65fb3ae8ae54ada90b3f0dbfa19d2fdb0600f399b8e813dc37b35e380
SSDEEP 12288:SxKYAhdPZUh4uUmZpM1j7+kU0I6S+1kxHBmO:SxKBP2hLjU1jqnPH+1qHBm
TLSH
T1F4D4238BA81521E5F599D830D0671B5586FEF131683F6E333F4C15AA4DF422BA34B6C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 602KB
SHA256 ea3033924fe9f1bfa2159134c05dc14de37b91e3cf576d5bc8511dead7791040
MD5 f26450866cefaa05cb005aae7c8a7c90
SHA1 c8be8f37f313a0b951ab3d5830a43825ba46b467
SHA512 8079dfecdad0327637e68a6d4c1f46e7df729a7fc721aef4e5e780785ceca8d4115b373078178e8e65e85fd64ee26e08883e48aa47982a7bf12410ee8d67a24e
SSDEEP 12288:ayM0Uh2N7bxFsU3hKUgLJ+SCQLV024hwa3zPs+Ya5h2:ayXUhI7tFdW+K02pa3bj2
TLSH
T101D4231694F460B3CA33FC755776E3C51148EC24A7B2850CEAEA8B0D59991E02FF82E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 602KB
SHA256 a2466ae08e888f6afed9f272c80eb707f1114e27f0555ec89810a38cd08f08d0
MD5 aa245ae52055cca29c615407f14a847c
SHA1 a5fefdff0ce8a9fb647c367a83fc1c51ae96dc26
SHA512 0da99305a10fd5d72ba54879d207146bcd6d824a542ee183c4febb166c2ac8bfb8a46fa697aacd5d80769f61c583ab6678ea0d0feab4450c2be2075f010a958f
SSDEEP 12288:AdM0Uh2N7bxFsU3hKUgLJ+SCQLV024hwa3zPs+Ya5h2:AdXUhI7tFdW+K02pa3bj2
TLSH
T1BDD4231694F460B3CA32FC755777E3C55148E864A7B2850CE9EE8B0D99990E02FF82E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 623KB
SHA256 33cebcfdedfbd979bf928d55529319c1b665bdd3f0eea44ee68ee69621e72da2
MD5 ae60546e4288b4503f1d0194f60a363f
SHA1 b9350c38075ec6c0b244311f3bd4fcf125b11056
SHA512 beebd21a5f539a53e5a16f4ff4b7625d0351e1e5c5dc1bb11f51e25911b61dd9dc324aac28e0199052220915c914e662dc56cc029f8a7d6d8b70babb14509a94
SSDEEP 12288:qTlQgmM0Uh2N7bxFsU3hKUgLJ+SCQLV024hwa3zPs+Ya5h2:qfmXUhI7tFdW+K02pa3bj2
TLSH
T1C5D4221255B820F3C933FC388676E3959268FC64A772860EDAD54B090D652E06FF87E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 602KB
SHA256 104bf604d87a2d5ff5aefeaa1b8dea33afc3d98da9ce0854c053095615711b85
MD5 7a30802af7f89663f514bad80a2a3287
SHA1 b488e970debd3e4fc2e4df518414c4fe27859b01
SHA512 5105af2d52d8a405617faf64ede39c49d47b39b819e7b0633ca5a8a8e15bd38516c3963d3fe65e34e797a33703f26d00ccd0262e805d39a4845d0e52de07eec9
SSDEEP 12288:vr5tmM0Uh2N7bxFsU3hKUgLJ+SCQLV024hwa3zPs+Ya5h2:vr/mXUhI7tFdW+K02pa3bj2
TLSH
T1A9D4231694B460B3CA33FC755777E3D51148EC64A7B2850CEAEA8B0D59990E02FF82E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 602KB
SHA256 41474db0d25b4854f30c9b639303e87d99c0c0a20f4a447c36196a8b5724f2d5
MD5 6da8f9717cd5073cb3123eee4e0a3f59
SHA1 130700b945c1953e5c60389aba7eb27b44e40bd0
SHA512 7b1acd095eb32aaa7b8d9ee4283785c50b9379bbcafa6db3dbb16ae8ee98d647e56471f9212a6a82877f4d7a46e2ff7d264896e1bc6680cfccf5e2f991eb9495
SSDEEP 12288:cWM0Uh2N7bxFsU3hKUgLJ+SCQLV024hwa3zPs+Ya5h2:cWXUhI7tFdW+K02pa3bj2
TLSH
T12DD4231694F460B3CA33FC755777E3D51148EC24A7B2850CE9EA8B0999991E02FF82E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 602KB
SHA256 5897f7d139e8e61a3d6959d8825771b7d772dcc85003b863dcbaf71b22688d87
MD5 a9a7f535b173ba343d6d81dd62d7b7b8
SHA1 a9c754da47f9626404ae2c0666777b1137409d11
SHA512 afff4e14f1357e819875ec5e7529c4cdc29b28a056990a001de6f962e7928c3afd33705dce60a271185c6c8939f3bf3aad0143c6420dd2038eb823b127ae8f43
SSDEEP 12288:BY9M0Uh2N7bxFsU3hKUgLJ+SCQLV024hwa3zPs+Ya5h2:BY9XUhI7tFdW+K02pa3bj2
