47de83c09339aaa64980034ef5c08fc87fe290f2722baecb2c420645da792e91

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 06:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_2ec442f6af686f8bc172189c429d5d6c_amadey_elex_luca-stealer_lynx_medusalocker_njrat_smoke-loader.exe
Size 1.9MB
Sample260910-hgb2fssvct
SHA256 47de83c09339aaa64980034ef5c08fc87fe290f2722baecb2c420645da792e91
MD5 2ec442f6af686f8bc172189c429d5d6c
SHA1 0242c42d3bc67f3b0f0f40b28bd4dcdfc7f0e8c8
SHA512 02a1e0316cbc3d0aa2b2e4bfd6156549246fffc31439003d2b8b20988494aea47c5f9dbb5db7e3797e83c9e20e86bea84c2d180d4cc0306551ff745fdc88943a
SSDEEP 24576:FxRxRFMeR1Ei1iQiYWLg77R0Ryxknw4FYnshx8OfVe247:b7R1Eui2Z77R0Ux4x8EVep
TLSH
T10095F11479A2E076C53242B18D7CE776496EB9204B3245EFB3D89B2D1D708C27B36A37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2880	elevation_service.exe
1168	elevation_service.exe
2268	maintenanceservice.exe
436	OSE.EXE
4200	PerceptionSimulationService.exe
4516	perfhost.exe
1548	ReFsDedupSvc.exe
5068	SensorDataService.exe
2332	ssh-agent.exe
3128	AgentService.exe
6616	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-08_2ec442f6af686f8bc172189c429d5d6c_amadey_elex_luca-stealer_lynx_medusalocker_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-08_2ec442f6af686f8bc172189c429d5d6c_amadey_elex_luca-stealer_lynx_medusalocker_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-08_2ec442f6af686f8bc172189c429d5d6c_amadey_elex_luca-stealer_lynx_medusalocker_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-08_2ec442f6af686f8bc172189c429d5d6c_amadey_elex_luca-stealer_lynx_medusalocker_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\447567ec957eebe4.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-09-08_2ec442f6af686f8bc172189c429d5d6c_amadey_elex_luca-stealer_lynx_medusalocker_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-08_2ec442f6af686f8bc172189c429d5d6c_amadey_elex_luca-stealer_lynx_medusalocker_njrat_smoke-loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4944	4308	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_2ec442f6af686f8bc172189c429d5d6c_amadey_elex_luca-stealer_lynx_medusalocker_njrat_smoke-loader.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000059943589ef40dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bca54389ef40dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000021a26589ef40dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000c697d889ef40dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bc151c89ef40dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a1f2d088ef40dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004b53738bef40dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2880	elevation_service.exe
2880	elevation_service.exe
2880	elevation_service.exe
2880	elevation_service.exe
2880	elevation_service.exe
2880	elevation_service.exe
2880	elevation_service.exe
1168	elevation_service.exe
1168	elevation_service.exe
1168	elevation_service.exe
1168	elevation_service.exe
1168	elevation_service.exe
1168	elevation_service.exe
1168	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4308	2026-09-08_2ec442f6af686f8bc172189c429d5d6c_amadey_elex_luca-stealer_lynx_medusalocker_njrat_smoke-loader.exe
Token: SeTakeOwnershipPrivilege	2880	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	3128	AgentService.exe
Token: SeBackupPrivilege	1548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1548	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1548	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1548	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1548	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1548	ReFsDedupSvc.exe
Token: 33	6616	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6616	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6616	SearchIndexer.exe
Token: SeDebugPrivilege	2880	elevation_service.exe
Token: SeDebugPrivilege	1168	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6616 wrote to memory of 3980	6616	SearchIndexer.exe	104
PID 6616 wrote to memory of 6844	6616	SearchIndexer.exe	105
PID 6616 wrote to memory of 7064	6616	SearchIndexer.exe	106
PID 6616 wrote to memory of 1188	6616	SearchIndexer.exe	107
PID 6616 wrote to memory of 5116	6616	SearchIndexer.exe	109
PID 6616 wrote to memory of 2656	6616	SearchIndexer.exe	110
PID 6616 wrote to memory of 836	6616	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-09-08_2ec442f6af686f8bc172189c429d5d6c_amadey_elex_luca-stealer_lynx_medusalocker_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_2ec442f6af686f8bc172189c429d5d6c_amadey_elex_luca-stealer_lynx_medusalocker_njrat_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4308
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 800
  2⤵
  - Program crash
  PID:4944

