29d6ca2b33d6aad013d2130d30cf9ae72eefd533f1169250e1b2abda132e4762

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/10/2026, 22:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-12_b28bf174be6a106c58cbd81860cd5f32_amadey_elex_luca-stealer_lynx_njrat_play.exe
Size 1.6MB
Sample261013-2lt8dade99
SHA256 29d6ca2b33d6aad013d2130d30cf9ae72eefd533f1169250e1b2abda132e4762
MD5 b28bf174be6a106c58cbd81860cd5f32
SHA1 8c44b85e44a41d96ab1a4a4492f0666318d8ba7d
SHA512 b00d8a8ea4a1726c1dda7010aa66a08f369216aacfc484f47f29678d69530cf902e4f9993f5ba28214381d0459ee2607c9243f5b2d011a3027a28088ea61ae7d
SSDEEP 24576:D4l9rFNSEzOVIWxYqAC/PT+S1g0xHnxC4bZtxoEgmK0:MDSEz4IOECS4g0djtLhVR
TLSH
T129750202B5D14432E9B315364EB89771ADFEBDB04922DEAF2384591EEF315C0D62A723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5116	elevation_service.exe
1580	elevation_service.exe
4160	maintenanceservice.exe
1292	OSE.EXE
5860	PerceptionSimulationService.exe
256	perfhost.exe
2980	ReFsDedupSvc.exe
5364	SensorDataService.exe
1124	ssh-agent.exe
3996	AgentService.exe
2408	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-12_b28bf174be6a106c58cbd81860cd5f32_amadey_elex_luca-stealer_lynx_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-12_b28bf174be6a106c58cbd81860cd5f32_amadey_elex_luca-stealer_lynx_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-12_b28bf174be6a106c58cbd81860cd5f32_amadey_elex_luca-stealer_lynx_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d0af31a631e6882f.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-12_b28bf174be6a106c58cbd81860cd5f32_amadey_elex_luca-stealer_lynx_njrat_play.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_110156\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-12_b28bf174be6a106c58cbd81860cd5f32_amadey_elex_luca-stealer_lynx_njrat_play.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-12_b28bf174be6a106c58cbd81860cd5f32_amadey_elex_luca-stealer_lynx_njrat_play.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-12_b28bf174be6a106c58cbd81860cd5f32_amadey_elex_luca-stealer_lynx_njrat_play.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-12_b28bf174be6a106c58cbd81860cd5f32_amadey_elex_luca-stealer_lynx_njrat_play.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005b0c4e2c645bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000eb0d52b645bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005acb28ee635bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008eb16aed635bdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000021a895ee635bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a819c32b645bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fc801fee635bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5116	elevation_service.exe
5116	elevation_service.exe
5116	elevation_service.exe
5116	elevation_service.exe
5116	elevation_service.exe
5116	elevation_service.exe
5116	elevation_service.exe
1580	elevation_service.exe
1580	elevation_service.exe
1580	elevation_service.exe
1580	elevation_service.exe
1580	elevation_service.exe
1580	elevation_service.exe
1580	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4304	2026-10-12_b28bf174be6a106c58cbd81860cd5f32_amadey_elex_luca-stealer_lynx_njrat_play.exe
Token: SeTakeOwnershipPrivilege	5116	elevation_service.exe
Token: SeBackupPrivilege	2980	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2980	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2980	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2980	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2980	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2980	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2980	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2980	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2980	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2980	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3996	AgentService.exe
Token: 33	2408	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2408	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2408	SearchIndexer.exe
Token: SeDebugPrivilege	5116	elevation_service.exe
Token: SeDebugPrivilege	1580	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 1992	2408	SearchIndexer.exe	101
PID 2408 wrote to memory of 4256	2408	SearchIndexer.exe	102
PID 2408 wrote to memory of 3936	2408	SearchIndexer.exe	103
PID 2408 wrote to memory of 2156	2408	SearchIndexer.exe	104
PID 2408 wrote to memory of 2448	2408	SearchIndexer.exe	108
PID 2408 wrote to memory of 2884	2408	SearchIndexer.exe	109
PID 2408 wrote to memory of 5964	2408	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-10-12_b28bf174be6a106c58cbd81860cd5f32_amadey_elex_luca-stealer_lynx_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-12_b28bf174be6a106c58cbd81860cd5f32_amadey_elex_luca-stealer_lynx_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4304