TLSH
T11AD4232694B46073CA33FC755776E3D51148EC64A7B2850CFAEA8B0D59990E02FF82E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 864KB
SHA256 a9c102f2d09316a15c9759b0e487e20ab64f124fafcdf9a471d30010e739d4a3
MD5 d1a7f1610e8aabe4b85ae0f5db74b3a6
SHA1 13a8ef342f3fb5e80d777defda96e2b3b33cf890
SHA512 d2df3246cb69fb7330e4c7482f12e2d3799e6030f493a2692e29a0057662af0decd4752841e05ce23b5dd2a5fe16a4c8a0fcf6d3b5a05edf74375a88cc1d901b
SSDEEP 12288:uiZwbP9zqcQSBcPvyjM0Uh2N7bxFsU3hKUgLJ+SCQLV024hwa3zPs+Ya5h2:RZMFzq1SNjXUhI7tFdW+K02pa3bj2
TLSH
T1B315F155B2A018F6DC63953EC926DB06D2B2BC190770C60F53E8272A5F333A11D6DBE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 602KB
SHA256 811250c75ce96291d3d0b1da44c5ae73d4764a0a4fef575ed7bf97a4a5cf2f21
MD5 25c51046deeef8cf7a64a9f4c67ea5c7
SHA1 292fe5d5d10aef81abc19720cb95836b101253b8
SHA512 346c6e123c49fe836c1b498435adb00fde61418f7c3d7b9c3e38723062b81b7f3441b5e26ec9af72267c145f1c41177b9566b23f928e175a5899d2b0a80cc992
SSDEEP 12288:ON9M0Uh2N7bxFsU3hKUgLJ+SCQLV024hwa3zPs+Ya5h2:ON9XUhI7tFdW+K02pa3bj2
TLSH
T136D4231694B420B3CA32FC795777E3D55148EC64A7B2850CE9EA8B0D59990E02FFC2E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 602KB
SHA256 1b83d96d73f7c3dab55ee4dd11feb518f3b70be363703a69f9bbe7b5a0e6808d
MD5 b921703235409f1414dead230e27ad58
SHA1 fd67c84ac47eea9ff28c901a12f49a61368817db
SHA512 67fde17d157ba5348af36266b116c3f6f9a4d80d58e7a5c0c0141bae5e578c1f9bcd599679ad608a32a6372d0d598bb8edfd85d004a36692964f90a3ae349fe0
SSDEEP 12288:g4M0Uh2N7bxFsU3hKUgLJ+SCQLV024hwa3zPs+Ya5h2:g4XUhI7tFdW+K02pa3bj2
TLSH
T169D4231694B460B3CA33FC755777E3C55148EC24A7B2850CE9EA8B0D99991E02FF82E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 740KB
SHA256 7faefb83f5be6c47d4837acd7b5462c0ac4b441696a7d1741d1674383c418970
MD5 73765aeab263a9c34dcd4ff4942f30cc
SHA1 f80aff3173e3e535168d12064a946a767ec8ebaf
SHA512 f7648aabea482eefe8e5a3feff6fedd57bb0509191a3a0545c10a03858b2efba9a717aa9b2b2c489455565dc0f8721370824f5746226d52079707101757573f8
SSDEEP 12288:/TPz5L80M0Uh2N7bxFsU3hKUgLJ+SCQLV024hwa3zPs+Ya5h2:Dzy0XUhI7tFdW+K02pa3bj2
TLSH
T178F4011762B030FBC133E53889729B42A375F83547708A5F97A4473A1E272E05E7A7E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 602KB
SHA256 08702a47890d495d4b4c5a450e8d7ca0cc7417eac5819d786a08fbc4ee14b6b5
MD5 064f493e76d53c33b15484b66aced0e8
SHA1 ffc9127d12168efeb23ccfe463b645d4149594ca
SHA512 c6073916f350e15645b6098855b78d2ca638d2d054a27f121fc59609023f5df66feeee8c87d03bd42566a92f05f24c34f7c7410932b99039d56c515a69beb822
SSDEEP 12288:2DM0Uh2N7bxFsU3hKUgLJ+SCQLV024hwa3zPs+Ya5h2:2DXUhI7tFdW+K02pa3bj2
TLSH
T1BFD4231694F460B3CA32FC795777E3D51148EC64A7B2850CE9EA8B0D59990E02FF82E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 602KB
SHA256 062a519701991af3fce41c8c01351fecd24a26c946b23baee297a945d24be878
MD5 db2fb46d95d8f58d54afd65bfb3dc611
SHA1 7813b7da56ae61082cbf1d7c7d57857551d04001
SHA512 080ffb51a8832e1243e1c0df4864add6c2107dca7523498b29b4e289a5ce76da76a10d5f4a0b73f1c9a3aae3aa2648e6ed5d7a1be89ff9e702d169ec40897d16
SSDEEP 12288:a3M0Uh2N7bxFsU3hKUgLJ+SCQLV024hwa3zPs+Ya5h2:a3XUhI7tFdW+K02pa3bj2
TLSH