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4308 -ip 4308
1⤵
PID:6240

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1168

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2268

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:436

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4200

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4516

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1548

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5068

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2332

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3128

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6616
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3980
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6844
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 2980 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:7064
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3004 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1188
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5116
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 2980 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2656
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3004 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c421d833f37f00dbfa0cd40133a360f81e2beec44ba7015d3cd4b49c79221cd8
MD5 5716c648d980a37b099ee2c3be8f1dc9
SHA1 144911cc07488018898fa697d3e14ecd418979ce
SHA512 efd51716fb7e0fcdd79aee63edcd0ea6ca51f9d599155ad88d373820b77ce7bc14c07f71ee04e3275079b2a9dea7b071023f0bde40a04d8ea505a682d52816b5
SSDEEP 49152:hb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnHx4x8EVep:n3q6mjBcix8EVy
TLSH
T129D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 3f5428cb1bb4ccf4ed9c631bb23a219fa9d651fe45b6d9f2b959294f944783be
MD5 89ea4a5ce041ababea15bba7fee072f9
SHA1 bf226a5d705407250bcdb125fa455f550905f41e
SHA512 086c14444bf7027e9a7898281746a93a97bed226cc5e32a67b39ff79798bdf548b6559e25ffb276504c0d1d09072ff91d38c927380fc69cbefc043994c86ff94
SSDEEP 12288:n1XLsswWkxy2lRq2czAN+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:1XYfDtczANyxknw4FYnshx8OfVe247
TLSH
T10B75F12877D548F9EC6B8139CDB28112E633B8554770E38B03E4A52A5F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 efc243c6d797d28bbb06a40f526f9af7bf3e4dad7cfd14f6d41c8024a885e362
MD5 c7d309a7b274a64ead4711601b46a7c7
SHA1 5c0122abbedc0c6e9d25d2375bd73dd2089a04d9
SHA512 cabe7b267b5afe0d6a6bd0e2740a5b723c50026be52a1e1d2c2abe9afb24be61860672227c72176961bfb5370dcb5d88bdc56490da951498b025e62e9f5ef742
SSDEEP 24576:30Le5ji0hmxSrMUyxknw4FYnshx8OfVe247:3Pji0Aoax4x8EVep
TLSH
T1A995AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1feddf30f030cb763cfc85a17c33ab3e31339ee7d534a963bbf2802e61d53a78
MD5 c2662982df5bd1f71e7f4484d2470b62
SHA1 40a42b654166895f3705c61aa99f5daca0c1229a
SHA512 f0cc15c4701045355f9d2083f455b6351b2805f26a73457e022542ccafca9d58b45886f1c6b1e55358df81921a339573fd6de3b833d51fc927bc47790a7dbe4a
SSDEEP 24576:4a7/ezSC6vUyD/aqgrvWj6q8wyuyyxknw4FYnshx8OfVe247://ezSC6vUzPv+HjyWx4x8EVep
TLSH
T1C9756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9a8970ece9a1a05d9fa22d4cdf6b705faef4171c6fd4dcd6dc46b5b628ffbfbe
MD5 72b37851e17271afec334e77a17415a7
SHA1 8e21946801a81d7c254744f51e38f128a5729a12
SHA512 5e929e4c32b6df6da9d9b55fa53ec3eef27bdcc627a3db838630de13fd2de9af9a2f2c13869790b3d44423de5f6bdff22cdeff305920825d0da40a04b068c8d1
SSDEEP 24576:mVbqPb88hv/l+BJyxknw4FYnshx8OfVe247:mVO88hXl+6x4x8EVep
TLSH
T12A559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 c03f7ca193cf9b9115e4757e572ca42e1bc099915d21100f319586ad201440fd
MD5 64a8f3a5d3325af3000b57e029c178c6
SHA1 9903c613ec583496281fe522313deea99ca13a0c
SHA512 6ee3353b9bc89103a5316e41051b3dbb74d3c9298fdc2f9edb3e570261d541de5c9d38a17f666f19768e9134655612028357ca0898969d6ce2f17b189797a7aa
SSDEEP 12288:oag+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:oagyxknw4FYnshx8OfVe247
TLSH
T1246523BCABD9E4E1F69E14331A7572223605FDA4DAB4C11BCB78B54EE0B0C54E06E613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 a823d521b00b2dbd40d1b7c0fce92c624080c6ac097730a4705aa37ffcd9c3e7
MD5 fe5b364c49e887ab3f3cddcc789faf85
SHA1 8e9e5c96371f64a8ccbcbb3df723deb0c78452c3
SHA512 703b408ee76792782ae413deb1573970cb28d852d33b05ae769cc9b8fc82010c412a4dbfbcc64d1cb6fd37d57f76ae7e974706761883528f338dba4252f65fed
SSDEEP 12288:JeBNUbTVO86UR+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:JJIURyxknw4FYnshx8OfVe247
TLSH
T10A75CF7BEE28FCE2C27E5DB95B918200A77274704B6193CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e5a8d0ab7bba60fa51aeab72b7ac341dc6d69d2da7ffae4d54576866cc456d7d
MD5 a19bd5d936e648d3ee4a6150567202d0
SHA1 b8608372298acdfc18d9f32d3d1632b0dc759494
SHA512 9d901635c0a6978490d645b70e0afb232bb9777af96abfbe56b0ed9696a83924797622b706f6c173e327564e31cbbbb945be7042568edecfc58081ba256b48dd
SSDEEP 49152:sQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THi:sQvGAdlCEL8c/WRNw5Cdix8EVy
TLSH
T1DB267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 8a331f2ca038fa3377c73b2ea4c9e49ce025bfe17c089d21ddfe95ddb548acde
MD5 b69b56abdae284c8c710b81e6e2047b3
SHA1 c33015b2b2530303bfda46b2ec2cde4fd3e0c25b