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5116

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1580

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4160

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1292

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5860

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:256

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2980

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5364

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1124

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3996

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1992
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4256
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1592 2948 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3936
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1624 1616 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2156
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2448
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1592 2948 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2884
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1624 1616 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2e4ecdd5391d9dbfa557938ff8723cfe81307aa9ffaf261ad442f62bd144e681
MD5 1085631d3bfa6bc3fb3d29fadbd20896
SHA1 3ef4febc93b96f472b6db9fdd1a04e60e2be57b2
SHA512 802301b83e6ac24924021fd4f793a0c5e8551e8caa9ab48cf398b7ee864e2d9e3ad2693b1c2ec70325f883bec27807af9e277743e47100537f05c035c743898c
SSDEEP 49152:pb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnfCS4g0djtLhVR:/3q6HjB+L4/dxL/R
TLSH
T1A5D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 afb575650d192a7e915fc0f8bb803fdf9b33fd1432b5578d40c33018e2f35ca3
MD5 c38f2632bd784930bf594a20a296b157
SHA1 738d723b530434b15811fe494d9ca6487a69e990
SHA512 6a5f1607eeb1bc4d6149be01d616936e93fdf00be100b3a123007fef1eb10d79699bff87ae8f349ba1848e3204fa4dd0aecf54fb5a602c7b7b0d891aa01b8d5e
SSDEEP 24576:/XYfDtczACqAC/PT+S1g0xHnxC4bZtxoEgmK0:KtcdCS4g0djtLhVR
TLSH
T16275F128779409F9ED6B827CCDA28501E6737CA14760E7DB03A4A92A1F333D45E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 36acf290c696955fff427a1bda97913286630e51915568eb40f193356f3c9e13
MD5 52204aedb16841cf9c8fd01f6f2e2e35
SHA1 977fe627d371dc8d787620f4e202a1513e577486
SHA512 45c54bf9c3b24adeaf57deeb299b2da9ad343c08380b0826fb23bcd4c808be7981c9d12d502b278e2e7aa3db780b2dfeede47283c333f76da81a1529d6230f52
SSDEEP 24576:40Le5ji0hmxFrMdqAC/PT+S1g0xHnxC4bZtxoEgmK0:4Pji0ArMCS4g0djtLhVR
TLSH
T1D0959E26F6748335D073C0B9C5D2A68AE971348257308ACB4286D77C7E67BE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c087de39dd205b1314e7369bc20a349a7bfca335304dbb82660e5e6c15f39e19
MD5 e8f2560e037943824e39362d1e65649d
SHA1 c380cabc4cb65afd1d3672fe58bddf2a194bed71