T1C6D4231694B460B3CA32FC755777E3C51148EC65A7B2850CEAEA8B0D59990E02FFC2E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 740KB
SHA256 46af2875c4d65a97067ba19660d78ac3e37b06619d01a43611204a170a50e931
MD5 4f14fa1a627da5832c44e3300b09bd38
SHA1 a870e26ae36a1b5dab999a19e5d6af21329dcba0
SHA512 89a335e58016fdae33fd9c482acf478680f095a747fd8a60e54467776cbf10cd7436ec8cfb3e814ae77d683e8fdb3c19bac4abf95294cca278db51a55d2d5150
SSDEEP 12288:ZVWPiGL1dGzIGr4Gv16g81ZPyMCMmeOWES9Hfy8ivLmKdxZFexBek+j:ZEiOi34sv81ZPfJX/r8xZFgBekA
TLSH
T104F4121336A530F9C57A8179CC652A12F7B2B8364B359B7F636402362F236916D3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 863KB
SHA256 1cece1d7729e602ccbc3818a51439600771cfaee06fb8aa0774ac7dc6528a3ca
MD5 eec436aeece6ae7cdae1cf49bb308d96
SHA1 2ff8f3afc593c0d634ae67e901340676725e260e
SHA512 4b9e2efd5dec9408ef406a1c8d2b826a4356d83f6bbf9d67d7fa4eba0240d524326a8701677f6293914d14952ae57eda25ce08127054e5a7c37fecd085a09ace
SSDEEP 24576:KTXaLf3z0zz034sv81ZPfJX/r8xZFgBekA:KTqLfjP3ePNrD0
TLSH
T1BB1501A077A018F8DD67817ECD659916D6B2BC5A0A70C72F13A436271F333611C3DBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 3372484328d8097693d9348d51cb4bcbe32c1051c1ef81ac064f48038b52049a
MD5 a1ebdb283d2b389e5bcda4c69cb07cee
SHA1 00d984e016a083eb532c2191be792ccc05fbc854
SHA512 91158791d3bc95e08843be426d26832194b47cb81c91d98b979e2c4d8bc58ae62c6acae31809f10d69b26dd8d5250e804dee998eeb7e807cd4e858ffcfb3eb5a
SSDEEP 24576:T37dmCHXy7/iUm34sv81ZPfJX/r8xZFgBekA:z7dmCHXyjk3ePNrD0
TLSH
T1C335CF90B7E414E4F1B78A35CD769512DAB6BC5A1B31DE8F03A4251A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 602KB
SHA256 2c9527cf4e23e292f7f3feb2ae99b33450b0637af00c33dc3d5c8ff079948afc
MD5 ad307d5c89c27919d5d8df375ac8970b
SHA1 b09f9db641f3f2559f2fb732b97c19095c3a2e19
SHA512 1f7ebc6598d42edc72b3db593909b9ae148f4a8ae5667b9a853629f98e6c1172bb0dd74022cdb764d7adb1a016b769e222f3515c69fd084b1c5437eb36d9fecf
SSDEEP 12288:b5GzIGr4Gv16g81ZPyMCMmeOWES9Hfy8ivLmKdxZFexBek+j:bG34sv81ZPfJX/r8xZFgBekA
TLSH
T191D423102CF915A1CB5980F7FC5CBB668BF6E946A97BB77FF704200237654893878069
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 602KB
SHA256 5e322510456e01933cd2082c7d9f0b1f58aa7ce9cc5dc46c2ca70ccf61d78bad
MD5 d8bc4a0765f4e72bc063d06c19864d08
SHA1 d6f0a141ca824d31d2804ec25b37bc8cbd47ef01
SHA512 0e8983941776f01398cff22f68972cb68684fcafa45cbf6d83a3217a54bef4c329c0c0700542c4e26ebcbd3f330d2b833aec3f1bfb449befd0b72f856d1860a7
SSDEEP 12288:hdGzIGr4Gv16g81ZPyMCMmeOWES9Hfy8ivLmKdxZFexBek+j:hi34sv81ZPfJX/r8xZFgBekA
TLSH
T19ED423202CF515A1CB1980F7FC5CBB568BF6E946A57BFB7FF7042006376548A2878069
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 602KB
SHA256 723ebb9e6643ec86011ea0529ab35dbc4c2fffb0bfa9b6074b286c92a040cdbc
MD5 8a6b2e2e323f7c88bf036593f0a7354d
SHA1 577119e266d6994c2fa309c614f5e04cff894203
SHA512 c1a96b493baace776039b8f6c023da5bda0d2bab6d78a67701889efe1075575a5859d873cece7e97b9505b95ff390616dcdae0cebd50b807bd2832077ad63aee
SSDEEP 12288:QDGzIGr4Gv16g81ZPyMCMmeOWES9Hfy8ivLmKdxZFexBek+j:QQ34sv81ZPfJX/r8xZFgBekA
TLSH
T142D423202CB516A1CB5880F7FC58BB658BF6E946A5BBF77FF7052002376548A3878069
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 602KB
