40d096d5663d12e993ce098a19d392e1660d11a8a18d6f38b9de1e63134a2e55

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 02:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat.exe
Size 1.7MB
Sample261011-dew7dscg33
SHA256 40d096d5663d12e993ce098a19d392e1660d11a8a18d6f38b9de1e63134a2e55
MD5 c51a79e5c6dac5659a15720e1a3d56b8
SHA1 6778a7f7a75aa54b7e7354046b8481b145f88287
SHA512 ff5f5d1897ac58bba3a3b4e34faf4202efc605a59853228b1fa438eb72c230bd377df26825817a62294bc1f52ad35311346316b710cd2000a69fac00ba57ea38
SSDEEP 49152:0k46/fl+CrLR+ft983Dl3gEe8xA+y+bHNvPZumqUIWPLXFKo:r/f0CvR+l9EDl3VxA+y6umqU1LVKo
TLSH
T131851210FC41E032D0A205B0DB65DAF35938AD61AB5494C3F3E07DB6BA349E1663DB6E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
824	elevation_service.exe
4124	elevation_service.exe
4320	OSE.EXE
5504	PerceptionSimulationService.exe
4564	ReFsDedupSvc.exe
1960	SensorDataService.exe
2392	ssh-agent.exe
3316	AgentService.exe
1148	SearchIndexer.exe
5708	perfhost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe

Drops file in System32 directory 60 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ae1b58174b315ee3.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	perfhost.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\ae1b58174b315ee3.bin	perfhost.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat.exe

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2184-0-0x0000000000400000-0x000000000079D000-memory.dmp	upx
behavioral2/memory/2184-61-0x0000000000400000-0x000000000079D000-memory.dmp	upx
behavioral2/files/0x0001000000009384-177.dat	upx
behavioral2/files/0x0001000000009344-274.dat	upx
behavioral2/files/0x00010000000093d3-275.dat	upx
behavioral2/files/0x0001000000009cd1-281.dat	upx
behavioral2/files/0x000100000000a2bc-290.dat	upx
behavioral2/memory/2184-302-0x0000000000400000-0x000000000079D000-memory.dmp	upx
behavioral2/files/0x000100000000a1cf-288.dat	upx
behavioral2/files/0x000100000000a0c9-287.dat	upx
behavioral2/files/0x000100000000ba38-286.dat	upx
behavioral2/files/0x0001000000006215-285.dat	upx
behavioral2/files/0x0001000000009b8d-284.dat	upx
behavioral2/files/0x000100000000df1c-283.dat	upx
behavioral2/files/0x0001000000009cf9-282.dat	upx
behavioral2/files/0x000100000001b990-280.dat	upx
behavioral2/files/0x000100000000994d-279.dat	upx
behavioral2/memory/5708-412-0x0000000000400000-0x0000000000555000-memory.dmp	upx
behavioral2/memory/5708-423-0x0000000000400000-0x0000000000555000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	perfhost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	perfhost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	perfhost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	perfhost.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	perfhost.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	perfhost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	perfhost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	perfhost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	perfhost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107515\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	perfhost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	perfhost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000418b0f172c59dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ed780d162c59dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000063ff4f172c59dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003233d8172c59dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f466dd192c59dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000549139592c59dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f86b61152c59dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008db900162c59dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c233a9172c59dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
824	elevation_service.exe
824	elevation_service.exe
824	elevation_service.exe
824	elevation_service.exe
824	elevation_service.exe
824	elevation_service.exe
824	elevation_service.exe
4124	elevation_service.exe
4124	elevation_service.exe
4124	elevation_service.exe
4124	elevation_service.exe
4124	elevation_service.exe
4124	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2184	2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeAssignPrimaryTokenPrivilege	3316	AgentService.exe
Token: SeBackupPrivilege	4564	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4564	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4564	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4564	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4564	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4564	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4564	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4564	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4564	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4564	ReFsDedupSvc.exe
Token: 33	1148	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1148	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1148	SearchIndexer.exe
Token: SeDebugPrivilege	824	elevation_service.exe
Token: SeDebugPrivilege	4124	elevation_service.exe
Token: SeDebugPrivilege	5708	perfhost.exe
Token: SeDebugPrivilege	5708	perfhost.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 5556	1148	SearchIndexer.exe	100
PID 1148 wrote to memory of 5244	1148	SearchIndexer.exe	101
PID 1148 wrote to memory of 3656	1148	SearchIndexer.exe	102
PID 1148 wrote to memory of 4916	1148	SearchIndexer.exe	103
PID 1148 wrote to memory of 2372	1148	SearchIndexer.exe	106
PID 1148 wrote to memory of 5624	1148	SearchIndexer.exe	107
PID 1148 wrote to memory of 4476	1148	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-10_c51a79e5c6dac5659a15720e1a3d56b8_amadey_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2184

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:824

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4124

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4320

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5504

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4564

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1960

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2392

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3316

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5556
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1262770251-41185387-1005173349-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1262770251-41185387-1005173349-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5244
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3656
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2968 2996 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4916
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2372
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5624
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2968 2996 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4476

