a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c

Analysis

max time kernel
149s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 09:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_888196ca73a1bd8b1f019d6d8bf8443f_amadey_elex_luca-stealer_lynx_njrat.exe
Size 1.8MB
Sample261002-ln48csxvbw
SHA256 a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c
MD5 888196ca73a1bd8b1f019d6d8bf8443f
SHA1 82ddeceec36f07625890793a704d86e044dd4643
SHA512 d2df3f86fd2d461a7620ab48f8e6e4a8cc0a67e5af42f44ad6113ec28c042b074ad09b1d1e4166718228c796e49e9254b7cb8b398344741cc4a4a1fa9c1d31b5
SSDEEP 24576:1el3++0DvfeUYqcZQCGm4YagXe4i7ojhsP5Lgrk1TWb4AN5:E3ovfe41Yde30jaNf1TWbdz
TLSH
T19485E111F840E432D19201B0E6A5CBF3592CADA1EB1558C7F3D0BDB67A349E1A73DB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4524	elevation_service.exe
4948	elevation_service.exe
4464	maintenanceservice.exe
240	OSE.EXE
5196	PerceptionSimulationService.exe
1940	perfhost.exe
1956	ReFsDedupSvc.exe
1664	SensorDataService.exe
4044	ssh-agent.exe
3044	AgentService.exe
4040	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 51 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
	\??\F:\	2026-10-01_888196ca73a1bd8b1f019d6d8bf8443f_amadey_elex_luca-stealer_lynx_njrat.exe
File opened (read-only)	\??\F:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-01_888196ca73a1bd8b1f019d6d8bf8443f_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-01_888196ca73a1bd8b1f019d6d8bf8443f_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-01_888196ca73a1bd8b1f019d6d8bf8443f_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-01_888196ca73a1bd8b1f019d6d8bf8443f_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-01_888196ca73a1bd8b1f019d6d8bf8443f_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-01_888196ca73a1bd8b1f019d6d8bf8443f_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-01_888196ca73a1bd8b1f019d6d8bf8443f_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b13aa4ba7465cd71.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-01_888196ca73a1bd8b1f019d6d8bf8443f_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-01_888196ca73a1bd8b1f019d6d8bf8443f_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-01_888196ca73a1bd8b1f019d6d8bf8443f_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-01_888196ca73a1bd8b1f019d6d8bf8443f_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-01_888196ca73a1bd8b1f019d6d8bf8443f_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-01_888196ca73a1bd8b1f019d6d8bf8443f_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-01_888196ca73a1bd8b1f019d6d8bf8443f_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-01_888196ca73a1bd8b1f019d6d8bf8443f_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-01_888196ca73a1bd8b1f019d6d8bf8443f_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-01_888196ca73a1bd8b1f019d6d8bf8443f_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-01_888196ca73a1bd8b1f019d6d8bf8443f_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-01_888196ca73a1bd8b1f019d6d8bf8443f_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-01_888196ca73a1bd8b1f019d6d8bf8443f_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-01_888196ca73a1bd8b1f019d6d8bf8443f_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-10-01_888196ca73a1bd8b1f019d6d8bf8443f_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-10-01_888196ca73a1bd8b1f019d6d8bf8443f_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-10-01_888196ca73a1bd8b1f019d6d8bf8443f_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-10-01_888196ca73a1bd8b1f019d6d8bf8443f_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-10-01_888196ca73a1bd8b1f019d6d8bf8443f_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-10-01_888196ca73a1bd8b1f019d6d8bf8443f_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-10-01_888196ca73a1bd8b1f019d6d8bf8443f_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-10-01_888196ca73a1bd8b1f019d6d8bf8443f_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-10-01_888196ca73a1bd8b1f019d6d8bf8443f_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-10-01_888196ca73a1bd8b1f019d6d8bf8443f_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-10-01_888196ca73a1bd8b1f019d6d8bf8443f_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-10-01_888196ca73a1bd8b1f019d6d8bf8443f_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-10-01_888196ca73a1bd8b1f019d6d8bf8443f_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-10-01_888196ca73a1bd8b1f019d6d8bf8443f_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-10-01_888196ca73a1bd8b1f019d6d8bf8443f_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-01_888196ca73a1bd8b1f019d6d8bf8443f_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-01_888196ca73a1bd8b1f019d6d8bf8443f_amadey_elex_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-01_888196ca73a1bd8b1f019d6d8bf8443f_amadey_elex_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_888196ca73a1bd8b1f019d6d8bf8443f_amadey_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005c6e55485252dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000390320495252dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cee298465252dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000049ef208a5252dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f0ac4d495252dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c4e276485252dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006c85e6895252dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4524	elevation_service.exe
4524	elevation_service.exe
4524	elevation_service.exe
4524	elevation_service.exe
4524	elevation_service.exe
4524	elevation_service.exe
4524	elevation_service.exe
4948	elevation_service.exe
4948	elevation_service.exe
4948	elevation_service.exe
4948	elevation_service.exe
4948	elevation_service.exe
4948	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4120	2026-10-01_888196ca73a1bd8b1f019d6d8bf8443f_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeBackupPrivilege	1956	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1956	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1956	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1956	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1956	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1956	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1956	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1956	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1956	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1956	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3044	AgentService.exe
Token: 33	4040	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4040	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4040	SearchIndexer.exe
Token: SeDebugPrivilege	4524	elevation_service.exe
Token: SeDebugPrivilege	4948	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 5788	4040	SearchIndexer.exe	100
PID 4040 wrote to memory of 4820	4040	SearchIndexer.exe	101
PID 4040 wrote to memory of 2704	4040	SearchIndexer.exe	102
PID 4040 wrote to memory of 5360	4040	SearchIndexer.exe	103
PID 4040 wrote to memory of 3716	4040	SearchIndexer.exe	105
PID 4040 wrote to memory of 5268	4040	SearchIndexer.exe	106
PID 4040 wrote to memory of 5252	4040	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-10-01_888196ca73a1bd8b1f019d6d8bf8443f_amadey_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_888196ca73a1bd8b1f019d6d8bf8443f_amadey_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4120