SHA256 1c123a8cb17184536a800f9a481628c095c3f7c7d2cb4bd59d060f30ba1eb04f
MD5 1100643815640e785ad1ac7cb369c750
SHA1 67a3325818bb61bd912e2485d01e2c0139aa6fe7
SHA512 110616621d7f3d4450d7342ef9f6b792cfe4a24d51b75f60fdad0ea805f2e8605b909d39c76b5f10561d0c3b0f23284559c1e07117cf92dae20ebcf03a2a78c1
SSDEEP 12288:zXGzIGr4Gv16g81ZPyMCMmeOWES9Hfy8ivLmKdxZFexBek+j:zM34sv81ZPfJX/r8xZFgBekA
TLSH
T163D423202CB516A1CB5980F7FC5CBB558BF6E946A5BBF77FF7082002376548A3878069
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 46e8fffdf60b296ee850605d4454438dc9d91a81ddb0c27168f69a94cd3bfe7f
MD5 79ee2084fae8d3030c7a3c0cf0d8cb83
SHA1 0398181afbf27e7b5d1551b236e33b3de98d4cab
SHA512 24074224dbeaf0989ea396cb7dda2c665af09ca1fb8f5627a65c080a0e6f49c3b5b8f3c23362260ecd4443309447e0119f47ce2614588e672cd631ed4b6992d5
SSDEEP 12288:pWMsfuYAhdPZUh4uUmZpM1j7+kU0I6S+1kxHBmO:0LuBP2hLjU1jqnPH+1qHBm
TLSH
T1C8F4014AD25412E8D0AEA134C7520A41B377BC3196F2E78B2BC0F57E0FB52559EDA783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 9ded149e9a90d2bd73d52b2daacad6fab1df31cc06d04fd09dda45829bb27cdc
MD5 51163cde2ac9cf528cb25661e1be933e
SHA1 a5051cdecbfc8492c75376ac31608161b1e2e766
SHA512 7a0728f2babc73629f6eb196009999396886d3d619146d5d5961a68d45351950ffd3babd0d80f1f10b7e7f2a3e302e048f62a47ec08cf66e2e98e85131e50b24
SSDEEP 12288:sC7xYAhdPZUh4uUmZpM1j7+kU0I6S+1kxHBmO:PxBP2hLjU1jqnPH+1qHBm
TLSH
T100D42357E91421E1F9EDD83090271B2556BFF2315E3A9E633E0C22EA4CB021AD65B7CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 85f7c7bb111c670ddd18d754b8d48676dbe0cdd36f4ae578fb3bbb7b5528ab47
MD5 59f3565baf6a1172f3ff59f9046ab17d
SHA1 15cf481be18ae2165009ca9ba28a66d9586b9702
SHA512 c75632e6b25980a64b8f8ae97d89d110c6e7e68e8409043ff455214254e01b2a0bed557d298f8f407039810ec3f16d30c2bcf8f3bf0450108118bf6d5db3346e
SSDEEP 24576:Ogb6bmBIi49WNNFpg1rSvFv7bYVVeR/g9BWdhUueY29YJIj:Ogb4mBIBhGFaDYAYGYw
TLSH
T15765AE1E22EC02F5E0F9E2B8DDA64417D6B278160731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 5b1a4764429d98d35bbb69cd5072b6c6e29e4901a7f81f29ff0c101ae6b10921
MD5 1e927c149237cbfc1fb6acb04c7d61ad
SHA1 63d9ff6e41c8ebb0b7044c3028205c4c330dcdd2
SHA512 de55767f22af6a41bd6c48874885bf44e737a258b6a89e957a7570e4f6212501c69547f5498f44394523cb7d115ca4767d330be55d8e01d28cec34731986d0bf
SSDEEP 12288:pHGYYAhdPZUh4uUmZpM1j7+kU0I6S+1kxHBmO:BGYBP2hLjU1jqnPH+1qHBm
TLSH
T1F1E4235F746130E4D97AC530D0631A1675B6B1305B392AFF1EC891BA8FB41E5A33AEC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 9a35c60cc9f4a03cf86ca48b5ee4472791d8d43dc02b3fa022b7e3a884d94806
MD5 3c0c409e38968c5842283f5c34ad7c32
SHA1 9cbc634d84f429ee293eb725d094499eb2633b09
SHA512 72a59197b6756dd629af92c0d0117b766534d21856bdcbaec37f7a3bc76a2b98fcdbff233f8e61501c7559363ca69b08e1502fe29cb2a9aa67ee20dccab8571f
SSDEEP 12288:VF2YAhdPZUh4uUmZpM1j7+kU0I6S+1kxHBmO:VF2BP2hLjU1jqnPH+1qHBm
TLSH
T14CD4238BA41521E1F9D9D83090531F1546AAF1316B3B6FF33E4C11AA49F41EBA37B6C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 4e8c523284284676b2d139d5985a747de789c954d0720ea475ea4b4459ebf02a
MD5 4954d22ea09e0f875eebbf1e233c07f6
SHA1 f1977a9a0dbd05f3b61a33f70b19a369051293a5