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ab70174bdf5b1fef9331de60d20fca19f8e93253144063936d9d203427478d8a
MD5 b396e66d32ba1ce46d70823c33270e15
SHA1 5e5bb95d2cbf19f9888056b014cd56dce327d3d4
SHA512 38ec704782b078a11480478258200dbe27bc20cc07f8baf4f293c3a56e84304a06ad44bb46eba1a4a707e7a09e33bca94f0f05d0f77ed8e3217deec3a7c438cf
SSDEEP 49152:Zb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnhR+ft983Dl3gEe8xA+:v3q60jBWR+l9EDl3VxA+
TLSH
T1C0D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 cbd6c0c5535af9a596b6f166246964fb387a45ee9e99ba8212a3841b1b86e4e3
MD5 712f2864c3296cf2ae12f09f6a84e8aa
SHA1 749d784ad3f4a26b62ab4ff49a79f73742bb0e31
SHA512 e29bbf7987714fcc8cbb43150aa7b2477869bbf433ffcb42bf7d2e46584e259666bad52e71bc82727227c501c0419ea4618218405f8031de4b761be3406220e6
SSDEEP 49152:lfcubHNvPZumqUIWPLXFKopR+ft983Dl3gEe8xA+:lXumqU1LVKopR+l9EDl3VxA+
TLSH
T17F7512247B9909F5EC6B81BDCDA2C511E633784907E0E79703B049665F2338C5D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 617cd40f97562ee758d660eac90045de174836f859e83ddd28252cba86a23ef1
MD5 f67a5bd884ee208e8b8dac2b339727db
SHA1 4446bace79a053187f20d7419d28c1ffc689cb31
SHA512 63a8d87444c4269c6916567bc9559f0cd08a310c497c5dd1422abcbf396583f2835dc56f3fe35cc729a9730588c8815b8ec304459f5a25fbee71b56fd57b53c7
SSDEEP 24576:r0Le5ji0hmxNrMJRPWxNs298r3OCDIjG3gE9ow+8xA+:rPji0A7gR+ft983Dl3gEe8xA+
TLSH
T18635AE15F6788331D073C0B9C5D2A69AE97230865B308ACB4286D77C7F67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6c4e3f05db3b9bc907158c116b09459ba0857a3cb3e155c540577a37e5306975
MD5 36da91648f01ed3a01c2a2c413d20eab
SHA1 e9d9159e1ab3360c86dc32dfd9c2e6d29c5f0b7e
SHA512 2a884074f3e6d853ec0a782006839daad1711929198e2614cb8e97ff38815d2df1d0e6781b4c768fe516fe2c4c5fc194e683aab58d5b8e0bbdfc0f3dc1949168
SSDEEP 24576:Ga7/ezSC6vUyD/aqgrvWr6q8wyuTRPWxNs298r3OCDIjG3gE9ow+8xA+:R/ezSC6vUzPviHjyUR+ft983Dl3gEe8H
TLSH
T1A0755C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 cfc18b8a4e4c70d32baf5cb99b1117ee541dd3d2c85d881d15b847f1b7896df5
MD5 448cce7b094dcb6dae0946477a103eed
SHA1 9d52c717ff10ec1c978331e6affd7e25176f2d65
SHA512 f78da36db575b3d6f2a2c46da3e6d6c04fdbabad8293274152685b5085634ae08e91ac6ce211c58dd93f5257eb5f8d6c9cf746f2f45733a1da7e4b194ba34f4d
SSDEEP 24576:BVbqPb88hv/l+bmRPWxNs298r3OCDIjG3gE9ow+8xA+:BVO88hXl+SR+ft983Dl3gEe8xA+
TLSH
T12455AE66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 1365aee7862bea3083217b4c57dab9c47d64580651dc31c8322119befcee6c53
MD5 7aad5774aa3152849cf682d1ec609dec
SHA1 02e3f2cf457e72c8a50c313fe82f290eed657f4c
SHA512 66e52eb87ef2806b5f8aadcf3a1a79ce5d027f14642ac0ccf2b7381c336c9286d408e941a0774fe900b8a3256bc8faa4247ef9d1f10a9b2a50261a581b137ff0
SSDEEP 12288:4jVRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:4jVRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1B1C423042D4C35C2DB2F81F59ACAF0F2A0339D4D28F939F2D461AAA1AD7D65ED980177
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 6a61c204321a5907ef4968bb3d2c5c3c040db2dce2d2114df38e54309d3ebd52
MD5 5ab05af4a1ec5bb6d1a922df0986cca6
SHA1 5b2b4b65552077225121b11dabca73089f0ec3b2
SHA512 2337a99254f36f162b12ff713b154aff36d288fbcf85d7f7e5f1fac16bca17d8786ad5c0c15a8b42483d1ab9d14fa2345b57799c532f8f333fa38fc7ed9b56f5
SSDEEP 24576:4JIUORPWxNs298r3OCDIjG3gE9ow+8xA+:4JIUOR+ft983Dl3gEe8xA+
TLSH
T1DC05CF3BAE28FCD2C27E8DB95A91C240E77278304F61A3CBD165820EDE235E55E75C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e3b7522713d6a00219e9e47db679d913922f70c01612cc9b2cae090466ae0158
MD5 8ba06fe74af1512c4b28a656c6cf0c85
SHA1 088d9ebe2d4f1f5c8baf6925f81981dc00e77e15
SHA512 79442793d646ef8906cbea3aa68d0453329483fa0bcfb48886c82014c04d0a8e5e65b648c44e8afdf9691380fe93579496492a32cc898b233a022cfbf1c77abc
SSDEEP 98304:DQvGAdlCEL8c/RRNw5CjR+l9EDl3VxA+:svyEYc/R3w8j4sDlF
TLSH
T1D9267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 3c442ce2395c7f3a60cfdf938b9baf7c9fdac26644e0ad4e8d68ed72bf0293b3
MD5 929a7cbda7becd96e6a1e9d0dce17cc5
SHA1 1620134f96a77c4ee31d7c559023264a3e5901b3
SHA512 59e3c86a683e4da211becf341e4af7b69aa97a5ef277971899cbc79fa829326a32350de6b80d4e6f530a40d049aea899a91ae80393082a752d173a6dcbfc6f06
SSDEEP 24576:QSewsAjwRPWxNs298r3OCDIjG3gE9ow+8xA+:DljwR+ft983Dl3gEe8xA+
TLSH
T14E15E030FE74E032C77F0DB61B26D716543D79204BA129C3E3A88E9D59342D26776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2cff3015e327836ad3a0174ad906d83fd74294107cc7edc6d240280145d5f286
MD5 caabafe96035fc0638c6ca359acdb5df
SHA1 88e9ed6afc94b2adcb494935ac681b25196c70fc
SHA512 ab1ad6ea082f5548e271ee9470d56d74de007100981971c5e6f9a0bb59a168d92fbaa91bf1c739015eae84224f71d4d158e294947d75b24f7bc86ccaba3e94ab
SSDEEP 196608:7UEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHI4sDlF:7UEtQevvqc2W1cpV2RI32e
TLSH
T1C0474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 03dc79292880b0bcb40f35f0918e5a38c099fabc46f7b017e6deb50904b091f3
MD5 943bbc14b19e9a6c9b78c07be99dc446
SHA1 20508fbc1b8e31073be3d795d440fd17f47a646c
SHA512 71e3046815581d5c12655f4902817213fda389599ce83f809c70433caf5cfefe710eb7daaa237b8af69e407ed5bf322101496f5eff2455094eca79979097bb64
SSDEEP 49152:UCbRquA/m2yL5zTfFiV+XenmE3/zQR+ft983Dl3gEe8xA+:9oquVjnm3R+l9EDl3VxA+
TLSH
T1F6D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f78d11220d092eb5d12d6c516991e1caa56d044cb3b6db81d0f34e94ee61eb7a
MD5 e575dbebba424060abd1a4eecebea5c8
SHA1 cade35f2ff4a536754c0fe5ae441676ea3651dba
SHA512 bfd8eefd9819097bdf07fc2c7cc28d53ed034d7cbb26125d107523f141eab9b0451c413df3e7c87af3c73e416d1f212f0e9fea8dd0d4ebf8d6948d11f9bcd19a
SSDEEP 24576:/AhGL2IFoiwtA5l7S53XRPWxNs298r3OCDIjG3gE9ow+8xA+:/AM1Foiq5HR+ft983Dl3gEe8xA+
TLSH
T1E335AE80EBF955D4F5B3AAB899B69171EA76BCA65E31C20F2150C11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 14913c9ac74339701cde4f607583aa1dcb2109a55cbff22accd0322a8c37adf2
MD5 ddaa8169ae6242f94c24468d540df047
SHA1 f4bc0f17120de732c4752294a1697f6f15055f13