SHA512 2035b57217f1a4c152e5ef92b938459beebc40d3646c5a408d718d2fcbfad9ab466a3d21a458eb7b25cc9f7b26bcb5c0bfd2cb47b75b3a829cc69916b95c0e15
SSDEEP 12288:4AwSfxL/2Dc3zDLLmt0LDQewsAjf+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:d+ewsAjfyxknw4FYnshx8OfVe247
TLSH
T14A85E030FF74E032C6BF0DB21B36D716142DB9604B611AC3E3E89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9aa7f598db99c4f394049369defdd3f3a10abe37afc68cda9074a2bbb61f3986
MD5 dbc5049ae6f26cd315380e40f75a9b80
SHA1 aa99f82e467d8cd65cd44f781f8674753661f289
SHA512 62cd8d6fc416432957af813c37aaf169b5a1a11749ae9bcc91b99fd65145aae6825788eeacb09c4aa77d03edd10ac473f78088b6444b7ef9a42230a2599f13fe
SSDEEP 196608:yUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHH:yUEtQevvqc2W1cpV20I32
TLSH
T1F3474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ba06d99481ee2579d71d88fb1709e2817c916a55773e3dad4976553de92c1ee6
MD5 b4d97750d51ea6d4e88e7613153ed35a
SHA1 f746fb8787ab7f3a0dd37b5d335c7469c5dcec52
SHA512 ead85cd58748b99a627f447e64bccc65490125e95114bd85bad35a980afc1a457ce4f938702f9679cbad756dbe11f70069ea7191e1ca9bdef0b930fbc6eb025f
SSDEEP 49152:aCbRquA/m2yL5zLfFiV+XenmE3/zqx4x8EVep:voq2Vjnm5ix8EVy
TLSH
T101D58E1976B8C2E4D1F6C77886A2C647F37178154B30A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 306df2ef5e84ba11f1f3745a3ac62d9fb0c1baa1976e57e0bd3969df724f9f7e
MD5 680348973492c6eb669af38ae7d9ec1d
SHA1 4f6a54096b09d3e9ce56f019232e54d81a1d449f
SHA512 22604bd460e6fcb1d9d1b1d903b34aa3ff6c65a2f7f4429febe4a9956807f30de4118b86e7b90438540282b49bc7721321cf062d8da24d76b619b5ac27bcf4de
SSDEEP 24576:/AhGL6IFoiwtA5l7S53myxknw4FYnshx8OfVe247:/AM5Foiq5px4x8EVep
TLSH
T17035AE80EBF955D4F5B3AA7899B69171EA76BCA65E31C20F1260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 633046ffe515805cbb53204a7908bd5c24446f59cbe30dbbaf70ce26c7c3fc81
MD5 eac1c698d4c640c5a8e5e37756685399
SHA1 f3561fc2c9e3cae98d12bb514a4cb7898e05c8a4
SHA512 08678f51f86027826baf51e34a59f4a6cd71d74e618c55b54e2a9330ce58be792334193358290c68b617f8ef5565139178945379e6ab3902fcaebff06d3ebcb0
SSDEEP 12288:Hmw5HEjsChNrBFgl0WDm+CS+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:GwumOWzyxknw4FYnshx8OfVe247
TLSH
T1DF75F14977E81CF9E9A741398657D136F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 e8fa5afed5fd40048c7795130afc918d29c6290925ff63173d5895c3d5354060
MD5 4cbaaff807f0a6c4f284104d30cccfd3
SHA1 111e16567c7f5a75ca7bdd1448dae546c48e4bfc
SHA512 5cff5ed4208299d5bd4272db9e3296bba300cfcfce2b4465bb5b6558ab948547e1848a79cae915f57cb73776057f627cb4f8a7c6834823c8fb62288bf758ba18
SSDEEP 12288:IvZ1IyP+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:IZucyxknw4FYnshx8OfVe247
TLSH
T1156512AC33E870F1E1A7113A89F15206E762B4A2677183CF4768625EAE71DD09D3D723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a2f0ea16b555ac7855516a4a4e5f2fdfa061cda09457557f97e558e5fa557a70
MD5 62e35d0358d9169bb88fc0803d5cb3e4
SHA1 270f8632b95ae47278c724adbdd31f925638df4a
SHA512 eb9d2521d660c2620ea88b4ac6fa0fb700c62682023761843f655dc85f6db324f68fe53f3680a3a4fe64cb858831f99d6478309a90300e49d1141bcc84e684a0
SSDEEP 49152:Vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23U2:MQRQyi36YOcPDLvw2gAf+PN3gix8EVy
TLSH
T13B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 66706c270428c3583920a1659c289c4f26771af521d5748d24431482478a4ad5
MD5 bda5ab2803cb178bea9d856a5942d1eb
SHA1 b4839b88fa2fff7708d76d4ef513103fa2c7fdec
SHA512 2b0962d2354da8dea2510362584a9e1664e364b95a22bcd184a322a1fee7c87e11847baadcdae2109081ed5652ca53a0059c2750b63b30903e1061d1fb9315f0
SSDEEP 49152:ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23U2:tQRQyi36YOcPDLvw2gAf+PN3gix8EVy
TLSH
T167667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 471f76c2b20585c483021d5775b16f6a7fdf53c7d133fecc85d006cb4663ed3a
MD5 53e2299206d257d01ebac3b6cba8038f
SHA1 d90b75eb64a49f21b23362d1728184e46a21beb0
SHA512 7ae68435cf04b6e7315afcbd329278a1151b7060dd933b8446a8d467dd22834d971c75a62eefa24488f69bf52573f106d51fbc5c57897dc7155b1bda8b69ce8b
SSDEEP 24576:mwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0syxknw4FYnshx8Z:w68Qg55nhkeWu7PNU3/ax4x8EVep
TLSH
T1DDB55933B2F600A9C44DE1769F4A973196D17C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 bfc8bf103c528a6a8111f025a66b4e5751a36ee590076845e12c1a88e801f608
MD5 e93682e314d0d825930c6f35c9e1929b
SHA1 afa92666d80f8d0c25c46463b513b70740737dbb
SHA512 ca6fff485f077cc01ee47b7503fc358e6fe335df33d842540bc0da4ec478f0933ea938d99f96e1ae09a85f39997f78bf5b40850e3ccdbb2dbc47af3d9763c009
SSDEEP 49152:m3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99Y:3y5112gYy5azzVvU69nLKnhZjix8EVy
TLSH
T167167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2b073610f2e493ff8ea34984a21736637245dfe87ea1f1967bb44f9be5a73339
MD5 c7e99ec3bea3d94afd560d66bf19ed8a
SHA1 714d507bd829fd7cf4e7098b561eb235fbf4c488
SHA512 db4e27dc9e03fc1bda0edbe5d52b1060e5d800874f1c4dc7d566d038e19820ce0739e8c47b1d981df914b4905f5f5787aab20b9d05e3e50cf541fa018fa60850
SSDEEP 49152:ZB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl/x4x8EVep:Pu6JmIxd2d/ix8EVy
TLSH
T140D59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 73421c28ba038afa77cbd52f6d18c425a887c4c9fca37b6e090321829962fb6d
MD5 3f2b046b18832f1d2b1d9c4c3297d347
SHA1 3e50f85ed9ec2267c31fa54da2607db15bcfc5cb