SHA512 cde4c5babfe1a71028fc43ad0dea7f04f9211cdb864839d8e460672baa191be5e2f7cfae4cd4d797d99dba905685ac1ba9f28aa5bfdeb3794009f645743ca409
SSDEEP 24576:W/I8j+8pJqH1Mzria7/mfVeR/g9BWdhUueY29YJIj:M3S8PqVra7/MDYAYGYw
TLSH
T1CE35F16677E101F4D477D138898246A7F6B1B8211364EBDF0BA88B511F23AE14B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 00336355fe8ba405f2f387e1fbc2e5f5182606fbbd4f844f6da3ef020ba95bbc
MD5 64cb7e151a508800a66d7f7951982a50
SHA1 869474f56b124431209a4ade0937ca59c67df0b7
SHA512 aa37c41b213de1a94046eba7ab90581c934fbf2bc848fb6474445b6f9d3351edd9a8390df5e8a7589638420ce41713cce9dca8ec9c986a343604951c76d2dc3d
SSDEEP 12288:HHvUrBFrEjwaQmYAhdPZUh4uUmZpM1j7+kU0I6S+1kxHBmO:HPUr+NQmBP2hLjU1jqnPH+1qHBm
TLSH
T1F105F12F65A818E5F67AE03CC5824709E772B462171296DF06D0817E4F73AE8BD3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 5de2bd94bf3a67d746846744a19fe6d8794017872d6c526ea9c3a833bccddc8e
MD5 c648504b39a8bd05b6c1eb548eb9b791
SHA1 90accd6d39c0f4b410659980a112c31e6b9b61a7
SHA512 d05900c2d6fcb7a57e1125f671f0ce72f00fd4f9901cd079e4fe484a543e21307de92174c40cbe8fa22737e17d8963a423eabe9088bf97647653ece0afa19fd1
SSDEEP 49152:WBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjaFUwnPHUWBm:5G05lO43b4wnPH78
TLSH
T1E4D5C06E62EC11F9D1BBD07CD9C64A0BEBB23425033556CB02A486A91F27FF4967E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 42ee494daf49d384a9ea5aafd1935d29f27fce711f3b4fbbad2dbc9e10b938d0
MD5 6b7f564ab6d8e2f1ee148dd8a95cfaba
SHA1 0801b5ca46523afd2eba7668a31f3a6c861f4ab1
SHA512 1c69685e2ced0a731b81dd06f41586c1c699e41ebefc55bd36d94f20a7162f76d45f725e3b47def91c9e031dfe7181a4eaa45f3232ddccbccbbb73e7fc93bb10
SSDEEP 24576:01a5POZ3dpbWVM50JicR2hG0lasx2+47eidnqVeR/g9BWdhUueY29YJIj:ua5POZ3wJt2pasx2+mMDYAYGYw
TLSH
T18465BF5EA6FC01D4E5B9D17DC583461AF5B1342153329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 af2fd7e22893cd5ee8efa79a2ca655b693123753174a306af272283e864f1f95
MD5 f2a266407060cbbfa94ab7635f4fca33
SHA1 011624bbf24332802fc6b29eb19905fea5e8dbec
SHA512 cad199b567694c37c489ec5bb8f5018db1c0536005eb2b360eba7c64ae83171a5121c4d194c74e29cddf3e54eee064a9e510af725e44759bf054710201464c97
SSDEEP 24576:HNcwHdjbyQ4nLC18lb/EOjowL7FkuBP2hLjU1jqnPH+1qHBm:HNc/zEOVHFgFUwnPHUWBm
TLSH
T1C7858C1622E901E4F5BBE1BE89779946FAB1786513348ACF0291811F1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 41efa415e3e74fdb4bd998d658bfc333c27e1f5f8af1eda6057b24d4e1452e47
MD5 40ca5a05971d948a92a0e439f7bce49d
SHA1 a4c6aa97afa3bd753db2f0b82f228fd0b981ca38
SHA512 899c445e5b35fe42e5b4d4dcf74c2dbae2529192929c37d634d00c0f4a381725468167ad16551789459484f6ff2abb7220628d1f339866fa1802f42c044762f6
SSDEEP 12288:fIHPJnJP6szeCs6Rl28d3JDfe3YiyC/g9iQWdh1eueYQce/E8YO2NonQHFylyIBt:6JnJPbzB4S3VeR/g9BWdhUueY29YJIj
TLSH
T18415E13DD29810E8E4B7C2B4815A179AFE71387D2F2569C729B4D5343F12EE0A939F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 1ae0c7b1979c49bcef81e0827c53ff99df2ca02075ad3e5e251496b28ed3a52e
MD5 3cd7de07f9e067e18fdcb90441239078
SHA1 90e751870ff52c9d2d844a695b1ea9ee2798735c
SHA512 edfe7d263eda514f23a40e62ba018ccd0214b16179ffc63ebaa8b8f42d278f5c2bc2a3a3d3b690b0b9abfc0f66b01762fa67ed0acd528853195bd9ed2cafa685
SSDEEP 24576:bCLHGL0MoeVtFumTijCmlKQWDkEVeR/g9BWdhUueY29YJIj:bCLHGeeV5ijCmlDWDkEDYAYGYw