SHA512 e106e516afd6eea7fd353a7f32a610ece2f91e1aac677a10707cea1f93c77066bc41221d84fdedc98e5067255682f86b842899838bba38a9e8517310252954bc
SSDEEP 24576:swuXOW0RPWxNs298r3OCDIjG3gE9ow+8xA+:swsObR+ft983Dl3gEe8xA+
TLSH
T1D805F1453A981CF5E96B81788687D132F7B3BC022A75DB2F4760C65B6F37321AD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 cc1a62e71c4af780d3caf8c061de67e32693b0d5288f2751a37d45fab4acb718
MD5 f72b4d0f08e3a5b0eb3a19bfe5fb98ae
SHA1 ab70ecf5f37dba458abaf659d31aaf1bc1d8b7e8
SHA512 046e09eeee11f99aabb0d216c0dc593b297d31545adbe03f0ca6dbfed34bb160e7449012b8caab8aca0dfbb12c8bda343054b34420fe2d6f1b3d8e46d31289aa
SSDEEP 12288:r/Z1IyARPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:zZuxRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1C7E412493A9C30F2D66B82BCCDD5A141E332784627B513DF542186A66F37ACA9E35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 8b2f2cae1f50bc02b11745a063526b7f758cff651340eb1b8014d899258833af
MD5 c047d6b25c19aeb2fac3e5a2548dd826
SHA1 e7b4a1bc091c3bbb33ebd1a394c8fd12d62829f2
SHA512 3ab55b301f67388df33539367fc786ed31112b46ee3b22c2274a50d6a84c126a1804f5bc49cebd9959482f586cb32d8da907b3fae85a575f06ab12f64cf76d02
SSDEEP 98304:PQRQyi36YOcPhLvw2gAf+PN3iR+l9EDl3VxA+:+QyiKahX+PNS4sDlF
TLSH
T11E667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2b317c4b96eedae4c52aee1ef7dd3fac77392c70b04efb124f4b4b5ec78c8470
MD5 3f2385f85fde245ac89a2ed3c6af538a
SHA1 c6835f1b1aefdcdff37077bc9d799b3fcf1f33b9
SHA512 7614e0b0830f9ec24501c363e0eea6072d96283bbd2d667521345b9186bf3a489d81a003e697a54f47d2114b51dccd73064f0fa5089e5ca1d5766184b994da51
SSDEEP 98304:dQRQyi36YOcPhLvw2gAf+PN3iR+l9EDl3VxA+:UQyiKahX+PNS4sDlF
TLSH
T10D667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8ea404ef75ce03bd704acffe9054888450649259199d89d186c90afdd026394f
MD5 c30289a652b925e399289f9c3abb692e
SHA1 e3b3e15f215a1fe5e0416fa0797f04f8e07a4be3
SHA512 4ed9cc41842da1dae459e7cc2f20ab497bd9ff9972e96fb45027736dffb1495ea865322bd5910959635d15ad1d59c32e2a8b757d87bc346342d272f623fa1cf0
SSDEEP 49152:e68Qg55nhceWu7PNU3/gR+ft983Dl3gEe8xA+:sthLRc/gR+l9EDl3VxA+
TLSH
T1DAB55933B2F600A9C44DE1769F4A973196D27C758FE0E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d0653b6b694568954101dadf287d6c663e513f3fe3b7f8113f66575deb059def
MD5 405803bea45333aade9638ac4b692732
SHA1 324a8fec1d9e43e04498f62afecef8ddf21dd5f1
SHA512 b2d8d2d9dcbef5308ae1e59956748ae2151b279123f4d9c55a63916da747f5a6a453e95125b36ac2c0a915a82bfcb70364fd125aa326a00295d7e4403cbea506
SSDEEP 98304:yy5112gYy5azzVva69nLKnhZVR+l9EDl3VxA+:7LIHjWhv4sDlF
TLSH
T1F7167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f0c980d32bba46c441d459fce59908b212b1dbd286354c062ffff158b0888f63
MD5 40965b5fcdb2c9126c2ee0db92e9483a
SHA1 119eaeba7681ebf3523c2e0c4adc995003ce5f04
SHA512 2af3f230a62222d0ebdddc29c4c0fc6edd25a228cfc2304721b7e735170b1149a2e95bc60501a599927e7d7d1982be446b0605c3b7f8913fdec575efefaef967
SSDEEP 49152:0B+taZ3usBWOBr4tEG20bqx0z+n217aau1glqR+ft983Dl3gEe8xA+:uu6JmUxd2dqR+l9EDl3VxA+
TLSH
T19BD59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 31affd47fc06f4bf338dca5f808e17ee1401f3a5744f39559e8554b29df4413e
MD5 7d0cec43c961d90ed63a0e06d9b6600f
SHA1 f461229087a11a559f3a0ee989869da03ef2fbce
SHA512 75dda1e24954ae4050f147b99008161731f0df1f3a371714c1547c186e8a992d73ca8a8b6bf75719afdd773466a0ad41e5fa3484e088e1ff8af10c32b531599e
SSDEEP 49152:T1hpsNoJpF1A6BU44CwH7R4xuR+ft983Dl3gEe8xA+:TmifPkR3R+l9EDl3VxA+
TLSH
T155B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c34abe8f4f10dd8a583cd514c117fce2f3a06b1a3407f147786de04c15e6c590
MD5 f16ceb5b9ee4292a6710db4896e7532e
SHA1 9cbed85bc96a389254d2daa61f0081930a99219f
SHA512 fa2bf3fcde07c9f39e70b5878fa7259977f13115019d015756f0a850c59d91a7d5b245ff04f88383d3edb5e5c75654ce38cdb6aa57c7087c4109c1cc91ec2c54
SSDEEP 49152:0SuZQIY0Be2KNRVtOnks6NMHqxR+ft983Dl3gEe8xA+:m5dKvi61xR+l9EDl3VxA+
TLSH
T191C5BF03F2E941E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1adacc9f1dd5197e3f039e6d82ce19f1a72257ab55e0193cd9985b353b5c9dbc
MD5 319e832bc84ab9118ddcfccbcb2835b5
SHA1 31295d86d763e116945a88ee1cefc648667570c9
SHA512 40a37b611ba6234c9ad549c0b99035cc4f2936fd031b18656c91dc4809f9041f642201fe09fa46b3a8a8146c4f12b4a7fc2c82680239490eeace7c67fbd5b375
SSDEEP 49152:uhtSn8EApI0figXgiDn0AP5w6R+ft983Dl3gEe8xA+:vX2iyph7R+l9EDl3VxA+
TLSH
T19B95BE13F2D901E8D05ED178C7468632E962BC160B35BAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 185a967674eaadf86160cb8a1f869ef8d3620cf238c42809120fd3ab215c9c3d
MD5 428e1a34ed5a1093f82fc54e5f15c809
SHA1 af71305e5d0d07e0e280790229b23c2a322b03dd
SHA512 44fb580f1306f44cd7a34bf4ad0baa40b7fcd4985951bb757fdcab186f19bf5e31a57b78d048c26e2699ad830ed22d6771ff494eb592c588dfb120d6a0212799
SSDEEP 12288:RdRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:RdRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1B5C423043C4D25C3DA1FC1F59A86F0E1E0376D4F78F935F2E4628561AE7A65EA9800BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 2008c3e4d751be1aeb6889d044ce47b1c1ec4bd05c54508a02e8a6d4dcd8c8a0
MD5 2ad23be132f8d7729dbc0dab5c5fa529
SHA1 30f211334636b87402775a5d0e8f2c9e86f7aac5
SHA512 0ff2586866710c19e0840191220e015ae6d97b22707e8e3346abb55233cbb59b69add0dd7a299191c765c16b9f1fba19ca117abcc3c625504bc6f2f3ae4cd426
SSDEEP 12288:7sRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:7sRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T127C423043C4D25C3DA1F81F59A86F0E1E0365D4F78F935F2E4628562BE7A65EA9800BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 d34d24ffe7257f78dc59eda54a635cd229c1db97d7887c064c06ca8c5c16f9a7
MD5 4ba403f2aa8d2bd6a2d522365606081b
SHA1 ef9896e3e893aa935d9eb45473a70916b66d3f80
SHA512 0dcb8ec92956397942f0db8d1ac398c214b5cc0c020c13b40aadf9c8904fd87372650f7a8908ca8ada8bb7bddfa504394ac8cecd69f09a18e4dda4fa6af4ce0b