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4524

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4948

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4464

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:240

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5196

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1940

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1956

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1664

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4044

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3044

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5788
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4820
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2752 2764 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2704
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5360
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3716
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2752 2764 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5268
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 88d2bde0665f1177c9eecdb470e749210e6740d9e11f00a3200e7f8f599eae0a
MD5 4508959b595836c5ba7ce1445a398d86
SHA1 e6a298a7665d8d37b04a439d9c5d39ea798e666e
SHA512 3a9cef488dc8ea7c9e5a59a45307679826a1de46d2fed62524365e2e93ee0f003c1224b0ced85ab2179ae36824ad1c243b873c22e4602369a213de077d63803f
SSDEEP 49152:1b+632BuPkFKRrdE6ohrstBhuXjfS4LWxnke30jaNf1TWbdz:L3q60jB5U023W
TLSH
T161D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 34fced8b953b355433039d49ed99a4322b64261739955d741c056d5c463e4542
MD5 30c17374d3b3ff146ea1cd7853eaf450
SHA1 79df05352278fb35b040f277f36ea79635a26a58
SHA512 0260d16c1fd59dc014c5717e37c7934cd7b1ad88d04a53670cbd28237ecd77c5a40bddfb6feaf4319141035a3da5f6187189701e3ca36d2533d895efa0ef3d3b
SSDEEP 24576:4XYfDtczAygXe4i7ojhsP5Lgrk1TWb4AN5:vtc+e30jaNf1TWbdz
TLSH
T1BB85F12877D409F9ED67827CC8E28611EA737C814360EB9B03E499661F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 28734c1b230acad03e2244cc51b0eb34f0040c4628584bfe1e2e3abd5f4e423f
MD5 c487627218534869b9a566f3bc186017
SHA1 0bea4b6bb3f15f552d4f69aa5dcebb924bd3e821
SHA512 f2a4ddbfa7772d16b7dca790c880a83e73acd1b84c7e70d2226961001f54eb5fcf2b3b705e04bd40a923b967af73b3fc65db30951c2e5a65d3b189dabaf07ed1
SSDEEP 24576:h0Le5ji0hmxnrMBgXe4i7ojhsP5Lgrk1TWb4AN5:hPji0Axje30jaNf1TWbdz
TLSH
T19795AE26F6748775D073C0B9C5D2A68AED71308257308ACB4286D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3a838af4c85b3a2ca2c0539dc870a58053382d2dd9b65eb12b4a8d145247600b
MD5 62d85ecf70535a994e1cdcb3da2adaed
SHA1 575b06de0722330f9c10c3761b49d8b02863e544
SHA512 5501890e7a143b3fcaea537ebc2369eaf0de6c39065574f4a2adac0436577664fa67b9698b432ac592fec2f6d5c4dbe92509f74711808380ac2a6eadbd60f139
SSDEEP 24576:1a7/ezSC6vUyD/aqgrvWr6q8wyuHgXe4i7ojhsP5Lgrk1TWb4AN5:8/ezSC6vUzPviHjyfe30jaNf1TWbdz
TLSH
T194756C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 392351b45b7291a4006bc0391809e7e4a70fdb1cf94e12e3e9f3bb44cbf07e48
MD5 9f353cad3a35641d88123b4836fe8dc8
SHA1 b988502bc250c59e6d18c2e727b2db8f2fbfb664
SHA512 aa1fd334679eabbad86500bf50a2bf3724f9c4582b38e1233a1fe5fbc93ddf442775839b7f13c281beaca8b47a2cbd54615de9d122c7a9d43ae9e1accd301c31
SSDEEP 24576:1VbqPb88hv/l+bmgXe4i7ojhsP5Lgrk1TWb4AN5:1VO88hXl+Ne30jaNf1TWbdz
TLSH
T1AC559E66F5748331D073C0BAC4D39A9AEE3234425B318ACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 346c8cc6e0f2158f9c451d7da59e277f92f6effed9c956200c2e05b8881d93fb
MD5 62c8ddbabb6944809398a4161d6e7ce6
SHA1 30d9fb88f424fd00b45db0a03e575d7898aecea3
SHA512 7b3cb292927684bd938d5c71e8962e0af6e7a8f709b4cea44c8c36ac1e2945f554778957d9b3da19d65eb57c37a25163f8afab28bae931fc4eea040a15a3ee50
SSDEEP 12288:cxE0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:cxFgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F76523929F5449C6F38BC3F4A0F7CB91E5A11EC071444E6B47E0FE9318BC89ADAD8469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 6cb00866ca8c3cd9242f4e30c76830458596c2e1473340fb994f372ed2ee34b8
MD5 1032c8a6c4d6fbb37359eb0298c04311
SHA1 3a73ed24adf5313442d40112391747932fd13034
SHA512 53402a69d6b5fadf5de2a5c3e197dbee1f890c778b289561ae29c75bb84b4079a2a8940e8e149b55b48106aa9e83bdb5e57f8695daedbb84a979eb7bf19977f9
SSDEEP 12288:KeBNUbTVO86UB0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:KJIUugXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F285CF3BEE28FCD2C27E8DB85691C740E7B278704B5293CBD164820E9E235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 78846169351e7498bc4438c1a4c4414a298ef431c4e21da931f206cfdb901221
MD5 b18e06b27ee13c230d06e3434d56a882