TLSH
T1F3A56B05E7EB5184E8F3CAF5CA2294169A327C549B34F7EF4E80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 c087c17933b853ee5ffb75fa9a5a5832c6b2b92195fd6206b1002a3a314fc45c
MD5 87d7c8e88a8b46afdba4cde3f06e7848
SHA1 62457f522540a121a771bb340b6a3b3db6aeb7b4
SHA512 0321f81bc6e20c8793887449c3085cad37793878275dd3dff2a7c683fd2c4e515a915d07f1874fa23f709bdf38bbfe66b1d6e0cf5d56e885abe1941dd2329be7
SSDEEP 12288:KtHck6j5ZI7xYAhdPZUh4uUmZpM1j7+kU0I6S+1kxHBmO:26DI9BP2hLjU1jqnPH+1qHBm
TLSH
T19E05F15E723610F5E1ABD039C1830602D2B2F07197265ADF1B9885BE4EB3ED9B53DE81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 a4fadf557b1d5a45fdfaedf5684d3012bb0567309c3bd49de94b57d51828c229
MD5 aa3b07c417cb3d9c14c8652f28d71c0a
SHA1 246991b7a8de14e7bc78eb8b3c29503fd3bbb3b0
SHA512 ef1251a88d563dc060ae28f2f4a4f7d268e7120b0e12eafb65fd30ad48b46f6221c989d8c370a623a31735819b5978da49d32b664782e5f9f792484425255617
SSDEEP 12288:kG6kyRYAhdPZUh4uUmZpM1j7+kU0I6S+1kxHBmO:1tyRBP2hLjU1jqnPH+1qHBm
TLSH
T1BDF41206A25430D4FABA8530D47346508F7AFC305B365BEF2AC0A67E0F753E5A636B85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 f49c4ef4b0835433b0e03c6a86c614cd7514be06f256c784ada2532b356988b9
MD5 449a676e478aa90805fd9a5487a97cdc
SHA1 19ff9888fc01fe90db40d3166e11825ae5c725e6
SHA512 4b3f43f8cfc6393832ee4c1f21c4ff3a0acca25093f437632db2655d01de9b0bc8b20314a8e8997bef4c1cfba6e3a9bad39bfb81b2dd5495c779cbe1be3e388f
SSDEEP 12288:ni/YAhdPZUh4uUmZpM1j7+kU0I6S+1kxHBmO:i/BP2hLjU1jqnPH+1qHBm
TLSH
T1BDD4235FA41531E1F999D83090271B1546BAF1311B3B2EF33E8855BA8DB41E7A337AC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 a9d2a252d12f1621b7d4c01343fc0b83c5a69f06287e41fc8bf50087e5527a1b
MD5 0891affd35c068d74b6f29e69c11dc59
SHA1 088ed28b89cbdbedf2131d90732ccc7639ec3285
SHA512 fe3acf3f1f919277756eaaebef67d926a16f55aa1a65c4fc7a99dd18737c7d265423c9ad8c3360b004ac11724ae9e7d0c674989110631674dec66519b24adec3
SSDEEP 24576:GwgR7oTfaidZcVeR/g9BWdhUueY29YJIj:bgmTrZcDYAYGYw
TLSH
T1F7559D1DA7EA05CAE2B2D279D8721493D633B4315772D6CF2448C03A4DABED8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 81dd1ec23437e0315e1bc817cfa23fdcdaa2a599eb816ed997ddf59d2a5f9ef5
MD5 da6a0e0d7b6e69cb86c5daac5165d49e
SHA1 fe123a72bd87768635052ffa049ee231a5a34163
SHA512 08e7dda52d1c2a026be4fa0718a799cc96d1ac1dd0c4f17182996a9c6430b76c49cc25987ba41f77600e32c7b6792f6184cfed2e1b687549b6261feb1be72a9a
SSDEEP 12288:xpJcm8CN1JDfe3YiyC/g9iQWdh1eueYQce/E8YO2NonQHFylyIBdO2oOt:xrcmR1VeR/g9BWdhUueY29YJIj
TLSH
T16F05F10FB66E00E9E1B7827C88820586F6B37470275267DF16A1C37E5E179E9BD38B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 1cad4a8a91bad591ea44a3b8d8b44440c961d88f694b67f20d3686448a93879a
MD5 0e6d491bbcbccda0a2cfe218f8f13ffd
SHA1 88ca31639e08b4b7683e7350885e7072caaef40d
SHA512 ee9a276da905590a4fce46ccb1471341df0aa1ce8f01bf3e7e21490eb65005a29dfd15afed2d8e4462a9b1629960dc36b1ad11564c1394dedc20e2fe260cd93e
SSDEEP 49152:7DL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3MDYAYGYw:w3Upow8sB1DYw
TLSH
T14EA58C3EA2E800A8D9AAC379C54213A6EA71782D3F3015DB0174C578BF1BDF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/364-293-0x00007FF660070000-0x00007FF66011E000-memory.dmp