SHA512 2df71a829dfb1a37e10d0c8a49535eaab10334ca6035354d505023aff7535372c9f24c67e68424107cf06fcdcf6fef84d783a9cec4ee7040d46d1ecac1095737
SSDEEP 49152:C1hpsNoJpF1A67U44CwH7R4x0x4x8EVep:CmifPqR5ix8EVy
TLSH
T1CAB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 685791e25ea99a7e613263d20fd3169364d2378aba16a23db76c119da21f333f
MD5 ca083e1a9f9e07067be5936287ae3d4d
SHA1 01d6f2731ad992751f48cc34c043551eacb4d371
SHA512 5598decbf3b38df3d133d08060aa7d2e5c6e269c0a293afa3d9684711c91b4c75f3e31744315ed0cc80538ca64a6a8d6a032801dd48ddda98f7e3d1345199999
SSDEEP 49152:XSuZQIY0Be2KkRVtOnks6NMHq3x4x8EVep:N5dKqi613ix8EVy
TLSH
T1EBC5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0cdd38d89fa3c2c764885fd94853fc8ea5ee5c1c396fa48c8c9837120dc5ba89
MD5 3c1a62758e74212c112cf7e418a1a42a
SHA1 2e4d63951d36cfaa85144f938121129204328d77
SHA512 f24f21ff0ebc93d3ed1f6a8096b3a54029b4eb425c4ad6638c7a351c62f92a2e09f27e5770c18f0d4235d6c5610dd56ab04ccd1e27d147f6e9f3db92f1f277fc
SSDEEP 49152:lhtSn8EApI0figjgiDn0AP5w4x4x8EVep:UX2iWphVix8EVy
TLSH
T1AB95BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 5e4aca8693b8d8bfd728cd0fed617a3b33d206435e6b06eca820d30017e74a55
MD5 4467a5981bb5a5ed90ffc8196d51ac07
SHA1 48f2f0dd6108e6f2b816b70aa0b16e85692848a8
SHA512 053e515f91272c04c5ffc25ef7486d3e1103a7aef8d90d17d7788460eb0fcbeb31b8c4f5a7ed00b3b20fd66b32b1f65612d124d776ab60d8cc4ed76b84a30d5c
SSDEEP 12288:EI+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:EIyxknw4FYnshx8OfVe247
TLSH
T10265237CBBDEE5E2F50D11734A7132667609B5A5EBB1811BCB6CB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 829e567969c32728156d31b0a759470814e2e5ca1cef9e53e103dce3802cfc52
MD5 385f10cd47e189acf6620af1ed732a16
SHA1 69ed046e077e8a3fe19172c69ba842d96a8cb177
SHA512 e3a1fc87887740d3a0741f7c5c4c4f6676c1757704dbdcf15583ca4167364a103b82c3727d554be45b6600865e030fda631486d75170db0a9f8ecd33293a5339
SSDEEP 12288:CL+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:CLyxknw4FYnshx8OfVe247
TLSH
T13A65237CBBDEE5E2E50D10734A7172666609B5A5EBB1811BCB7CB00EF1B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 cdbf54b412d1ee7d013b30b6509b13d2e472f761f108c55c7037ac0f7865bfd2
MD5 b18078a41a6b244130bfa6a18ff16816
SHA1 ce1ee2e7067e432a77727177d5d6bf22e082d4a0
SHA512 7adf49c084c4a083b4b4b4a70b27deee4059b5f8b6055ef26e6a8ab6ac1915afdd6ac902779289e14804e50923212f49fa078ac1dc1ec82144b563db40686a74
SSDEEP 12288:BZ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:BZyxknw4FYnshx8OfVe247
TLSH
T12765237CBBDFE5E2E54D10730A7133667609B5A5EAB1811BCB6DB00EF0B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 87999820de49c2ac06c5cdf4b031159ffecbcb9246b79698d217ad9575c62780
MD5 456b739c75bafb9e5138ca050354ec1e
SHA1 f6e1f57a7a760fdf36c684c1974061fdf01a06f7
SHA512 be2da0fef78cce4d592515598edd4b2d894ae837a33c2432a825144cc887dd870da9b7d04e5d54ceb0bb053f2f6d207a130d1c5b38e1a9877c6a14617277b6cf
SSDEEP 12288:oVG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Zyxknw4FYnshx8OfVe247
TLSH
T17F65237C7BDE90D1E45A51738A726222B365B8E4E731C25FCB24710EEDB0894A43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 7a8a536def2e3e824f7a308a9bda3ec77b6c9d9b9525fca5489d0d337ebc4704
MD5 d9b1a7fdeeb84767f95bca409cfad328
SHA1 9e4a89e13676fe46a115e4a22d0d01c1204ff7d0
SHA512 008d7a89b11be4b6a568dd86b43cfe36ef42095d0d223f67319dbea1381d053e82e7d2a63ba7ab85bba59365ac6eadd2650a875af6e181e1b36b822536b7972b
SSDEEP 12288:ie+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ieyxknw4FYnshx8OfVe247
TLSH
T1D665237CBBDFE5E2E50D10734A7133667609B5A5EAB1811BCB6DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 4aa88ad3a7735f14f7464b240d0c525a5f0a0a742da27e7f8daf416e7be21dd4
MD5 8ebde015376e4ced1e381a346ba642d2
SHA1 a5522f14ede9ad1e5931e5ec27172f9d80130cc5
SHA512 1b8666495cd1ea6e0bc09be1f6f574a1878dca82d41fc8c578010ff29518f943321c10a1b025d4f97429b70fc441091cd380f0a4a707168039aa478c38645176
SSDEEP 12288:OH+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:OHyxknw4FYnshx8OfVe247
TLSH
T1AB65237CBBDEE5E2E50D10730A7172667609B5A5EBB1811BCB7CB00EF1B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 9538679cd1c8108984afcb965cbd171f6d51d6726400cdc5688ed9be97570166
MD5 917284ea416e040ef5b46ea665d5aac1
SHA1 ada0f869c28dafe9f0ba87605486d8be4cb590b3
SHA512 1a6e4720ab94b0cc22e8c3362e41a9b2ad828e9a3bb2426a7c5f71ec48aac72c1361ec7522e9cba2211966eacdc3fe500338b490a79b3f325260a2a786b54e38
SSDEEP 12288:ZD+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ZDyxknw4FYnshx8OfVe247
TLSH
T18565237CBBDBD5E2E50D10730B7172666609B5A5EAB1811BCB7DB00EF1B0C64A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 300ff36bbd1d9d897b76d85f67eada5f6e763556b90574a13410c0adb69770aa
MD5 d5c7f9584e1b5d09f43490bac3f18729
SHA1 2b678a4123e7e4c0487a43ca784fae3a748afb4b
SHA512 a42bfeb13c31d73e6894381b217f14b89e14a4327d194bcc5b83008ee987572cc990c109c47cf185c0bc259358031346c48570b0e2d1e2b7017a3c73cc9538be
SSDEEP 12288:siZwbyzzFEoS2cPvyr+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:PZMqzFVSOryxknw4FYnshx8OfVe247
TLSH
T12C7501A8B39018F4EC67413FC9259916D6B27C594B70C21F43B8362B5F736A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 fd389fdc94a96ca0dc58b45968c501fcda5d5ce8b4c55cf86f592b7c5f4c94e9
MD5 7dd9bfcf7e741b9446e0357cf1248d09