SHA1 fb1952efeb8c3e436d8d2ff3dfa698f753273e34
SHA512 0d7e52c52cff9a9a01a024cfdd77d5c4a32fb9b9f55a2f4ee5a0880c8914454c496c8421ba5819e8992af646f74142fbd203a9c2ec4b0e1d1127de3b2e15e3ce
SSDEEP 49152:oQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THD:oQvGAdlCEL8c/RRNw5CeU023W
TLSH
T150267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 c6c5dbbcc21a0af9c0c60a2bae3cb2e65a26be8071621fd855639bdb214bbe49
MD5 c4acffbcfdc0689861007c5041a60de3
SHA1 032ed33d05d949b41bb939ad583390d0e46e2632
SHA512 3972d301b64b2e0b8b9bb20f04fc964ef5675fb9f73de0a0b5b31809d55b52e97e6a52d145048b4b00fe8beb9802f4e4b17dbb5f6d5b58f24b2ecc6a633ad8ab
SSDEEP 24576:8oewsAj8gXe4i7ojhsP5Lgrk1TWb4AN5:FljTe30jaNf1TWbdz
TLSH
T1C585E031FE74E032C3BB0DB21B76C716586C6A604B511AC3E3E89E9E59342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 6fc5d6be2aaeb7d8ed1e4c2cba63d4d8cb88c5e0cfbe438d6caed4c92e6fd74c
MD5 28f6ae35f53f6d7a884c72850d307d06
SHA1 36c9344cf41f23bbb346f6d8d0d7e96f2cae5b42
SHA512 f0e85285cab76911882489247071bd40a2fde4340fd68e02817b222358721538f211de47bb1204ff56571a9584e2cd127868db4de542239a331b1e2ac2f0aac4
SSDEEP 196608:mUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJH7p4W:mUEtQevvqc2W1cpV2RI32N4W
TLSH
T169474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 56a05832e915611fc84f5d7b199f25687c4ddb59499424a3b4a2c306f3a74492
MD5 312ceca5b355c1313659c44c8a9b64d4
SHA1 563702a0e3724f2f589978df2a249119eabfcc2f
SHA512 17d31e4e00cf640f49578ea3b0d4916aec8bca91b8a03bdd81e026c87483be1c91165ebb07b937e83c9df1988efbadd3b1fe604069807eb9adc259da7cd47063
SSDEEP 49152:yCbRquA/m2yL5zQfFiV+XenmE3/zze30jaNf1TWbdz:XoqtVjnm6U023W
TLSH
T106D58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9a11285d6ce7eafe4f10a749f19827734052b0ad3b605af540da799cc8cdf81e
MD5 431a0d064f17470ff8969d6465451cd1
SHA1 b0e35de2692703c1374330a3f3174e875208b323
SHA512 55ef1093517f69e46e0d9423d752fd87d8182e19e39ae315cea36921650d20eb046e580e0c8a9a06ccf728fc25cfe1f8c6885ea3be3de0191f4fda8e0d05a519
SSDEEP 24576:mAhGL2IFoiwtA5l7S53jgXe4i7ojhsP5Lgrk1TWb4AN5:mAM1Foiq5qe30jaNf1TWbdz
TLSH
T1AE359D81EBF955D4F5B3AAB899B68571EA76BCA65E30C20F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 0ed4690f0311485cb82e3f954d4e61083f65a75133f4e7ecee1a59084c4a0515
MD5 61be5cd7aabb92fde91f3943785ba2ac
SHA1 21fbd479c5a2e9c469a929cc915ddf61dc628768
SHA512 2fdab6bf8d858896114df79e7a444d9dd4f77de25f56e0eb1301086bcb6f95d8fed8669bbc38aa1667e385752bc9ab93bef1403a353b37b0fe5606263cf9d6be
SSDEEP 12288:Smw5HEjsChNUBFgl0WDm+CO0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:LwulOWIgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T18485F14676A40CF9E5A78278C597C636F7F2BC412A21CB1F07A0C65B5F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 0aaed0a663c52ef8464c3f61da9018dbcba7584a17f525a470e282ec8f6e9854
MD5 0402b23f56b1d9d0003067b240d42c2e
SHA1 14c4856c2ba398bb04c96f95f4e8b726868956ae
SHA512 d041a7a574725b15a20a3678a7e1a91043ec646d92938c3338b44710402fabbea35085a1f8fa5355c848ea7176c4f92eb4a26b6e6440e3cd85cc7e5427d9101e
SSDEEP 12288:ZJZ1Iyf0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:HZupgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1D175129637D420F9E2978278D4F68741E7B23C82237147CF02A096A61F76ED65E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c84393517177c4789af6662c6982c60e498012aef0a69d0d36fbe2b32f9f4f6b
MD5 648a06bdb03d30a24bc51aebe67514f0
SHA1 34f734780fe6a4a9fca71be7870c7cdb9dca8aa6
SHA512 7a0fbf9bc2f866947235568236eb5bf2a66c86e9d2b93938cd242fd1c7c76647504c715b144226b9f298c737cb5d0ae0acf27c6c3dbf3fb8dc133f3455ab1cb7
SSDEEP 49152:Bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UX:IQRQyi36YOcPhLvw2gAf+PN39U023W
TLSH
T173667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a0823e28fb6426f7e0964120c0b63b42dda0c8c0c30038576087e72ad0cab40e
MD5 8e8763160602ff4534e4253d892336d7
SHA1 1131db98530ae46ffc3e36191b472360067f7394
SHA512 42351da0cb67cb6b2e3eb72430e07950d8b6a768e2d2c460bd7c3072d8b32ec77900cfcb5ed68278c782e33f0fe078878b18b165506a627d980222dc69719842
SSDEEP 49152:Yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UX:fQRQyi36YOcPhLvw2gAf+PN39U023W
TLSH
T179667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0c34d1b6d7a870b22cb258539f6572ab944faa908aa4e5e7ae346a8e44287f42
MD5 3fe71e10dc75fe345f26e2fe57a5d2cb
SHA1 3c289a15cce7ba9acc87a27e1e2c14f060105b9d
SHA512 6d64e29b2a804f02d79b94026cd095409563138f49b8e1248294f1608b6482bc3e032a5b22185a7a02c564d6dfa10053e8598fa2fd8ac84fbcb6f97f20ba755b
SSDEEP 49152:j68Qg55nhceWu7PNU3/je30jaNf1TWbdz:dthLRc/jU023W
TLSH
T1E2B54933B2F60099C04DE1769F4A872196E27C758FE0E7DB855172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e8f4e96b0ccfc3e2eaf8b190c1fde273262825b67fbb1268027d0e5c81e167bd