Download

memory/364-295-0x000002B2DB610000-0x000002B2DB676000-memory.dmp

Download

memory/364-294-0x000002B2DB610000-0x000002B2DB676000-memory.dmp

Download

memory/364-369-0x00007FF660070000-0x00007FF66011E000-memory.dmp

Download

memory/372-47-0x000002308E980000-0x000002308E9E6000-memory.dmp

Download

memory/372-46-0x000002308E980000-0x000002308E9E6000-memory.dmp

Download

memory/372-45-0x00007FF7BA970000-0x00007FF7BAAD8000-memory.dmp

Download

memory/372-52-0x000002308E980000-0x000002308E9E6000-memory.dmp

Download

memory/372-54-0x00007FF7BA970000-0x00007FF7BAAD8000-memory.dmp

Download

memory/1104-286-0x00000196DD7A0000-0x00000196DD806000-memory.dmp

Download

memory/1104-366-0x00007FF6ACC50000-0x00007FF6AD394000-memory.dmp

Download

memory/1104-288-0x00007FF6ACC50000-0x00007FF6AD394000-memory.dmp

Download

memory/1104-285-0x00000196DD7A0000-0x00000196DD806000-memory.dmp

Download

memory/1828-324-0x00007FF7732B0000-0x00007FF773553000-memory.dmp

Download

memory/1828-323-0x00000199A9D00000-0x00000199A9D66000-memory.dmp

Download

memory/1828-325-0x00000199A9D00000-0x00000199A9D66000-memory.dmp

Download

memory/1828-389-0x00007FF7732B0000-0x00007FF773553000-memory.dmp

Download

memory/2192-340-0x00007FF7F4E00000-0x00007FF7F4F4A000-memory.dmp

Download

memory/2192-264-0x00007FF7F4E00000-0x00007FF7F4F4A000-memory.dmp

Download

memory/2192-267-0x0000014C7A230000-0x0000014C7A296000-memory.dmp

Download

memory/2192-266-0x0000014C7A230000-0x0000014C7A296000-memory.dmp

Download

memory/2312-447-0x00007FF6107D0000-0x00007FF610A5A000-memory.dmp

Download

memory/2312-352-0x00007FF6107D0000-0x00007FF610A5A000-memory.dmp

Download

memory/2312-354-0x0000014CB0F80000-0x0000014CB0FE6000-memory.dmp

Download

memory/2312-353-0x0000014CB0F80000-0x0000014CB0FE6000-memory.dmp

Download

memory/2332-373-0x0000016D994D0000-0x0000016D99536000-memory.dmp

Download

memory/2332-449-0x00007FF765CA0000-0x00007FF7661A6000-memory.dmp

Download

memory/2332-372-0x0000016D994D0000-0x0000016D99536000-memory.dmp

Download

memory/2332-371-0x00007FF765CA0000-0x00007FF7661A6000-memory.dmp

Download

memory/3388-58-0x000001B159940000-0x000001B1599A6000-memory.dmp

Download

memory/3388-57-0x000001B1597D0000-0x000001B159865000-memory.dmp

Download

memory/3388-59-0x000001B159940000-0x000001B1599A6000-memory.dmp

Download

memory/3452-6-0x0000000002D30000-0x0000000002D99000-memory.dmp

Download

memory/3452-7-0x0000000002D30000-0x0000000002D99000-memory.dmp

Download

memory/3452-1-0x0000000002D30000-0x0000000002D99000-memory.dmp

Download

memory/3452-0-0x0000000002DE0000-0x0000000002F02000-memory.dmp

Download

memory/3824-395-0x00007FF6A7000000-0x00007FF6A733E000-memory.dmp

Download

memory/3824-394-0x000001E1F0D90000-0x000001E1F0DF6000-memory.dmp

Download

memory/3824-393-0x000001E1F0D90000-0x000001E1F0DF6000-memory.dmp

Download

memory/3824-451-0x00007FF6A7000000-0x00007FF6A733E000-memory.dmp

Download

memory/4120-235-0x00007FF78E370000-0x00007FF78E439000-memory.dmp

Download

memory/4120-237-0x00000235D6790000-0x00000235D67F6000-memory.dmp

Download

memory/4120-312-0x00007FF78E370000-0x00007FF78E439000-memory.dmp

Download

memory/4120-236-0x00000235D6790000-0x00000235D67F6000-memory.dmp

Download

memory/4340-381-0x0000017256520000-0x0000017256586000-memory.dmp

Download

memory/4340-384-0x0000017256520000-0x0000017256586000-memory.dmp

Download

memory/4340-383-0x00007FF736650000-0x00007FF73677E000-memory.dmp

Download

memory/4340-450-0x00007FF736650000-0x00007FF73677E000-memory.dmp