SHA1 22d37d4cb4dee1b3939ed351482dc7c50f814269
SHA512 1f05970ffabaae48f65904822f55d4c58392d70ce8391a8d0e0e521a369c9d0494125673a5b9ae02cbba1a32e2d6352f1e87258ef5a779fba74e881f11e36fe3
SSDEEP 12288:DM+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:DMyxknw4FYnshx8OfVe247
TLSH
T15765237CBBDEE5E2F50D10730A7173666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 5589e675b7a858d73222739615dca7829882d82b1c9312ccdc4440c1ed9075cc
MD5 356c17936e3bab69d0f7e1d728cd9a76
SHA1 2c6781a18ff8783f65e7394dd7c9468270de53e3
SHA512 ff5aca24650976708a947bab96cebb5c352dec22aee792327cdd2124ce9e33bad08e7a6069e802d7b06e74e4ae8f90cb300ad371afc3601f6d91c32c9e7f9ac5
SSDEEP 12288:lQ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:lQyxknw4FYnshx8OfVe247
TLSH
T12565237CBBDAE5E2F50D10730B7173666609B6A5EAB1811BCB7DB00EF1B0C54A01E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 7ec57897ce5a4c4bac14da55e84474c81ab54827dbbe961042d050fee7e3d34c
MD5 2a2658afeacf1dc08a96790fc6acfa05
SHA1 4ef7376729199fc7c527246230804b1e9be123e2
SHA512 bfc305d0fe5f3a9699732aa141c6d6524a58687cdbc50f5297ce68f4839fedb368ea2218996e038ea3851fadb781efd53e039c76c1116030788c50d315f48ff0
SSDEEP 12288:lyPz5L8P+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:szyPyxknw4FYnshx8OfVe247
TLSH
T1E475125B73E630F5E13A523689621602F372B8724B3086AF47A4537E6E325D09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 da2865064482a48e8242ec83541e7d7efe67dc7d78bbebc157aec0ea7ce923df
MD5 9e75d32b48f8fd2042eb01c2d3529980
SHA1 bb7f19b3b19d4e9677e090283cd7451fe0c6ac09
SHA512 f55283413df34f6831d5ee54488972c668a0a190801d5cedda520b34fce2219afec00eb8da9bdd9308c008a23b7d2db32c2633c01500fd5ecacd207d0fa767fd
SSDEEP 12288:kM+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:kMyxknw4FYnshx8OfVe247
TLSH
T12B65237CBBDEE4E2F50D10730A7173666609B5A5EAB1811BCB6DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 a7262076821fa338a47d3aa6d6c9a4e78bdb12fea05f945a3fdf54cc306a4ca8
MD5 f60484f549f8f78ba195cdf579d987ad
SHA1 da772db3b2d1e3048d073490ba3029bcebbb1aab
SHA512 12e611043110ed2b257ed1afd689d4c91a5fb1492073fc0107573a124d87c5810923198aa132393a2e18ec49e00cf07f029d900531e06fb81ab663c0c7a6832a
SSDEEP 12288:OM+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:OMyxknw4FYnshx8OfVe247
TLSH
T1FF65237CBBDEE5E2F50D10730B7173666609B5A5EAB1811BCB6DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 e60186bda0473b387046e5ecf1e948919b17e52750c03be5faa15b5b657d67af
MD5 c2cb1ce545e76176f89c45a1cb8b48d2
SHA1 add73dc26b4ac463f2155b83c10e41296aa738d4
SHA512 48eb02fd6f7bb9a06f2bb47fb49d36d177773509301b3f8dafba115e2095efed9b5badd454c25dee69b548f0be5e67a02b05ef8537759c066b5f35474b50cd8b
SSDEEP 12288:4yPz5L8P+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ZzyPyxknw4FYnshx8OfVe247
TLSH
T15875125B73E530F5E13A523689621602F372B8724B3086AF47A4537E6E325E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 5346151caf217e31481b6cb880189294e473cfc41eee02990e9b547b29db847b
MD5 92554048e9f37b2cd5d7694663a24b27
SHA1 fb1b6ef9a172b7114b7b82ed5937580b5152e9e6
SHA512 e3eb7054959c56acdab00f89b4a3a7aa037e3d0089b35ab8fb86cfa77e8010c4989bdc522af0dae8ee34c7db068290a2a2b88e33d115906deff0a53cbe15a850
SSDEEP 24576:4TPaLl3z0zDpyxknw4FYnshx8OfVe247:4TSLljtx4x8EVep
TLSH
T1977501A8B39058F4EC67413FC9659516D2B27C6A4770C21F43B8362B9F336A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 785a173ecbaadd076465f39ec1db37ec120825467a7ff8e3fb2fc85d6f65a301
MD5 d8a1e275ba88802c1918b8d0ea9c6de4
SHA1 220ebad8527d10ed5ddd536f64506bb5987e39ad
SHA512 42def517172623f332439f5ab6a73141990000e0e23f409abe62ad39438eac8405286d298ed841f9240dd01e49a7da5abbc1a928c5fe1ffeaa0a1a09a8025715
SSDEEP 24576:g30d9CHKy7GZ1yxknw4FYnshx8OfVe247:q0d9CHKyaCx4x8EVep
TLSH
T1DB95DF90F3E410E4F0B79A358D765512DA767C9A5B31CA8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 6aa912d9bf3830f8f4a1268798a8d8b48f699222db0c06f0e99b2f7b2dc8b941
MD5 db3f5226bce0a6b582e88d1360956094
SHA1 c28d2d6fe349540618d3c4e57e74180dfbdc897d
SHA512 3f5534998f021ea534e58d5899ba41510c5d1518512a00835a2e4af08e3333634210f93c01a41479bad8fef4bdb2174bcdac25a1a87eb8fc66afe1d3b1f5aaed
SSDEEP 12288:T5+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:T5yxknw4FYnshx8OfVe247
TLSH
T14B65237CBBDEE5E2F50D10734A7133667609B5A5EAB1811BCB6DB00EF0B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 da0c775f1cd592c8f682861b219f073ebb5df488daa3467dd4c109fd1d80691c
MD5 8dcc28fe54f51fcf07aa29e0705cdb06
SHA1 b293ce4c25e6c9a4f298cc999123a548216e6735
SHA512 06a44ad53e227cbb5624019900c7c2fd2d864f2a05e04fb0975c71e22f8f2f01bbb8472b9b502e09e7de32958b65c56fc53027109678eeb90a77f11f513af45d
SSDEEP 12288:uv+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:uvyxknw4FYnshx8OfVe247
TLSH
T13C65237CBBDAE5E2F50D10730A7173627609B5A5EAB1811BCBBDB00EF5B0C54A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 5fbd6cf2f465a34d8605e8dacca27b859df26871fcdb0f4bf9773f7de4675b6a
MD5 046a9efc1b8ab04c5f6f01a9c2c13906
SHA1 c69bc42540b877f5e0a1a31d9df41d7ac369e7fd
SHA512 e6227074b2290d6573b454c19e55f98e2b03444f2b186893c14aaa18a3090395948fe0dff554852aeb7a2a6bb4baef74f036a45fe605da06e5a4a692a66b44a5
SSDEEP 12288:pq+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:pqyxknw4FYnshx8OfVe247