MD5 484ec6fa35b7922fe42fc6abae15d395
SHA1 ccb694671035bf8a163e934355c0dc1866b2b3ef
SHA512 ae035b282bdfa7421dd502aea8a25d44b07302fa4f73fa101e8797ae0675635e3ffa5adb3a6dae8ae0836c8c4ddeb1dd0a5bed7a220f6e0a5b3f425977ab206f
SSDEEP 49152:Z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk991:Iy5112gYy5azzVva69nLKnhZQU023W
TLSH
T143168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 27033d68cd05f2bae615244e080638f41c23b3bfa3aeff0b570f039c5100bd21
MD5 776c97318ac5580f8f2eabd70d31e6b7
SHA1 e10c410acbe8d7628fa992844a4ea0c8aa886fc4
SHA512 9e8cf30dd7e2091d5135f48cb47dfd7ce0adaf90d4c2fc2ce08c195dd57b3ad3fe1aae371f9476590f6a892ac5165304ec06ef36ebc778397912abbacbfe8343
SSDEEP 49152:zB+taZ3usBWOBr4tEG20bqx0z+n217aau1gl1e30jaNf1TWbdz:Fu6JmUxd2d1U023W
TLSH
T167D59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2fecc04f5751129fc6ae82284b60f769d424c871a4a7ea771b0eaefaacb68dc1
MD5 eab6b99b1190f2b8ffa31ef99afafb3d
SHA1 dd68f79875a5b92d19b102090b63941c51222163
SHA512 21f8a9c28689b11c1175c37bf4de879bf6e57c03df7e7a12d4143d4f816b8f5007c169f242275f98d8a8a2121c6b5dadc64f48487711bfd38e736ad571d97ad6
SSDEEP 49152:81hpsNoJpF1A6BU44CwH7R4xBe30jaNf1TWbdz:8mifPkR6U023W
TLSH
T103B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c6bec12a15c8dc273537e3cbe194aaf457d8e5cf4485ee3813f75ab200f1968c
MD5 c1d48fda0316c79a4966bd35bb161fb5
SHA1 a66b83fb2607d2918c21ddb65f6e8a50d8011689
SHA512 c9dfbf786827cd2f856a44a30cd34f06355bf381e6b7cc0edbe0c41a80455a1bd137b7db89e265bd3a5dacc5716ea957f4de67b6298f9dc8223629a9ba3130ac
SSDEEP 49152:7SuZQIY0Be2KNRVtOnks6NMHqUe30jaNf1TWbdz:p5dKvi61UU023W
TLSH
T1ECC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c782b93c7549425463537a541db410dce8adc603896555fa1bd181c5f2c3a105
MD5 5f3bf4de1102a56f404cff4ec5078ac9
SHA1 2b7c394c69ff4bd8a90622adab9380a73cb96bbf
SHA512 72123f775e1e53c9512b954fe173925e57464b8dbeea35c4ac3c8cb53ef28ad094e5c5701fd2a5ccc843cb8a667e7d8c7e56050cb29b0c862f7acd1439dfb839
SSDEEP 49152:ehtSn8EApI0figXgiDn0AP5wle30jaNf1TWbdz:/X2iyphmU023W
TLSH
T1AC95BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 f55ee7cee8abc992a5148387ca6125db54f98e5b780cf3ddad7bd8622f026ada
MD5 629013c42c00f7a7535888fd4d276681
SHA1 132035cce55ef2c5a93d82ac295115c6ba2df5ac
SHA512 e01c7ee966a14887fc750e10fff4256a7149af8732ba6a5933443893efda26d9463e98be57bec52495810b00eaf4701c268917ecea8da12ed67c799e17abb0de
SSDEEP 12288:pM0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:ptgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F7652392AE5549C6E34BC3F0D0F787C1E5E11FC672444E6B53E0B9531EBCC9A6AC84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 8f0a8b68538ad1d36c215d37357d6a1ca68f0dd433e516fe8f6b1121b38ac178
MD5 b4b85bd506090ef108f630bb29e36344
SHA1 fed829c2da0ff09f7cfa7c1c8fde99ac1297d9d1
SHA512 a5668de339d8431c7965a64c4105c99a24bf76df5b9e913905549dbe9799e1a6afabab13dc3d2dc3c5d27fc5532ec1f6e9d3cd2a14636a9eb5a5f19da9811c4d
SSDEEP 12288:VD0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:VggXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1656523A2AE5549C6E34BC3F0D0F7C7D1E9E11FC272404E6B57E0F95319BCC9A6A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 659e331e4b3fd0ec5ef085405432ed5e127393dfaec831e0a3c5e9083b362d9b
MD5 66b3c11ff98fda88d0025f6697c7c542
SHA1 dd53ea9d7076cafcca85fac24052735a01cb475b
SHA512 a90549d208fc6778f9fe156d1146cb67968bb0df9140e977ba04d952c2799da763b4209b80cc24baeff3947bfbd7d2ab62de89d8c45cd50d51c93b5e42130367
SSDEEP 12288:dJ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:dWgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1BB652392AE5549C6E34BC3F0D0F787D1E9E11FC272404E6B57E0B95319BCC9A6AC84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 f7ec4b437e98148f1780337beb46177c7da98dbf5ac73fcafa5917f5aa7ba918
MD5 8a61248b9e6ddbacbae8046a7b16d92e
SHA1 1ed2df12c832c71585bbaacabc2b510f4a0ded5a
SHA512 2d5b1b43f7746910c9df5154cfe8469f64168793858e085ce0e8a8c551f8db4a03aa04926023de28abe18a518d216fced477856d71cb28dd6fde2a3badcdec8b
SSDEEP 12288:yVK0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:IgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T15B6523926F5505C6E287C3F4C0F38791E6F13EC173114BAF47D069530EB4AD9AEA8A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 af6486c351b2a88c7c580147952ef07bc76c0b0be756f00be71fef750764c1b8
MD5 741f2cb0e5f549bfc409360fc80aa584
SHA1 7632ee9e56891d520f24e98a65e50405af871a3e
SHA512 92503f2b4d08b192b527fa40727537eb818489c156851aa07789348ce5168c2b7b9f3890e294ed1aedaff25f2be21ed397e7ac1b0c5e3fc7628c4b9b663cc3a4