SSDEEP 12288:wWRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:wWRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T116C423043C4D25C3DA1F81F99A86F0E1E0375D4F78F935F2E4628561BE7A65EA9800BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 a58d0a47c106e7c41665d20c116c19fa0bf98ac7859c17f91e77250702324c77
MD5 d0634125e893f4f284bef621b4622065
SHA1 1ffbd4a5b4229ea3c78baa694648079e56715b20
SHA512 ae1d2c41543ce354da89a481dcc66e4e7b18577fb479c93a4409c5b3963b4d9f5efe4e9beb735e645b65b00e6dd8e4cf2863b297a3abd5a50c1918508925123c
SSDEEP 12288:YV3RPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:GRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1EFD423003E4D21C2D92FC2F9CE86E0A1F133BC8E79B526FBD41149625E7639DAD60676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 19414cbc01465aa813eadb2b78f4f68d1df8624c08c8ac59108c86b36ad1e11f
MD5 181ffbb5080fd6af7376d41f976ca636
SHA1 86112438bca0610464ab8261140d27209e4b3bb2
SHA512 c5b7e3914068af609767b18cd07729d8fca50d57e165b1bcb009cf02add257926766ad1b085c8db07a5f9f09594bcee320067eef403cdf1ae0d02cd01e025fa8
SSDEEP 12288:cPRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:cPRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1A8C423043C4D25C3DA1FC1F59A86F0E1E0375D4F78F935F2E4628561BE7A65EAA800BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 c3de57040148b839490a69f00fceccf36730ef05a2f0ebf1096747a738feb110
MD5 cfc4a7a7249b9965ce60663fac2426cb
SHA1 17ee23dab7efbc3571a2b928a308ae37df425239
SHA512 c80ece4a4abefa480875bee3f9d27e679c04cada3a3fc17454f242c545a3d2f2a880825de10f6d3a726a17c9a7d5f9d3fba6da2f4b47864fda738bd3158195fd
SSDEEP 12288:AYRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:AYRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1DBC423043C4D25C3DA1FC1F59A86F0E1E0365D4F78F935F2E4628561BE7A65EAA800BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 2b00c007c80e03aee76f198ead66628036a2c4caf435f723eac6b52b17eeeeac
MD5 0770e396c4d4c5bee14b7e66b587be04
SHA1 bb669980be3ae105a26ab7988b36013767f9da04
SHA512 a531755417ab0ea5a305253d405701077b2006e06172cbafff35dea978bade54ea9440e107fc42e528f45dd893ddb162d5f5efc6c5fc642bc90edf47432cff59
SSDEEP 12288:rkRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:rkRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1ADC423043C4D25C3DA1F81F99A86F0E1E0365D4F78F925F2E462C561BE7A65EA9800BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 4375af584db4698fd6bec93ead42bcb31829c398d64cc589f8e7743e5cf0f304
MD5 e1dc77bdadc4d89327f7b4050175d7aa
SHA1 5fd65bf3ef8fd8818c0b3a75681dfbbff0a95dd4
SHA512 7ac9ef61a36c0eb90d25e31a4c41eec2536594c99c643a64da8add375428225e7e9c722d6d705efb14c3154a1c708b9710b4dc57ea485a19928a482b1cdfc52a
SSDEEP 24576:qZMMzFVSOMRPWxNs298r3OCDIjG3gE9ow+8xA+:qZMMzfoR+ft983Dl3gEe8xA+
TLSH
T1E2050194779418F0EC6B817ECD559912E2B27C4A1AB0C65F03B036675F333A11D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 27dcf12975dc406ff974a26f5ef85aebb8dbcde6e6cd23d642d910e8fa781e6f
MD5 1cbb230100ec092be66d3b7984d24604
SHA1 da074f816f12d539a934c64b55174d152bd108e6
SHA512 692af99ea6560fba649842a7bfa71bb76327a818897df663fe7e590924636c1a031be6f8d2b725b8dccffbef87edcd38f950a1d6ad377a533e7d403c17bdc9e2
SSDEEP 12288:dBRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:dBRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1E1C423043C4D25C3DB1F81F99A86F0E1E0365D4F78F935F2E4628561BE7A65EA9800BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 c8196079d21a2346e8f133220bb75d23a7cf103e58e781f7990d9f7d06a518b1
MD5 5c9fbebb9fd5ce544ef471f401765de0
SHA1 7aead220af0536edfa3d64dfbead48cbc6620f6c
SHA512 5f3636e23d005d5a2a7b2653c33d29d8ebaabc10befc88097360fe2f83663f5dc5fefef360f2cd34d967167cc9ecad41b139316be8d274a3295ee64ef02d6097
SSDEEP 12288:IlRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:IlRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1CCC423043C4D25C3DB1F81F99A86F0E1E0365D4F78F935F2E4628561BE7A65EA9800BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 77701820c0101d2e706ff9fb453ede8b1c9357cf6391b7a2d75c83a4b986458b
MD5 2752e06113f577e3d423a1f6f75a4f9a
SHA1 22ff6f596bfccce736d0b77c6660d3db64d61373
SHA512 95669f2f12a90c3ba9dff7da4449e25497a3667615d2c5afb811aedf1fc6f2d85f47e567e64e89fbfc7ad982ecf5b9f866a7e6178cdda80854b4ed3205070ce0
SSDEEP 12288:WyPz5L8ARPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:rzyARPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T17CF412073A9930F5D13B8278C8925952F372BC361B709AEF526047722F372959E3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 1239215f1f624d6d71390d08db8914ec57c827ba4e0f59fc06bf007322e01ddc
MD5 9020dc21d668a54860edc7c138f900d8
SHA1 601f7839bea3197681656863f7063efd3fe627b6
SHA512 f5ac2f3ce4936341357a451161d9f0f7e1314f4d6d6f80cdf8027ed87de51e4b04836db70755ca372135b066f64006f36088fa3bd2c7c0322e0664e083257927
SSDEEP 12288:0BRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:0BRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T150C423043C4D35C3DB1F81F99A86F0E1E0365D4F78F935F2E4628561BE7A65EA9800BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 6fd9462a9ffcf63630e72150be12321e2b005d8f7364e254ca380ff16f22465f
MD5 c19195024dd5642a9d0475de3b31f690
SHA1 9d5ee599abc8a76d059da238e3c048ecc7b80715
SHA512 cbce376e3663c040db0d21d766c392e8eb611f5d5718f2060cb21a078bd305b5f45465e162ad07fae4a4c612820701866a4cd1a89b7fae2a5b37b785315629ab
SSDEEP 12288:YBRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:YBRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T139C423043C4D35C3DB1F81F99A86F0E1E0365D4F78F935F2E4628561BE7A65EA9800BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 632dcbc489c5d4edc0ddffbad95da9b38ba3683758dad9e201927f5f61733c74
MD5 d0d800c70c13f5e0a84467ef4a1ebfa6
SHA1 96b47692ef6f2d5568a4bcf3a6198a57df23a4e1
SHA512 e9422ef75fc85ee7abc5500653c21d718a34d56146f4a0cd5ca01f850b31b19fe25f11264058ee18dd5321f9affd4bf3d5c689b33ac389ca4c4eef6e0a87929a