TLSH
T1FF65237CBBDEE5E2E50D10730B7173666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 cd33c620a05232adaa634246582a8b543853847a723fdbaf0b26fe6e15a358c8
MD5 28d784f566a48a30de1332a768607d28
SHA1 78dd273a9deddb86e95317b5afe52bc0063bfb07
SHA512 bc7339dd3c7708d9b161ce6b3a6959f1b78875d83c0cb81c0855e663fed91233236ab381ffca2c798fd98cc9d2d702d7a2577c820dba55abd81c9452dc0d0084
SSDEEP 12288:WM+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:WMyxknw4FYnshx8OfVe247
TLSH
T1D065237CBBDEE5E2F50D10730A7173666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 790564b50d5cf4682d88e00a068b572b2713df7dc394dc83cc7c842075de9c03
MD5 dd58ecb859abb45df197b2dfc2098915
SHA1 27467e4674309adae475aa51933e2814e841832a
SHA512 5bcb7fc708bfd1f860de5576d2fe2226f715f958a8a8ba001994da33bceb2592cabcbfd903d0899abe61e376805f9577740cc6c423a2c5880a5caed36afc55b6
SSDEEP 12288:/5+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:/5yxknw4FYnshx8OfVe247
TLSH
T1A765237CBBDFE5E2E50D10730A7173667609B5A5EAB1811BCB6DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 f2de44abb6671df447abbb0df86567f93e50e69257abb2064319bebccc3cc328
MD5 9005ae55b6ad15d1b4712207129bfdd1
SHA1 31352bec562cd9bfa746f0236bc0a0383439a1cd
SHA512 ea5047d3760ffbff9b6bba126761e29bf9533c1b8a3d551276600d031ce401fa02dc11f34de68f317b448ab8f2518a28781c437fde5127d88c02773240ff60e2
SSDEEP 12288:9k+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:9kyxknw4FYnshx8OfVe247
TLSH
T1BF65237CBBDED5E2E50D10734B7133226609B5A5EAB2811BCB7DB10EF5B0C54A02E923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 e4737f9c4b8a3a7da9425505c8aa7b5d7151e427ecd19c78d4715b4b031a5181
MD5 03d623ffe45ef307e6dff6b204c3d477
SHA1 939aa83abf9a7d01e0cfc3ce44a1080df4aeeddb
SHA512 e8fb21e2080746b1db218bcccf8e0e78c387d9c407a1fae9fab7c2161427ae4afe14f9f144e2ac9ae36a293f3bf416737c7a1950e3a25f938e2b1b6ede4af452
SSDEEP 12288:5e+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:5eyxknw4FYnshx8OfVe247
TLSH
T1CF65237CBBDEE5E2E50D10734A7133667609B5A5EBB1811BCB6DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 23628b035747d9a27bba9b0a5a16e280fd80c1bb890fb1b64f2ee13d5c9e302b
MD5 149d35b404ab9a6b98a3266d4d2dc731
SHA1 e8d207af7ae72ecc3462f3b0a0bb76f26071f734
SHA512 b7554292a95b68a97153046065055a523416229f928e278700c11c146d78f37af9a7be7e1be0767c5cf1aadafd086a3dfe8c5e823a889c742c64ee933eeec7fa
SSDEEP 24576:+fwvgk9RX6wkyAIAyxknw4FYnshx8OfVe247:qMnYIDx4x8EVep
TLSH
T15195CF29EBDC44E1E1B7913D89B3460AF6B178695B31C2CF029A536D0E33ED49D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 5a849fa74ff96eb8a68643865b62526c797520854afe99b2947939d000245f88
MD5 6ae7406daba288b779e8e7d8bbf62fa1
SHA1 4ceb094510ad8ed007b7ee1883e30adea9ebc580
SHA512 c76618551534aa9c63c68f324a63c650a2237764cbebb6d0c3158d584962cfbe78e569b9dd9459f9fdcabcef6099e433b762510ac2aba7283c53b3f2e461b9a5
SSDEEP 49152:OYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Yx4x8EVep:xySzPAix8EVy
TLSH
T110066C96A1A841D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 dd8d1aeba15f48bc743053232dd4591f2413ad3cc51a8d58d15b3e95ee57d0ea
MD5 44b18e0a113d2f3abd52afff46b3f17a
SHA1 6ab88e56289537231a90e5be382913cc62c13710
SHA512 b47bad01435b62619b72abb76530eca2ed125acd424afff48053fd9b21f18c4db7b45c87691b4d524f73cd142a40eec7f46a419a80a2b7023ff432fe52c27f50
SSDEEP 24576:S47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYbyxknw4FYnshx8OfVe247:S47JUQjqirIhCnDHUPfF/Ix4x8EVep
TLSH
T1F065AE1DA3EC01E5E1BA927885154A1AEA71742E5F31CACF1270837D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 3edf89b099ca504e2ebb9cadf461eb10fdfcdf7b3a5a5ab7ebb64a72554f7ac1
MD5 89d6d7f9b2bad27dfd1a87e1824cd4bb
SHA1 01fb5c7d023dd6fb370783375285389040dd24ea
SHA512 fd16ade44b46729cbe73f4bf7f05e655fe6c9a400846c84ca644153546bf1fe9932dea421bfe0fbb644c3f5f910fb2624f5db552b0d958a935646b786a21280a
SSDEEP 12288:X0sfc+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Tcyxknw4FYnshx8OfVe247
TLSH
T173750128E29852E4D06E2176CB625641B3237C6597F1C3CB97E0F53E1F71990ADEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 7799b95025f24d3998b5fde955784b42d5bb0a34db099978c23da49d0a60b379
MD5 21bd73b87d0a83088a19d6fd2f9f87ce
SHA1 26e57ac669f89b5690bb74441adbb0abccb31b3d
SHA512 2aa96c8a2baf82b36383ea999bcf2b0903f021f0acd4c5e0cad0449ce2d52e277eab1edd7cb7c1dbd22cc9443de56aa775a0df4b2a346e8f6a5fe2c8a9e28aff
SSDEEP 12288:e6BJmU3fEUNOUV9TBEUeVFFEupGEPEY3BZ5x1CsVmEmdEj:e6vmUP7hz4EupG9YxZ5xEsV7uE
TLSH
T1B6352850766AC75FC6AD40325E37C1CCAB707D01EE45AB0372C8973FC576668BAB2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 34bdf7c2e22dcee9031716d68e1986aad1726527dcdd890c46eef9e85b9574b0
MD5 af513bbbc094cdcd73f5bef999f7598b
SHA1 468727a174d5510c5ffe34e71ea71e65fe02c64e
SHA512 85762dc4a8175a7c339a47705858d3f77d62b084ae94afa6de62cd50031de8879b1624e8cfe796914b55f18256c29ad8a22d521d37e396656560a6f364bdfd2f
SSDEEP 6144:ZrdWxGtQtctwclBxnaIvIHRqikt7tGt8tXGtztYt1tptmPptMx2PptMxBbR/X0m/:XnKmx/YHkxkqNG5yvHQF1iQi7V
TLSH
T19B65E9815137A38FD1F66032172A9B4DAB74EC0677096F27B3C4443AD82AB25A4BD3D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 520042946b170fed792c8871b1b4701848411819c48c741f9489c7a8cff7f446
MD5 7d3852322f350012da58a5b4922d2bde
SHA1 404aefc9b935e5bf9e5e884a07c01227b720cde1