SSDEEP 12288:Qi0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:Q7gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T162652392AE5549C6E34BC3F0D0F787D1E9E11FC272404E6B57E0B9531DBCC9A6AC84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 445a2fcc733cfdb5b0d8010a2ec293cd047e8e42aefc7742bd66e6113375dbd2
MD5 bbafcd559338d795482bb358eac63949
SHA1 9f40220f3d7a73866734a21233e91c0ba0db542a
SHA512 d621e10ea5b88c506d20c1a603cabbcb5b2f2b147316b45b1322be86e823683d8e2a65e2898e818f2294cbd6714db571e302fc391e569e0e93e7088d01799239
SSDEEP 12288:LX0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:LEgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T11B652392AE5549C6E34BC3F0D0F787C1E5A11FC672404E6B57E0F95319BCCAA6AC84AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 bc972bc4103140befdb23d3b55c648e06ea1647e10d3bb679d6c665ccfa38ba2
MD5 c5e95beaa638a03e935115ea8de7e826
SHA1 cb24c8ea1544e18c27763c116dd0d42b5aaa3abc
SHA512 deeac97b632e8b1c7bd77739217d4207e1de958cac60d6258e43bede962ed8510e1a1d19778f65183b90080e77ccfcc8922500b82f8bf725468e4173f395dc22
SSDEEP 12288:T70DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:T4gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T12D6523A2AE5549C6E34BC3F0D0F6C7D0E5E11FC272404E6B57E0F95319FCCAA6A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 d71f66b29fdf1548415c1354676ba90f5b09affb9c309ff3158018bbecdd9cd8
MD5 8f82122416bfa77d8bd3108cc417c82f
SHA1 1c392e8381925fbe541ec137d489bb0185792c75
SHA512 46b639d0d47b37faafaa673098e8047566092dce1f6aa41e03246f56f35b1331b09136722c2fd8e9f92d946a03719ca0457a0606c8ab2b0da38145d6703b5fb9
SSDEEP 24576:GZMGzFVSOAgXe4i7ojhsP5Lgrk1TWb4AN5:GZMGzfbe30jaNf1TWbdz
TLSH
T1EA850195B3900CF8ED67827EC8A58A06D6B27C561760CA1F03F436671F733A11D2DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 3f6ef2cee175c15abb391ac8a518e24802579978002b96eb34693e04b404502e
MD5 697551343df3fcb75b957f955621b220
SHA1 cbdc19073d699ff913de44974e895b57d23d96bb
SHA512 ab7a1236b8e908aa6d717ef5a58e54a07162b5e70ca6811edea94f34dba4d431c132bfcc5376013a754d9ca2d9e2796906f630b2c870fc678be8889189c86f47
SSDEEP 12288:D40DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:D5gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E9652392AE5549C6E34BC3F4D0F7C7C1E9E11FC272404E6B47E0B9531DBCC9A6A884A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 0a347f5c17c8054d3d3bd44b04a6cfc2f40e5b410d5768127603a76d1969726b
MD5 01cda2a6c20d29a8936cfbc96b8890aa
SHA1 62e43feaa8aa33582f04c7e21a8b7df269fc0e1f
SHA512 24cda034873b1ef0a4be00e4e13f1175c33fe2e0a131bd986086eb2d60b0062dcb459e758feb1b378c32ffff51d952be833e51426b34d9edaa970d6b3074bdba
SSDEEP 12288:r00DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:rVgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1B36523A2AE5549C6E34BC3F0D0F7C7D1E9A11FC272404E6B57E0F95319BCC9A6A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 3c5dba5df703bafe650615ec7e0a3a67d134669018155d821177efc13165f74f
MD5 1bd46460b515354b6306065803a1acc7
SHA1 5279c5651360b29133f559b9126e93e8ead5811b
SHA512 e5d166b3f41336ad7138f3539dd7447a48ba2d5311ec22e2ecde3f007b15bc784aa23432cc8d379da635059e49fd4721fbe356071b3ee11e6eafb8a4b3ddf63e
SSDEEP 12288:/yPz5L8f0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:yzyMgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1DE75025777A120E9D1678278C4E24B42F7B27C7217208EAF03A057772E776D19E3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 16e62a48d6c166870d96aed3d8b90138cb90dfdbb35e48b9229a12e52dae1fb1
MD5 7fbca1d4d8656135df55df11813ffb4f
SHA1 9c0fb8f7c068e7a983cf5854820785c10cd7a13a
SHA512 5560d7f8b3b87a1d9e4a270ff7bc462281efc3df0ff9beed748e980c31d60dcb208ebad862f54f070d3d7ddc78392030100987c90a0aa093dbbbb0b44c06214c
SSDEEP 12288:340DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:35gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F3652392AE5549C6E34BC3F0D0F7C7C1E9E11FC272404E6B57E0B9531DBCC9A6A884A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 044ec6d8f10661a4f698c4d81580192cc40725754a3597c8df6d2b4716ec43b8
MD5 860dd601e58115cd9d64294e51ef9ee3
SHA1 89f1ba609ed52d033723122bf77b702392404291
SHA512 c33fb8121ffd59b99d06ce3fed211f4eafe3295b0cfc120ec67d632c6f1a083fef9625474bdb28bf87fa8ab0efbc6f2d352e277e21b5165305220a06777fbfe4
SSDEEP 12288:H40DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:H5gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E8652392AE5509C6E34BC3F0D0F787C1E9E11FC672404E6B53E0F9531DBCC9A6A884A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 93abbfa2403beecc6891613f26ab0bffbb6e7ce557235ab08f19e6dbe348b22f
MD5 85111533585f92b34a19a02dcbd86306
SHA1 0a6aeda7f03f463fe7f65938c3f0078b4f57c560