SSDEEP 12288:eyPz5L8ARPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:DzyARPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T159F412073A9930F5D13B8278C8921952F372BC361B749AEF526047722F372959E3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 f5ef0c5cd248419e246f7f7b4e6652967e9883a1c7913bb9ffa488106ee81563
MD5 f0726fb18f107fee88373bb90c69be7f
SHA1 576c16fce97a3e6fed51008196330dab8ac1def4
SHA512 cb6f6c268fc502d81fde02ed3cc9ec837a180c79bb98d678610b597cc165254fb08659ab127f5eea66aa431124520ccef207ec72c0a8850d5eeb1aab27feb681
SSDEEP 24576:dT9aLl3z0zDGRPWxNs298r3OCDIjG3gE9ow+8xA+:dTQLljTR+ft983Dl3gEe8xA+
TLSH
T11D050194779418F4EC6B817ECD569912D2B27C4A0BB0C66F03B036675F333A15C2DBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 71ed5f628e7e72b129401c6421e0e0b53cf2179bca343801421e15785b2a534f
MD5 bea66d89caa69fb58ae9d43023b4ee71
SHA1 71d56cb92221f657a209e76653f8ecefae35e849
SHA512 64166f7cbef151393e125e3fead8554741176c7966e5037912f3c2c115d3c187d3082118350d8ea9222b99ff5a6bb3aa690579867820a8150cd632990976a657
SSDEEP 24576:F3td9CHKy7GZCRPWxNs298r3OCDIjG3gE9ow+8xA+:ltd9CHKyaoR+ft983Dl3gEe8xA+
TLSH
T1BC25CF90F7E810E4F0B78A758D669512DA767C5A1B71DE8F03A4261A1F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 9b46a7aada47fd37779b0db7ce5051cacf70f43ec0b3a92f4161a81c71802845
MD5 16e190bdcf6069b5965d60fdc00827c1
SHA1 e1db2b2c3d7c15df984d51a0ab9e88e45fc67b08
SHA512 01e6e1a9ff90921ae529b6888a98622650d23baabaad707d4919bc32fcdbf7e1447c3379735956af7c4c6ad9712bf656856f4f94ac4c27aa899f0ecad197b4ee
SSDEEP 12288:22RPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:22RPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1E5C423043C4D25C3DB1F81F99A86F0E1E0375D4F78F935F2E4628561BE7A65EA9800BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 bcf4ae4640fd0dde4a2677cd297eca38ea8a29790056e353e9729aac22aa2794
MD5 3c4393be621834a2c84d81b12bd8f216
SHA1 b6a808a55933f082b8d129c7443e901db3e35177
SHA512 ba261619fc05a8fd770431118638629bdce307e3987a29c38173f3fdc140cd382b8ec7d8b99860d12eefe2c854d4606a508a016cd7924153e3bf0bd40a0c1a4f
SSDEEP 12288:lgRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:lgRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T159C423043C4D25C3DA1FC1F99AC6F0E1E0366D4F78F935F2E4628561AE7A65EA98007B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.2MB
SHA256 aa2254501baa24216ac5d809d43502abc9a15e9a1a1f12736c1f59105ad3152c
MD5 0cf003c7d39b8ce4fbc80986a93db58f
SHA1 3670dc0747b557b9ee7b7e26e86d8ee207e3968c
SHA512 8c304dda4e6b7f70063f408c990aa979df0fe72788079ff6dc0cfdaf6626f357fea35399f67d0773bb25bbb005fd2bcee4254e6298476853319c9fff9f12db36
SSDEEP 24576:pgwvtk9RX6wkyAIVyh1cHNfXPn13umqUIITPLXv9K+4ecw8+:PMnYIVbHNvPZumqUIWPLXFKo
TLSH
T1D445D029EFD845E5E1B7913C8DA74A0AF6B178691B71C2CF026903AD0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 72ea4000fcfedc21ca0e2fac5bf6d191c74b8698a1a7b72ef51a93420bf4f6f0
MD5 c8300f9306abc7bb0ce5a1bb1d068add
SHA1 cc0773f2ce63f035f3a1b139eef49af30e6cd719
SHA512 d7f01974da1abc604d153bc5ab3c68ae96f9307288f10038ca77c371e9cf496c1ec2b049e170c5d3bd1342f67fdb344640dfc28e647c7ca95adbb230b105ab11
SSDEEP 49152:KYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0aR+ft983Dl3gI:2ySzPCR+l9EDl3VxA+
TLSH
T1C6066C56A1A801D5C1B9C1B98F1BCC1BFB7134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 4000930b9bf6f9fcecd491c572ab7ec39bfab6856cffce1010a9f1bb70fb965f
MD5 44842b6c392efe67962ec13570eac474
SHA1 be1ab204150bbe4395f2b3fc4d6e2ed5c1582f7c
SHA512 493cdb020aca4f1ddf7290ebdb7192c2ba18e48adfb3992fe111e118740967096e39c29c5758895117244ac07bfa185b80b081dfa780038245cf6a32dd5c41fe
SSDEEP 24576:+47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYcRPWxNs298r3OCDIjG3gE9ow+8xA+:+47JUQj4irIhCnDHUPfF/qR+ft983Dl1
TLSH
T1D565AE1DA3EC01D5E1BA927885158A5AEA71782E1F31CACF1270837D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 ddf9d8e16aa91b11ebb1a75014068c15ba2b85097b310fe7939b680e1217855f
MD5 1b958b2e1e20bdb0abdc40a88f36dbde
SHA1 e0503c2af3013efe455efb368857e97a391e049f
SHA512 9d19a9fb06c1952cbb173e334b011df76da8e7f1fb3f504fdae3515178a07994c7234e387b8721f923ef3eb096c57b3602e565c41d41ca5fb072d16a03848317
SSDEEP 12288:0GsfxRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:sxRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T125E4F109D68812D1C02EA1B9CB469681F3337C1A97F1A3CB92D0F53E1F7A6949DE9713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 6e44a8c36ccb5523e09603b233c092496977387311fa0cffbb5322dab9908e4d
MD5 32ff5c36a3cf7c292176ae06903e001a
SHA1 f471948a550cab677069ceff602343302c3c37a1
SHA512 f943dec4d5dcaa3a552b37740d9723ed563e6ade94ff0dd75d285f3cc393b8f6750402a3ca965d7ff6839e5c3300f826f867dc1b0452af4d311f659b2890c6f3
SSDEEP 12288:zF4snKIU3fzXKkM56RAhO++KhpRAlX7fIpYim4+2OkyszXHkOtWkJM8YIOB684fS:zFNnvUPmxpFYi/pu+k4WkJM8YFB6zf
TLSH
T1CB5527117626CB4FC6A940325E76D6CCAB707C45EE046F0373C9873F9476A59BAE22C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 12KB
SHA256 35ebaecf8fd7731a9da4fe15ee73b16caa7d3828da551d77acbd1e487fea8975
MD5 7a9edcbe818f28c676ef3dc6eee83f1a
SHA1 bc24a2557505c242948ab44c16c051477fa31858
SHA512 abb12809c3aabd016e2056723615fceb67e2d463db63288b865c240c16ddda8f136e64596d7b9eddf1ccb4d8dab29458943b65009d2cc19ebbb0ceb89830e933
SSDEEP 12:KwXETsqIX1WEEEEEEEGKIYWkEEEdYuy/1aIXPEEERasl:KwIuQzP9Az
TLSH
T1B1422B340F404A34CB6ED830149E4399533FE0047A84DFEF224281E42F421780C8433C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 739341673697f7cbfd588d50e1cf4609e3621395b666885d3ee8fb889efa7f5f
MD5 097fdf32cd66570ad721633917c703a0
SHA1 3fc26df367aa35f8b3d7db8b8e7b472e342485a1
SHA512 b419c24f5dac0251ec08000588ea8c633c582c0f31ac4d17c821658d48a1330077fe65fd7c6eda907c5710f956cafecba52b3095878d06875ea94c79638971d5
SSDEEP 12288:ccvDBMBeuEP69eLuGmqTVxYoA6XcaHiuJFkGrMa2RAlX7uxxWDunz6RpSGpc/u79:cc3JC9cVxYiXlCoabw66Xtm/uopEEc
TLSH
T10355180165B7EB4FC97A90374332868EBB786C07B7453F0573458838986796EB6E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VentoyPlugson.log