SHA512 86301789d3b7aebed7d6b73388053091ef902ef713ade4f0771f7138ec8f34ec7bc665d6d9f1ea4d5c991eb0acdccd114d06e8a6d1bd90bdd7a605005f7e2369
SSDEEP 24576:8a7/ezSC6vUyD/aqgrvWE6q8wyuXqAC/PT+S1g0xHnxC4bZtxoEgmK0:b/ezSC6vUzPvxHjyQCS4g0djtLhVR
TLSH
T1BC755C25F5788323D0B2D0BAC5D6AA99FE723086573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5cc55d21fc91d5e16b2f333da9c551d4fc814768a098375f3c2ba77cee1d5e4c
MD5 6dea3ac7c713e7dffc22102356852dec
SHA1 e39a8fa86a0a616a9c1897332723c7e7f5201007
SHA512 e9784d3700039248fe82b4faa8b9c3843d56877b97a9a59d1808dc1dee36bb7ba690be2aa92d02f4f7fcdb6720e3c7db01bcdee6951d475eaae5fe7417fef3e8
SSDEEP 24576:gVbqPb88hv/l+6GqAC/PT+S1g0xHnxC4bZtxoEgmK0:gVO88hXl+rCS4g0djtLhVR
TLSH
T1B0559E66F5748331D073C0B9C5D2AA9AEE3234425B318ACB1246D76C2E777E6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 dca20d23043a075ab7781f9710722607b19d92b5079ed859bd0acebfbd45c3d2
MD5 7c3c37a1adbd28aec8cfbf84d7b55172
SHA1 df6a9a126ba14e9452e9bb7a3c81a4769a57ba2a
SHA512 b42498ad4a711dcb617812a284412c47897621f7ba7689244c35fbdd7e2cab3026e959a8eb5ce15f6dca63493a33d9070065e613b4030d1cbdc918dd4a0102a7
SSDEEP 12288:rNxRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:rNRqAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T17A65237A9718169EFB9F06F0CEDA8280F5D19EF09111FAAB8644B94F4C3C560C86F432
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 f32610f2934af84b7ddd8fa22ed57b5fa95646bc92ea492ea27b2590e64264df
MD5 d56c0609a335a0c54f813089a8728596
SHA1 b246911f033862fadd43847f5bfdc1268f882cbd
SHA512 033689ddece8240d5510686233c73838b297d2d3973f73ea7a529ad5b7581da320a161b53cfd7ea1a8324bc7d8cf95dbe0306ee15377aeafbfa3c2b6fc8acec1
SSDEEP 24576:RJIUuqAC/PT+S1g0xHnxC4bZtxoEgmK0:RJIUWCS4g0djtLhVR
TLSH
T11175CF3BEE28FCD2C27E4DB85A918640E77278704B11A3CBD165920EDE335E15D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e2042c6598c0117269d311db48d02d3d3126255311384988b9058f439cc58fcb
MD5 f6f6f8ff0688d26461afa79cdb649de2
SHA1 d06c0c1636b4da2d8469adfe2daa9133ada8429a
SHA512 7b2716c819f20bf6f62fcf6506fdfbf6aadd2d3846d9c722136ef5d7ae816344aafb91a6f5fae295c689d54532e49998cc75f46a2cd152c704b851c2c8e481ab
SSDEEP 49152:JQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH9:JQvGAdlCEL8c/yRNw5C9L4/dxL/R
TLSH
T182267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 dd441b95cea06d284a6175edd6025e31581a193b7cf58fc174cd6362d685c644
MD5 741cc3bf064ea85d567fe29209012191
SHA1 2d1ac615589005d4a8904ef01a5258389a7d8f61
SHA512 370c6fea03f7d61634ea940945dda981f78f404d8556a83cab0518e432b5a8fee9fc2307001def621237c27077509f3f3826687f6414f65933ff33f5c8dd8fd2
SSDEEP 24576:q6ewsAjQqAC/PT+S1g0xHnxC4bZtxoEgmK0:9lj8CS4g0djtLhVR
TLSH
T12985E031FE74E036C7BF0DB11B26C706646C7D604B512AC3E3A89D8E59342D2677AA27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 217eb3eb804115edf01f030d7651029a1904454bee4ce34e24fed41ddc10392e
MD5 224053520780dcbad528c9c21fc0b6a6