SHA512 85083b12792246783655d09aaf7e436a70a3871993b68fdf91c267b8c53d3471e52c56130d9cb3474d6291069ac84d040d973cd29f9a0e092f51d9e6f5a03df4
SSDEEP 12288:qyPz5L8f0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:3zyMgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13175025777A120E9D1678278C4E24B42F7B27C7217208EAF03A057732E776D19E3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 364e64472ce8304ce7178789e6453458a3a8215feb4f10455f6e82bc381b12c0
MD5 04019601cd880a79ea322b58637d293c
SHA1 a55da5bc051eac5c59d9814de40f64e786cb6626
SHA512 a2b5c7e859d3d261e9a6d1b5d9c70e075c3df9a9970e0967b0604eed8867e6465e97c765676f64326f8682b4bf09b90bb4ab8640c37130f9a856a0a2a49667b0
SSDEEP 24576:AT3aLl3z0zDGgXe4i7ojhsP5Lgrk1TWb4AN5:ATKLljue30jaNf1TWbdz
TLSH
T1268502A5B3500CF8ED67827EC8A68A06D6F27C560760CA1F03E436675F733A11D2DB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 98f7233f05c9eb56115858f21f09b3fc3899f0be341c786fd956439f1af21841
MD5 e1406e247453ce4165a17c624500702a
SHA1 83fc83f2162659aa3b16ecde3e39a7148521491e
SHA512 0887bd06988370b603df9cfa2bbe62708b4577896e2e48b4917072f7be84bffb1904f9054729399ea9b50d917de37abedc4aa26fc0206629fc3c42fe8c6577f8
SSDEEP 24576:d37d9CHKy7GZagXe4i7ojhsP5Lgrk1TWb4AN5:97d9CHKyabe30jaNf1TWbdz
TLSH
T13A95CF90F3E414E8F1B7CA75C9764611DAB67C991B21CE8F03A4665A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 bdfdbc90ca0ecc7d244a1e68c74638e781d52a70b937044b02ca364da7811da0
MD5 da62debc1943a1da5c87492bdcf8a658
SHA1 a46d463a81f1960a0e1d4301b82e9911c2dc9930
SHA512 aaebad561bef6f71d493e9e2f47a3c8c795848ac189b3e6c60c8aea6fc15ea85f10d2f0681319d20d3bb5ad3aed78c811e595824dcc8598c18ee423c2242c984
SSDEEP 12288:Ep0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:E2gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F5652392AE5549C6E34BC3F0D0F787D1E9E11FC272404E6B57E0B9531DFCC9A6A884A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 1ec5b988bd025dc12db363f54adce3c50b92d0fcced60089542231521acda8df
MD5 1ef27ecf21407ecabe6bf567cb9b3484
SHA1 3ba7f837069ca9809c080dcd7e27e041c32c0074
SHA512 e98d663bc192d7984cfebdefda77794aca89ed54376cdfc55b04b201c19ba7b5401160af83737b9ce3267d0740e85194ca070b26725aee786740fe512a38804b
SSDEEP 12288:c/0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:csgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1DC6523A1AE5549C6E34BC3F0D0F7C7D1E9E11FC271404E6B57E0B9531AFCC9A6A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 f009cbf782ceb8104fef81404c0aaa8c3d0f30156b612904d8bcfffa76088caa
MD5 9bf02dde487cbdb4ef46378137e134e2
SHA1 3ffdaab884b9d75263c9f12d2313ffc856160aef
SHA512 e7bd8963da557c009c5547e6d5a0bdd90bceadd8e6942a55e224eead226c5925ba275312954c1658725400ae4f6788697ec36139a3f9724d7329f4dcfe7bbc63
SSDEEP 12288:Xm0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:X/gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T152652392AE5549C6E34BC3F0D0E787D1E9E11FC272404E6B57E0B9531DBCC9E6A884AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 3be33291830bcb8998ccedcf4471c312056d2274d731af5532596114ce3147b1
MD5 a14261b309ff598580dd9a7bae340d5f
SHA1 a67fe20af52703e266439fb7515b083de6fe4943
SHA512 6e8ea36e3dd1a5780cb7d37f3014845f63cfc13d3100600047bc74c0b683d4ccfb3372f42f794507f8152b78371439699acb9e856e4bee24549b9f44fc7f6403
SSDEEP 12288:y40DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:y5gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T19E652392AE5509C6E34BC3F0D0F787D1E9E11FC272404E6B57E0B9531DBCC9A6A884AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 49e76809b0e32ac618fe9ea7d90e66b4e173dba6a60db9d832d75829b709fa8e
MD5 30c083e12fe88b6f6621ed7082f20e6e
SHA1 8d5d790b8056676b27814fc564bcb5f613a8821f
SHA512 e38afed97816725ed1fe1c8351dd08cd448d581ded9861ed8360017e886366b96905af4b9ca92d0d99e5e8e3e681eef89dd32728cc14c0af67c0ed0e32b31ce6
SSDEEP 12288:0p0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:02gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1EB652392AE5549C6E34BC3F0D0F787D1E9E11FC272404E6B57E0B9531DBCC9A6A884AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 1ad42812c1d06bdfd1173aea2c6776637d3558e282fb85162978107e950e9884
MD5 5344b335145f13e7f8d1f9bf09646ce0
SHA1 5b55ac09682ea85ac94b570160122bd24e41f45d
SHA512 88180060bbe2dd2b72bb258017887a1b631b84dbba45da9a4788c50c0060aef546ba81f0256e258a3029f4cc2374aff624c27c742aee89b1d20d51966090bfda
SSDEEP 12288:YQ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:YxgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E36523A2AE5509C6E34BC3F0D0E787D1E9E11FC271414E6B57E0F9531EBCC9A6A8846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 153355fd85b713a50e0ebd7f73b6058e267b8e26488ae049b0b3fdb9af10ee67