Path C:\Users\Admin\AppData\Local\Temp\VentoyPlugson.log
Size 372B
SHA256 5d09aaa678870f4a179cd145bdb9c2eab561a02600270ad0721c85602c6c92f8
MD5 f21dc5b74b03d6e00145e596701f84b9
SHA1 7360537c99518dfe9eaf7bf5c7dc643f693b3740
SHA512 d0cdd2b1e5e0deb2c642dcb99e7c1e486c5bea363077f73e58ca8dd9108b95bbbe5d136958f89f8d4a93f9efeddf811beb84caf34d4a091ae6814bfe5e08e707
TLSH
T17FE0860118FC827B0209961A576378ECEA7578756E872B5473C4A30F608CF186AC6581
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWow64\perfhost.exe
Size 782KB
SHA256 c6f8bc4408b824bbff452aab4a222f6a7ea8e603004309c9090069e1bca8b16a
MD5 0951554876299467010c4cf56a2a9580
SHA1 369e757790c425b1b4076df9d8af0d79c5bc74f1
SHA512 3380de96dfb24105e36e0d808d12118284327844f62370777fd85fb9e62a0c15ec8fbb6ca66feab592a2ff30828df14d5b9b3f1abd023b3599053e59f0d77e44
SSDEEP 24576:Suyh1cHNfXPn13umqUIITPLXv9K+4ecw8+:SubHNvPZumqUIWPLXFKo
TLSH
T116052330DF9FDB55F4B469B99E1BCF69A772326D0FC1C20224300685D7A468E1C256EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 2.1MB
SHA256 d0d82a0d4afdb860b7240cf0a18e31a2ed529d31e8c37cf66c999c2214bca3e1
MD5 30e83251c4157343c7e5a74597647728
SHA1 ccad946840c377c6b201c6c5ae200c554991f0a4
SHA512 1677facf7e49fb634634640aac1497defa49386cafa13f2de8aa75bdfad8855742b24bff8254e08ff40070f65e4577fdcd51460e0d23cb719c704103ba590681
SSDEEP 49152:pgb4mBIBhGFcR+ft983Dl3gEe8xA+nbHNvPZumqUIWPLXFKo:pt7R+l9EDl3VxA+7umqU1LVKo
TLSH
T1E3A5D01E22EC02F5E0F9E2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 2.1MB
SHA256 5baa692846b27ed621aeff06529ca70bd874fb87f856331d09c8cecd583d0b0e
MD5 f434eff80fdfb6ba11bfb0e41f81c748
SHA1 d302bbb3e744403c44f0d561d572b842d9693178
SHA512 32c1db9fbdd8977256e4c9d97f36281753cf9934644fd606db39f430d393ba255bcce07cbdf6e4234c47d6bbe833be6f7448f30255542c6908b231a11b37b6cb
SSDEEP 49152:Zgb4mBIBhGFcR+ft983Dl3gEe8xA+nbHNvPZumqUIWPLXFKo:Zt7R+l9EDl3VxA+7umqU1LVKo
TLSH
T106A5D01E22EC02F5E0F9E2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 836KB
SHA256 48910cdfa17c26d6d641b094b30837bcbc0ce926dd7abd130c9768c53a3f49b3
MD5 f1f7a393c864282ff3b7e9c30fac4677
SHA1 9e10444102bf76a84534b22caafc972f53d78a26
SHA512 3a57a1c36d9c4de44c2d2cda37a74f486f3194841e9ba018ca4c9f251c14fd1e4937126bc63db2df845521c3bc7fe1f1ecd31c1dd2a581aead9877040f9cbedf
SSDEEP 24576:AGryh1cHNfXPn13umqUIITPLXv9K+4ecw8+:AGrbHNvPZumqUIWPLXFKo
TLSH
T1C20523346DEBB798E43499BD8D22CE96B6B132640FC0D2EF04B00679CB546D92439DED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 e89debdf28cb415b31b49500e44665b2a42a9b2e8ea370ca7b386c0311c0ca0f
MD5 3e8b67fb56137dfcc7ab164f90a84032
SHA1 51b7da2eb4cabaad8a26bcf22367378018aea97c
SHA512 70227102672eac9cfefcfee6baa2d628fff5363112dc1de0f42ba43117422c20b235ea56c0a7f73aa6a10dae284a7c4cb6b1270171ab60e9fbcd61d6144aa214
SSDEEP 24576:aG88u8FpJqH1Wzria7/mMRPWxNs298r3OCDIjG3gE9ow+8xA+:h7ZFPqVha7/rR+ft983Dl3gEe8xA+
TLSH
T12F35012576E401F1D47BD1388A824663F6B2B8151374FFEF06A88B511F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 6809af73e6531439ff2ec7b2e6da9844724aa0677a1fdef35f537c07c96d58d5
MD5 85ca6ab6f690caf6062b4ed4f1c923e4
SHA1 e9daa19a9c59fb471c419028af54de21b4ecff5d
SHA512 a07fe1a120e1140283ec93c06574782b55bf46bc83bbe2f8decf44341c098e9046ad572a65835258cd83715ec3025c67bca4355179e200ace9d237fe3779bb16
SSDEEP 24576:zPUr+NQoRPWxNs298r3OCDIjG3gE9ow+8xA+:zJQoR+ft983Dl3gEe8xA+
TLSH
T1AD05F11F269C18E1E67BE17D89828219F372B8521711A2DF01E0817E5F77ED8BD39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 77bfe4cac7983d4aa63ed75cbb866f94da7053f66ffbeff5528cc16ce6c7ba63
MD5 2becd6349794647e86d7e102de9ee214
SHA1 6d46f4124984d0144d9d1d34bbdc1f0bb9d80413
SHA512 d50bdfbcd4418fd9301336b15812a0ad1a81abe331678806acc28e1b0977eea70df17eba2ed23302631ba7bc6e07c13fc336be0f2432c527358da14b54206c32
SSDEEP 49152:4BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjYR+ft983Dl3gEe8xF:TG05lO43btR+l9EDl3VxA+
TLSH
T147D5CF6E62EC11F5D1BBC17CDAC6460BEBB23815033556CB02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 bf24a8158b861c3c96b95202b2ff01978bf5b36c66c8721fd26ee35455cf727c
MD5 de1bfaacbb350a2f5e2a64070f2367f2
SHA1 ee31b324053f5f86375979aac6705df28e2b2734
SHA512 1219593786e0003f8671b8ac256c4c98027c282af93abdf098e8c127a0ea4588cc90d1f1d361c5c9afe553a36dce58ed0b4e861ab088fd69badd9b2e201536ae
SSDEEP 24576:Efa5POZ3dpqWVM50JicR2hG0lasx2+47eidnaRPWxNs298r3OCDIjG3gE9ow+8xF:ca5POZ39Jt2pasx2+mgR+ft983Dl3gE9
TLSH
T1C665BF5EA6FC01D5D579D17DC583861AF5B2342613329BCB012182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3d26a4a467cc782001233e66f50fb67943da02bb0b80efada504d8c1dd175138
MD5 aa922f9c54e773c1e56468f67a4809c4
SHA1 acb344760ee308e2021ed573f82a30dc8885e551
SHA512 bf8a948187cb4d8ded5b7286e9adf16d58b594791a6343eba247f61995639d602c59904162dd8612063de63172514c270c0a4785f2285d4066c39584da681400
SSDEEP 24576:MNcwHdjbyQ4nLC18lb/EOjowL7FkURPWxNs298r3OCDIjG3gE9ow+8xA+:MNc/zEOVHFLR+ft983Dl3gEe8xA+
TLSH
T1FE858C1623E901E4F5BBE1BE89779546FA71786913308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\System32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 d22a5cfd4485f458088315560a8e22c939ac72eb2de0222779bc0d451752314b
MD5 69086239f46102f62a7cee91540c0069
SHA1 5297cfe78bd248f8a23487adb35bbd8031115b0a
SHA512 c5092e01a44764d41b97cbded1a1f4c30ce50dc25ed81bd48e7992069af2f977ed253372621f468cdf19fadb3863461fc734ad32d87987a0fa206f542f5db052
SSDEEP 49152:KDVHeBIAA9R+ft983Dl3gEe8xA+7bHNvPZumqUIWPLXFKo:yR+l9EDl3VxA+3umqU1LVKo
TLSH
T14585023DEE5D04E0E57BD1BCCA538A06E37138AD076266D701A081B65F6BEE82D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 952KB