SHA512 349e45ac60e97cd84d246244e85ddebe3176093da13bea0dc8d47a72bd3b3825a506291a765005f1ce007807ae805f5f89133c3d33766dc90b6fa0537cd2eafc
SSDEEP 12288:2R70+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:e0yxknw4FYnshx8OfVe247
TLSH
T198652378A7DEE9D2F46D11730676A221360AB5B49B70C0DBDB28B14EE4B0CD0987DA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 2d4a4b72e8c31e70aaddff3126e24f7b1c612f9d99b6255891c187bf03249c52
MD5 410a20aae06edc928ae26f0c21cdbab0
SHA1 3e56575053210e02116c04b0a084df0ab1f6cf1a
SHA512 492cc5d65cc6090ebf157f6e289effa0d543c7131679b494774f14792c05e5f1236a83ef8299b088d2db707656a1a22bfbc453d086a3da0b0434b517df8ef386
SSDEEP 24576:ogb6bmBIi49WNNFpg1rSvFv7bYyyxknw4FYnshx8OfVe247:ogb4mBIBhGF+x4x8EVep
TLSH
T17C65AE1E22EC02F5E0F9D2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 26fa7781ef5f7bf6d187554b8ba8de3680924286223a09506ea372e76040aa6d
MD5 61b5fde576dc1fee0db2bc6f77d163f9
SHA1 fd8a519924c87560e2e503fb6444f245691496e9
SHA512 fd0e947eb4c025fb7f57e88776f90af73c90919250cbc3fa3c1f8f5a8b9673484ddc472a81986e240a731aae12bdfab6eee6d61bb31e1eed4bcb4ca56bb29ad8
SSDEEP 24576:xG88u8FpJqH1Izria7/mryxknw4FYnshx8OfVe247:U7ZFPqV3a7/lx4x8EVep
TLSH
T10395F16577E101F0D47BD1388A924663F6B2B4250374EBDF07AC8A561F23AE44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 32440a87e1d2450d620f392d927a876f8863ec4bc18a0a84df2ac7bffc1e0f09
MD5 8d1243d3b94862ee96707c8885e02ea6
SHA1 22e8799a6194550fff1f6ae6a72ff35fd3c842dc
SHA512 6d4acf70ac5963e5538288e1e72da2f4c00d35d696e2be9ea2e33ebb11f56baedbf83606b2feb487cf7c5b006f94142c74405638fe963b26b727a6f37196e533
SSDEEP 12288:NHvUrBFrEjwaQ3+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:NPUr+NQ3yxknw4FYnshx8OfVe247
TLSH
T19275F12E22ED18E5E67AA17D89924319F771B4621712D2CF02E0817E5E73DE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 fb7896f0da833f11045183a23a6ec6304be307cbb6e00f915401676cc6323560
MD5 a5dd8787911be0fcf07a6507c0c2cbb2
SHA1 8d6f75d45f638ef83a780fc983f683f0a842c27e
SHA512 dfd3aad3ad28db266a56c7fc7d2edf6ba46e1bc31c1ac6991c7b095f0531518e17947ea34f9940605acbbfc715a473ab00f310e7a3c67c2743a0762f5f41c608
SSDEEP 49152:JBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjSx4x8EVep:qG05lO43bbix8EVy
TLSH
T14CD5CF6E62EC11F9D0BBD17CDAC6460BEBB23425033556CB02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a97847fa213a50a438b4725e6438043a9a4f601994562e6b320b999fa8f08fa4
MD5 de9814dfec39a6816ee0b159627f7abc
SHA1 b019e423927d565c29d410f9aa465162888af21f
SHA512 45de06a9a4537bebddcccf709631ba6c15d7d4184a544be67bd21379b49f7b8bbda0fdf21c79a83e6a8c054048d01fe5831ec220cc09c25400336a52ff5aed03
SSDEEP 24576:Afa5POZ3dpyWVM50JicR2hG0lasx2+47eidntyxknw4FYnshx8OfVe247:4a5POZ3lJt2pasx2+max4x8EVep
TLSH
T14565AF5DA6FC01D5E5B9D17DC583861AF5B1342153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e54903569769903f3f87b208a4a98ec26069a8662ef400cbc3a7ed27036ab52e
MD5 9e68cc204fd451751d46c15581694782
SHA1 332a43ae21abfb7970535334f64ad6040c54687b
SHA512 03757687cf55843db38aa47cc3ee06945610d6f3959e53d9ed8d210a7aa5af58ed120c628b7a0cd58a19becb0ccadfd62014eee9449f8caaa7707af1c6097ef5
SSDEEP 24576:WNcwHdjbyQ4nLC18lb/EOjowL7FkTyxknw4FYnshx8OfVe247:WNc/zEOVHFFx4x8EVep
TLSH
T10C857B2A23E901E4E5BBE1BE89779546FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 25b34587e872732a8ccc44310cd541c558432f6af52a06a50073c76e6d71b2d6
MD5 c2fc0a76038dec5c8e2bb5712388e260
SHA1 03a277f549957d97bde6a8c884e2a07f7c104870
SHA512 e6e241407148eac119c0f5dcc69b7ff1da44fba7ed965ae60ca998fae3936762ae66b9548be3a8487298825bec8ac8e94f2ef35878041f6b28b4da967bf573bd
SSDEEP 24576:kzkNvNnaFeYhJNtmZBmQyxknw4FYnshx8OfVe247:kzMwBtOmTx4x8EVep
TLSH
T17E55AF6EBAF846E4D1FEC6B58D238112E6727461073293CB8390C13E5E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 ab90caa255f4a6a1da36d5ebb6f0a5b9c7a6156ce05d7eaf83bdedc001c13dc1
MD5 aa34d0ed6b3b80a987fb3c4537bf8b1a
SHA1 4dae29b15a095a539880325067998ea13612963a
SHA512 7a79e33c29b3aa7b00fc29a2aae047889b8449fcdebf159b0b754a2fd4d8a1fba8a97fd9eb06b89ea26553eed879a9dd1a2179552f938fbeb71429401439c426
SSDEEP 24576:WD3FHshBIYQgAoyxknw4FYnshx8OfVe247:WDVHeBIAALx4x8EVep
TLSH
T11485E17DEB9C04E4E47AD1BC8A638606E77138A9033256CB02D491BA5F67EE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/436-282-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/436-55-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/436-62-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/436-54-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/1168-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1168-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1168-30-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1168-31-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1168-128-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1548-332-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1548-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1548-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1548-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1548-99-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1548-93-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2268-51-0x00000000016C0000-0x0000000001720000-memory.dmp