MD5 fa1b830140b8fd29b9fe7d03512dae6b
SHA1 3a05adeb52f977ae35180e38fc820eef29b627c1
SHA512 4951b92954cabf95b3a6176cfd5d718ddabbdd9bbf5601827aff42eeb15c5705d6f55feae9499756f974be534d5ac30a8dddfb9f4302eeba1f802306d7d7190f
SSDEEP 12288:4i0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:47gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T12E652392AE5549C6E34BC3F0D0F787D1E9E11FC272404E6B57E0B9531DBCC9A6AC84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.4MB
SHA256 326d361f559f89ecbe2d9a220b83a85a310b542a8f63ef9b673d2a6367a616ea
MD5 d8165e427fd059c761c5f383e40bfdfe
SHA1 167fbab9fdeffac719186bdef0e5e4825c2bb3df
SHA512 1d14c5bea51681672e47d29324f6afb68e49fa4f3e6649730d2dbb1a5679ab6171219ded7d178fa83b25b61fcd5e6709d6f57d8f08aee50a84002b223ee53ffa
SSDEEP 12288:wx0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:w+gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1046523A2AE5509C6E34BC3F0D0E787D1E9E11FC271414E6B57E0B9531EBCC9A6A8846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.4MB
SHA256 b8914658cc0256c6b370a5c18d7423d2771305c820ca973c2e4559c244e2bcd9
MD5 f595e126802e1f74defab54d1c96bcad
SHA1 426586cc89a04df7b9a72f9dc87a5aeeeca1a7d1
SHA512 f9d6ca5b2ae5e43380e283070df3558293143b75b815d864eb3778ebfe7992f17b67d8e6d2b7b224de511680e444f5ea628007c7f57eb0fde5e74a81aad3a061
SSDEEP 12288:Ci0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:C7gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T124652392AE5549C6E34BC3F0D0F787D1E9E11FC272404E6B53E0B9531DBCC9A6A884AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 b93f04945e3a9048769cb1866a6a4777adb17ecb00df81462e3582db679376a6
MD5 e049606e8c12ee0d5ccdb33dd3b95839
SHA1 89b109562fe1811fc3faf4c973b3b3f96de50c25
SHA512 f434ad0ba101f336df7d36e2355de606e9f0ca49286a593e611653b7d4a2f547ac5f244043f5caffad128bf392d1d808abaf7d25da20992e3ba0eab7989b555c
SSDEEP 24576:qfwvyk9RX6wkyAIlgXe4i7ojhsP5Lgrk1TWb4AN5:EMnYIwe30jaNf1TWbdz
TLSH
T1A895D029EBD804D5E1B7923C99F3460AF6B178591B31C6CF029A53AE0E37ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 ac2962b95eee07ef00d0cb7ec704b5cdb2f83a6e35f93990a4dfa2a07935b988
MD5 18288ad2c4e6df2a3ea3bb53c99b6616
SHA1 696f20bd3467b6e2b1307eab8e63c6f24f812314
SHA512 d3cc38b057491f35ac996f399fbab2319290d3cddbe3b6733dd1c4755e4396159bd977e3d85867a5790517291a374b53fade8dac62a72a8b1fe09437548301e1
SSDEEP 49152:rYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Fe30jaNf1TWbp:VySzPdU023W
TLSH
T124067C96A16801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 7151edc2dbf0ece5c446e89c39236ae8776c8d2604343fc73bf38f02f9d54db4
MD5 dcf927292c8c6e8ff97905fe75528b44
SHA1 a9f9a76a179b38ed8b4d9b42e2f15e45e5a5a1cf
SHA512 7a6945bc4e8a163ab7b6748ba1cc23f38a2caeb1588605ec4e246f875fcc0b517f71bf89682ce6dd37996935fda65a51d43d992c7abf4617daf0f25409f751ee
SSDEEP 24576:047Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYQgXe4i7ojhsP5Lgrk1TWb4AN5:047JUQj4irIhCnDHUPfF/1e30jaNf1Te
TLSH
T10E65AE1EA3EC01D5E1BAC27885554A5AEA71782E1B31CACF12B0837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 617bbe68dd2c9eeeaba8f77936c4f3b27f6fb7a140c77abdd5094094fd7342d5
MD5 7791667fdca77861d3023d228d3e0760
SHA1 d1e6cdd6c61eeabfccc7b7d35d2cad870613d785
SHA512 6886f7f3838111f4a618f873440475e2d8b5aca4a9225eb953e4898b02aab99b1473a24ce68084d6cb784c3d0b797592c58639df06a3b3d321bd8f3795aa474f
SSDEEP 12288:wAsfI0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:SpgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T12675F05AD29802D8C05E92B5C3968A41F3733C9193E1C7CB53D0F93E1F79A949EE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 d78e9403bd8c344345a1798e1fa04279794f6625f75ebf5137d4cd72d3d97f88
MD5 fd5e47f4be7a92a0103aaf2810dd6907
SHA1 b5d2adf602097d20c2f9c516d4c7ab6b62c43da9
SHA512 2b125bb145caa08436cb710c2050466fdca5f9e1bfe15d8c0e3b4d05cc6cacbe2733c0f6bbdcce45480553e407cb71c5e43a53cabd2273000e47d5ccbd06ed06
SSDEEP 12288:nsgp7XZU3f7TcA5hOpSGNWEN1S0JEApXNzxT:nsg5pUP8myNWENg0npXNzF
TLSH
T1053528417666DB4FC6A840322E33D5CCAB707D41EE056F0373C9873F9576A58BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 70440c90b2afdb62038114dd3556bdbfb0b7051f103b5f62f80210da81a42255
MD5 b22a1cecc9fbf9bd4ea3bbeafb5c1ea6
SHA1 c527a90023556554e21a3ef9d1923616a3966ed8
SHA512 e784444528d560ed454c9bf3d0fea7f7e3734855fca935a6670ed01e38371c350442d473895ea89f4705477175f08e58e1727f63e5db8e40ef6ec403e4e9a78e
SSDEEP 6144:o93CcifpKXBnyKAcpzCcOqT/3YisUQytMxod4yphLjSrSctbMrkQytMxnTmW:o93Cci4Acp2cO0vpbHSrSc2rt
TLSH
T14645D8815137E7CFD1BA5032032A5B8C77A4EC06B7496F27B389453AD82AB55B0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VentoyPlugson.log