SHA256 c3719ad9a5db5fbbb025519fbc4f8fe45c2652699350f3b8a718df7f23e7ec09
MD5 3a006e23da4ab1c5103c33cc8013b3ae
SHA1 f4e351c3a989e5b67c26d4644e11434a988d2739
SHA512 411ebc67ef1b3118dcfae6ca2108e56cecf7f0686f4a64b70e90fc54c448ebe7f0ecb138c4e1074cf8a9bc240e1f661569d1d458944084977802569c51471571
SSDEEP 24576:46DI0yh1cHNfXPn13umqUIITPLXv9K+4ecw8+:46DI0bHNvPZumqUIWPLXFKo
TLSH
T16D25022C6B6B11F5E077D03ECA434542D2B27175879296DF06A085BA8FA3EDC783CE91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 936KB
SHA256 5afd8224e654a0aa81928e69b0bdf61bf7cba12572c019d477d9557f3421ea40
MD5 197a1c67f069b1b5233bb0631af30c86
SHA1 b90d84f966a329a1d7b67228b1a7938d8b4ce06c
SHA512 e6f4c9ff226d088786d5a625c5fc048c4c13a83a8548e35c698c5eae23f07fcf21c74e2e60172d9f909b192323a0bfbb74898c9d47cd9eb8d8b5859c02be3a85
SSDEEP 24576:Ltybyh1cHNfXPn13umqUIITPLXv9K+4ecw8+:LtObHNvPZumqUIWPLXFKo
TLSH
T1D2152210AF9AA6D4F5B41578CE23CA959B713C241F91C3DF10B0572E9F367C96830BAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 808KB
SHA256 0c6bd9c9c0080d9e0a04279a5901d114d2b8e635ae4cf5e2bd94d02b5044609d
MD5 3bb74aae140358800f74878beeef2b63
SHA1 b46344c654abf430bf1f7bd6ca414243f54dc4d0
SHA512 6c9fe981a30309c02e5c9a55233c7eed221ac501bd6ea8305c510c6ce7609130fdee19c4cd2f9a59625dcbd89b6760a4dc29583ffa36d42da7963e8b302915a4
SSDEEP 24576:FQyh1cHNfXPn13umqUIITPLXv9K+4ecw8+:FQbHNvPZumqUIWPLXFKo
TLSH
T1680523309E5BAB95F4706CB98E17CF86D3B1326D0FC1C2D724700A96CB996CA14359EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.4MB
SHA256 2683f28e1f15937413e40858d992f8f00cfbdd265e896b5d62cb1de7b87eabce
MD5 f071488a9e46d0fea45dbe0eb890a2ed
SHA1 f52fc88c0a20e56c8c839e80f5aa98a87e56c02c
SHA512 417e80a09aee5abdbc441bc7346046a97c0c6d1023b5e183660bc714b214ef011ec64ad95c8959bbf916bf178a5f2c69f8137c4c6dccd7956a59e05ba465a25e
SSDEEP 24576:TngmLoTfaidZWyh1cHNfXPn13umqUIITPLXv9K+4ecw8+:rgVTrZWbHNvPZumqUIWPLXFKo
TLSH
T13065AE1D67EA05CAE2B2D679D8225493D633B4311772C6CF2458C03A4DABEDCAE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 e6c2e6ce57120b769a4e44fc531e89218e541fcdd8fa1710a3082c3b0ae74320
MD5 06e672c0a9b0106b310740a586ce7e89
SHA1 7a05b9cd6cb6ccaf5e45ee0ccdb0ff7fe58dcb6d
SHA512 648d6837bc82c8e152fc8940468d687209650f8662b986e3ebcfc7c92943b4dc919a815c4d10d412d155e0fb11b3e62a234940f2f1b4acf9a812764055144c5e
SSDEEP 24576:eTkNvNnaFeYhJNtmZBmKyh1cHNfXPn13umqUIITPLXv9K+4ecw8+:eTMwBtOmKbHNvPZumqUIWPLXFKo
TLSH
T11075B02EBAF846E4E1FAC6B5CD238512E6727461073293CB5290C13F4E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 299ff1e142e5981d1964577fd9ebe73b34418e79eeedf28fc4fdd05eab5e7650
MD5 27c7a2142944f4b5f011bc07e531906b
SHA1 991022d043c35c8ec22522ddc3c0efcbeedcf022
SHA512 5eae14edb8be8ffcb208237bee67ed44850109e50e2d610dd63f34bd7d5c90939c2f46e4945ce35dce9a033886b367ef4758fac783456adf90909bf7a24718ac
SSDEEP 49152:yDVHeBIAA9R+ft983Dl3gEe8xA+7bHNvPZumqUIWPLXFKo:qR+l9EDl3VxA+3umqU1LVKo
TLSH
T15185023DEE5D04E0E57BD1BCCA538A06E37138AD076266D701A081B65F6BEE82D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\system32\TieringEngineService.exe
Size 1.1MB
SHA256 158ffb12e2267be81d0ae90a393d67374a779bafce2af01fd9d690810a22cbc0
MD5 6d904c97ce21393600e30fc70daa4df9
SHA1 5332294ebbe655e0788d4b977098f0f3eeb03ffe
SHA512 47863e048bdae974e69e375386240566a1379161148b50b1e90db1e0be58c6e124c9b826f88e03c8b97efb0f1c3dde2f4f026602a7abbb9951803b84df4d611d
SSDEEP 24576:EJnJPbzB4Spgyh1cHNfXPn13umqUIITPLXv9K+4ecw8+:EJnJv6SpgbHNvPZumqUIWPLXFKo
TLSH
T16635E03CD2A810E8E4B7C2B4811A1B5AFF71346D2F2269C719B4D5353F52EE0A939F58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 800KB
SHA256 f01e2f86bc8e8da356a11663a65f30e63645e811fc3ec24cc803d9f1c9553846
MD5 e036632a764b1832adce788c4c159df3
SHA1 79bf62b2ec569856827405ae2d81ff5c4f522eff
SHA512 6c2bd45ed2bfd61db84c6b82be0cbfb3b7bc3cd7ce5a98977308bbb58313d367992f2aca0475058e0c1305d477eca32ec56b7d3992289dac5fc68dd36c2e4baf
SSDEEP 24576:/nyh1cHNfXPn13umqUIITPLXv9K+4ecw8+:/nbHNvPZumqUIWPLXFKo
TLSH
T15D0523309E8BDB95F4B06CBA9E17CE99A7A1325D1FC1C2C314300686C7996DE18395FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 944KB
SHA256 5335bf08d002f06b0309c4d39cc00b9d339813e62ee4f7a9684407f06e13dd4b
MD5 739e0a88d3609fc192c7da36b8775cfd
SHA1 52b58bc13333960dd5e06d20c0a8bdf70aab9255
SHA512 6bc9d1ee375d42d353ae27efcd25a5ca1c643ecec271fd695310f876b748a98269a964c80091f8b25e750d5c12554fbd59e66b5b1a38cf58894d02aa42dbb1ce
SSDEEP 24576:z6UqjpSyh1cHNfXPn13umqUIITPLXv9K+4ecw8+:z6UdbHNvPZumqUIWPLXFKo
TLSH
T1112523285EC665E9F0745578DD22C66A82B139361BE1D2EF30E0067ECB31AC9443FF69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/824-128-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/824-31-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/824-39-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/824-38-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/824-32-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1148-166-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1148-160-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1148-393-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1148-159-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1960-117-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1960-389-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1960-387-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1960-111-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1960-110-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2184-302-0x0000000000400000-0x000000000079D000-memory.dmp