Download

memory/2268-43-0x00000000016C0000-0x0000000001720000-memory.dmp

Download

memory/2268-64-0x00000000016C0000-0x0000000001720000-memory.dmp

Download

memory/2268-66-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/2268-49-0x00000000016C0000-0x0000000001720000-memory.dmp

Download

memory/2268-42-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/2332-118-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/2332-124-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/2332-116-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/2332-315-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/2880-21-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2880-81-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2880-13-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2880-20-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2880-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3128-136-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3128-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3128-138-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3128-130-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3128-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4200-297-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/4200-71-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4200-77-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4200-69-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/4308-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4308-7-0x0000000002470000-0x00000000024D6000-memory.dmp

Download

memory/4308-6-0x0000000002470000-0x00000000024D6000-memory.dmp

Download

memory/4308-1-0x0000000002470000-0x00000000024D6000-memory.dmp

Download

memory/4308-27-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4516-82-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/4516-88-0x0000000000960000-0x00000000009C6000-memory.dmp

Download

memory/4516-312-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/4516-83-0x0000000000960000-0x00000000009C6000-memory.dmp

Download

memory/5068-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5068-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5068-316-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5068-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5068-111-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5068-105-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/6616-319-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6616-152-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6616-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6616-145-0x0000000140000000-0x0000000140172000-memory.dmp

Download