Path C:\Users\Admin\AppData\Local\Temp\VentoyPlugson.log
Size 372B
SHA256 74aa90c68fd2cf1d0f488a98f08b579f1c35e17f257f1aff8226d34a67dde493
MD5 80343990e18c904742248c3cf784a4c7
SHA1 59ea322f5086b7296def86a99999f8867560f8f8
SHA512 9fbe170d552a55d7c8b261034b00994e2bcc6222296143b6bed68d80b788f9047732e7f5565fd312e5a7874641798ee05e833c649186a5a6225820ff2e0bab32
TLSH
T197E026A01DEDCABB00085237174038889D68145E664B2B4867C0CF09686CB48BFD2184
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 3c1e796cf03ab4197ecc61e91e2ef606cbbb93601cf47ec3b799105423bdc3f4
MD5 4fccaf0a14068116fc3909d0b2529595
SHA1 fb6f0d51732d803a3aba7d6c5e6918f371e1c17a
SHA512 eb16ad1f02a164407f1e6e583ea9cd1493911da11dc65c0a09b5c6f5a948fc47f9a7fc594586e5e2e3d625afa71c0f374ab6c6c693e32159b23da4d808f4914a
SSDEEP 12288:Z+7g0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:chgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1536523629F584DC6F29BC3F090FBC760F5662EC0270089EB52D0BA9319B8CD99EB451D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 5c1616c78d24671a134c6f37670e9e71334d9f7e24f0da100ece93e0c2bac49d
MD5 79caa45d198411e76e402a0bfc47f816
SHA1 100a5563334678607cfcd501f2aad2b58ec47d67
SHA512 78f997a394e7364cdca9cd8e5ddca466d05851ddf21c9c1cf72080db4940879211986922364a7d0d7b2c6c6201156a8eba343ddb4d2797ffd81c2576ba600f3f
SSDEEP 24576:pgb6bmBIi49WNNFpg1rSvFv7bYHgXe4i7ojhsP5Lgrk1TWb4AN5:pgb4mBIBhGF3e30jaNf1TWbdz
TLSH
T17565AE1E22EC02F5E0FAD2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 38e344c3a09f6e91f22096ad009029870d2ddc5588e84dd281b6415908d07cd9
MD5 9c50344954c106a2dfe34b6e2eff2e50
SHA1 d1865cc697c5c4dc8bcb4e6c164f2f59ca0394d4
SHA512 5d6ae805952c8aebf29ea4a27695780351629d34c49435f6cb8d8f3be826b11e6b07a12e0dd6f3782ef343872c7f53037a9040cd85b80bc09e05da6ae04175f3
SSDEEP 24576:DG88u8FpJqH1Mzria7/mAgXe4i7ojhsP5Lgrk1TWb4AN5:y7ZFPqVra7/2e30jaNf1TWbdz
TLSH
T17995F16577E101F1D07BD138898246A3F6B2B8151364EFDF07A88B521F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 02ddee44d60e3c9c003cc1cae329b9b48fb9b4c6ce848e47b66d2881f961a78e
MD5 6f5887625aa27281bc1f0f9ab2cd387d
SHA1 bf6e92f3e74da6901f8e7ed1add13d22012b8d18
SHA512 a92d6c2c0ef67bea7a47eb261c536b803fd712f77b61070e72552d571b73cbf2de046782c53712c4b3a65f5cf263b40cfb78c371d7ccbc102d645d0d633431a0
SSDEEP 24576:kPUr+NQUgXe4i7ojhsP5Lgrk1TWb4AN5:kJQbe30jaNf1TWbdz
TLSH
T1A485E12F66A818E5E27AE17C85828719F7717852131196DF02E0817E4F67EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 0c56917b568f18691ce1832adf5e5352af3b413cfb7bbe8fb680131844067c6b
MD5 1f8b293eae24d627b7c225b18e4ff1bd
SHA1 526b835bbaeecd091e9ec2e628a4fcce182c064f
SHA512 3a814d3e1a9933d23b9a78dae95aa7b4c4113918f2338dd4dadab4c77d80b9fa0970c60b89958129bf4b38ba6c83e1abade19dbb03305110a32e902b5166bd92
SSDEEP 49152:FBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjre30jaNf1TWbdz:OG05lO43bYU023W
TLSH
T1DCD5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2057ac4aaa47fe8a554966b4b5f82241631c2805cb400c82de7daf5b2d52c0e8
MD5 ff587eca811f6bb7c5b31cf4a5ce6010
SHA1 6314f208c914047fe1245afb75a37adf2c934010
SHA512 7134e1c8e87587a33b470ec362e1b68777eb31a2b5a397b282cc3d33d59b2ebc32a2e755279de3a4d0959d1d4b730962a234450f82822bb80550a199f441b2b4
SSDEEP 24576:5fa5POZ3dpqWVM50JicR2hG0lasx2+47eidnSgXe4i7ojhsP5Lgrk1TWb4AN5:pa5POZ39Jt2pasx2+mje30jaNf1TWbdz
TLSH
T1F365AF5EA6FC01D5D1B9D17DC583861AF5B1346253319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 0f6713b8928494837841f7bc355503b15cfb5363f1503dba50d0e24c34ff5fd9
MD5 f4bec28dd686d74b4eb566b3decbf686
SHA1 425598a82b43f656cc3a0fa7b3b56f9405fdcd2a
SHA512 39ddc857b6415bec654760a4d99fee8be4171cd54b2f0bed88962f6a2884f026a43a01ed7684ddf41a881899ac24ddb30d36eadb8e6d832cbc4a041ea28b88ea
SSDEEP 24576:xNcwHdjbyQ4nLC18lb/EOjowL7FkogXe4i7ojhsP5Lgrk1TWb4AN5:xNc/zEOVHFWe30jaNf1TWbdz
TLSH
T1A8858C5623E901E4F1BBE1BE89779646FAB1786513308ACF0291851B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f53ebc2677ed5082fec7dee37f467127cc8a65392ef7d8ddddaffdd77efce29b
MD5 ccf00f8a3233c085f5fc57699c31ad26
SHA1 032cf408111994caaa3e65337bdea68b54498101
SHA512 d37673aada7cdfdee81f7ae59caacd1dfb3c0fdddf8cd94c45ef4d01fbc8cfc3192c7827673286e537569898a994e76b702db0da75773aa22fe9d1f48c34ea80
SSDEEP 24576:jtkNvNnaFeYhJNtmZBm+gXe4i7ojhsP5Lgrk1TWb4AN5:jtMwBtOmRe30jaNf1TWbdz
TLSH
T10055AF6EBAB806E4D1FEC6B4CD238512E6727851173293CB5290C13F0E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 d07eab2b9c699a31dd26cffe0f93f92b3fc239bd872683ef796d66d8d9a439cc
MD5 a994e7b4fa1e985dd4d9c3a48011854f
SHA1 9ee81412e99b250b7c42431bc0d90d79aaca0beb
SHA512 c74c191eb0a618a7775b8623b7d225d23029c878567705914706333eb33838c9ceddb8f7038d7b76e31e736937a8a79978686ddb7fb43603da1f51860bc53cba
SSDEEP 24576:AD3FHshBIYQgANgXe4i7ojhsP5Lgrk1TWb4AN5:ADVHeBIAAIe30jaNf1TWbdz
TLSH
T11395E17EEA5C04E4E57BC1BCD6A38A06E77138A9032156DB02D0D1B61F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-65-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/240-60-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/240-58-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/240-217-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/1664-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1664-106-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1664-112-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1664-367-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1664-370-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1664-372-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1940-332-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/1940-82-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/1940-87-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/1940-89-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/1956-92-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1956-385-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1956-387-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1956-354-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1956-100-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1956-98-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3044-138-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3044-131-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3044-140-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3044-145-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3044-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4040-373-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4040-148-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4040-154-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4040-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4044-126-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4044-119-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/4044-369-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/4044-121-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4120-12-0x0000000002220000-0x0000000002287000-memory.dmp

Download

memory/4120-3-0x0000000002220000-0x0000000002287000-memory.dmp

Download

memory/4120-7-0x0000000002220000-0x0000000002287000-memory.dmp

Download

memory/4120-81-0x0000000000400000-0x00000000005D5000-memory.dmp

Download

memory/4120-0-0x0000000000400000-0x00000000005D5000-memory.dmp

Download

memory/4120-258-0x0000000000400000-0x00000000005D5000-memory.dmp

Download

memory/4464-51-0x0000000002B70000-0x0000000002BD0000-memory.dmp

Download

memory/4464-42-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/4464-56-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/4464-54-0x0000000002B70000-0x0000000002BD0000-memory.dmp

Download

memory/4464-43-0x0000000002B70000-0x0000000002BD0000-memory.dmp

Download

memory/4524-17-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4524-104-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4524-18-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/4524-26-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/4948-30-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4948-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4948-118-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4948-36-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5196-70-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/5196-247-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/5196-77-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5196-71-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5360-384-0x00000216AF8E0000-0x00000216AFA11000-memory.dmp

Download