Download

memory/2184-6-0x0000000002490000-0x0000000002515000-memory.dmp

Download

memory/2184-61-0x0000000000400000-0x000000000079D000-memory.dmp

Download

memory/2184-7-0x0000000002490000-0x0000000002515000-memory.dmp

Download

memory/2184-13-0x0000000003310000-0x0000000003377000-memory.dmp

Download

memory/2184-20-0x0000000003310000-0x0000000003377000-memory.dmp

Download

memory/2184-0-0x0000000000400000-0x000000000079D000-memory.dmp

Download

memory/2184-1-0x0000000002490000-0x0000000002515000-memory.dmp

Download

memory/2392-131-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2392-392-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2392-137-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2392-129-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3316-142-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3316-155-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3316-154-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3316-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3316-148-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4124-51-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4124-50-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4124-57-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4124-158-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4124-58-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4320-69-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4320-63-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4320-71-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4320-356-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4320-70-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4564-407-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4564-391-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4564-103-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4564-96-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4564-405-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5504-390-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5504-83-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5504-89-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5504-81-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5708-418-0x0000000000950000-0x00000000009D5000-memory.dmp

Download

memory/5708-414-0x0000000000950000-0x00000000009D5000-memory.dmp

Download

memory/5708-412-0x0000000000400000-0x0000000000555000-memory.dmp

Download

memory/5708-423-0x0000000000400000-0x0000000000555000-memory.dmp

Download