Download

memory/4356-342-0x000002C2943B0000-0x000002C294416000-memory.dmp

Download

memory/4356-358-0x00007FF6149E0000-0x00007FF614D00000-memory.dmp

Download

memory/4356-343-0x00007FF6149E0000-0x00007FF614D00000-memory.dmp

Download

memory/4356-341-0x000002C2943B0000-0x000002C294416000-memory.dmp

Download

memory/4356-347-0x000002C2943B0000-0x000002C294416000-memory.dmp

Download

memory/4580-361-0x000002A60DCF0000-0x000002A60DD56000-memory.dmp

Download

memory/4580-448-0x00007FF6FDD80000-0x00007FF6FE250000-memory.dmp

Download

memory/4580-367-0x00007FF6FDD80000-0x00007FF6FE250000-memory.dmp

Download

memory/4580-362-0x000002A60DCF0000-0x000002A60DD56000-memory.dmp

Download

memory/4628-37-0x00000198774A0000-0x0000019877535000-memory.dmp

Download

memory/4628-38-0x0000019877660000-0x00000198776C6000-memory.dmp

Download

memory/4628-39-0x0000019877660000-0x00000198776C6000-memory.dmp

Download

memory/4840-377-0x00007FF6F69F0000-0x00007FF6F6E07000-memory.dmp

Download

memory/4840-304-0x0000024A94010000-0x0000024A94076000-memory.dmp

Download

memory/4840-303-0x0000024A94010000-0x0000024A94076000-memory.dmp

Download

memory/4840-446-0x00007FF6F69F0000-0x00007FF6F6E07000-memory.dmp

Download

memory/4840-444-0x0000024A94010000-0x0000024A94076000-memory.dmp

Download

memory/4840-302-0x00007FF6F69F0000-0x00007FF6F6E07000-memory.dmp

Download

memory/5064-31-0x00000187B91D0000-0x00000187B9236000-memory.dmp

Download

memory/5064-30-0x00000187B91D0000-0x00000187B9236000-memory.dmp

Download

memory/5064-28-0x00000187B8FF0000-0x00000187B9085000-memory.dmp

Download

memory/5064-29-0x00000187B91D0000-0x00000187B9236000-memory.dmp

Download

memory/5068-331-0x00007FF707430000-0x00007FF70754A000-memory.dmp

Download

memory/5068-253-0x0000025078500000-0x0000025078566000-memory.dmp

Download

memory/5068-252-0x00007FF707430000-0x00007FF70754A000-memory.dmp

Download

memory/5068-254-0x0000025078500000-0x0000025078566000-memory.dmp

Download

memory/5268-315-0x000001EA11DA0000-0x000001EA11E06000-memory.dmp

Download

memory/5268-313-0x00007FF7B4790000-0x00007FF7B4844000-memory.dmp

Download

memory/5268-314-0x000001EA11DA0000-0x000001EA11E06000-memory.dmp

Download

memory/5268-382-0x00007FF7B4790000-0x00007FF7B4844000-memory.dmp

Download

memory/5368-392-0x00007FF6A4770000-0x00007FF6A4904000-memory.dmp

Download

memory/5368-333-0x0000026893FF0000-0x0000026894056000-memory.dmp

Download

memory/5368-334-0x0000026893FF0000-0x0000026894056000-memory.dmp

Download

memory/5368-332-0x00007FF6A4770000-0x00007FF6A4904000-memory.dmp

Download

memory/5512-322-0x00007FF78E370000-0x00007FF78E439000-memory.dmp

Download

memory/5512-247-0x000001E2A09E0000-0x000001E2A0A46000-memory.dmp

Download

memory/5512-244-0x00007FF78E370000-0x00007FF78E439000-memory.dmp

Download

memory/5512-245-0x000001E2A09E0000-0x000001E2A0A46000-memory.dmp

Download

memory/5996-274-0x0000000000820000-0x0000000000889000-memory.dmp

Download

memory/5996-273-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5996-279-0x0000000000820000-0x0000000000889000-memory.dmp

Download

memory/5996-351-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/6088-15-0x000002710D330000-0x000002710D396000-memory.dmp

Download

memory/6088-17-0x000002710D330000-0x000002710D396000-memory.dmp

Download

memory/6088-16-0x00007FF780130000-0x00007FF780253000-memory.dmp

Download

memory/6088-18-0x000002710D330000-0x000002710D396000-memory.dmp

Download

memory/6088-63-0x00007FF780130000-0x00007FF780253000-memory.dmp

Download