SHA1 7fb88b156fd8ace9799d7e7ee7bd7fbe89ab013e
SHA512 a72c103bf98f4c88eb61c85237e2f66a662a4d4f7cc73a4123c89f56a86e700a0759753dca37caf8ad577bca179ba65c8e51221c5a4822dc9b1661aa5c8cdb70
SSDEEP 196608:dUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHo41pR:dUEtQevvqc2W1cpV2EI32h1r
TLSH
T1F6474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b083460047e5515de5607210fe2d74a240c6ed77aa188f284e68a631efa9c63b
MD5 eda28c925c5bd1d3babd738d4460adbb
SHA1 a9c455db9a8f6184f31cb1520893cf081356a5f1
SHA512 29076183d87ea1ea3485df56e6e238a49cc049c5d6263617905e8f3eed0596a01381aef1be3342c096fef5c581d540b7a582c3bd37889a7caa53137e49018333
SSDEEP 49152:uCbRquA/m2yL5zQfFiV+XenmE3/zcCS4g0djtLhVR:DoqtVjnmxL4/dxL/R
TLSH
T119D58D1976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c80063cb7def2bd6146a8f71d620a6e8bdc2d186da4fec7c18cf809bb75d09dd
MD5 185f59bc96ce2506706faaf561dd783f
SHA1 441f94d97e541ee6501ac378a972d6dde48e3d15
SHA512 6488e3134ecf92897e1554ea8ea2e738c6a8aa0931388d9a90a528a58f9d448f5daeeae03717a535fb076f714fd4d6f7561aef80d5202eab371804801c6b5f11
SSDEEP 24576:JAhGLJIFoiwtA5l7S53zqAC/PT+S1g0xHnxC4bZtxoEgmK0:JAMyFoiq5hCS4g0djtLhVR
TLSH
T1B3359D81E7F955D4F5B3AAB89DB68170EAB6BCA65E31D20F2150D10F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 887012e3f901df14119f7bc686219e1962d6fe40070634639f74e27cb67c2e99
MD5 c68ac0bb55f5a3bfd7c9883c841d8063
SHA1 467b3e37e77abc7795f2a016e413c773cb8d2dd2
SHA512 948bb2184d682e6755e25efccdaad6d4a444a30d1b185785e76cc767b5e2cfd5caf869f3aded2c7cc81b1c1e23ffa21efcaf2afa25ee45e06bb21aea667ef69e
SSDEEP 24576:RwuFOWMqAC/PT+S1g0xHnxC4bZtxoEgmK0:RwKO1CS4g0djtLhVR
TLSH
T1F475F14A76A40CF9EA674278C997C132F7F2BC512621DB1F0760C65B5F37261AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 cbde9400d7701315eec0b8a04f973277cc35ea1f528a79ff54ab97a97457b253
MD5 4329cfc5a4e5e26e6d4224c214841270
SHA1 f9558825eef880eadac31bd07b24ad2d6e341db6
SHA512 4700b92801ea05dae13c660ed599f4a62b8d03842dbc2d23a6478a1288a0bdde8d1974deed614fb7f4400d78932c903211139534a577ca014df3437e33518ff5
SSDEEP 12288:3FZ1Iy0RZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:1ZulqAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T13365126A23A421F9E29742B8CDE58641E7B17CF1633293CF1614625A1F36AD18D3E732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b3fc0e6d393574a727b7639ddd8dbbe3e84062837937a2a0cab3f899f7fea0e9
MD5 be0d646634d69b02c6558340d61a18f8
SHA1 84e1e485a7a901efadde6ac473f087612138a0a1
SHA512 f712e4b2f3bfc8e3b6bd5b5e56b319accc0198d7f81034121487791dd983b53a5d0df574758ceafce3117a9d9cee8e30a1e7af343a6db42698680e544bc6f4b1
SSDEEP 98304:QQRQyi36YOcPQLvw2gAf+PN3KL4/dxL/R:HQyiKayX+PNO41pR
TLSH
T1BA667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a869330a6b16264873ac2a401585d4e690ab5f674ec4b62570e064d12ffd920a
MD5 fa5e9ad3344e6151f5f4d7d3d7379791
SHA1 314a08040e5b50010d9452ad61d838b4b198b371
SHA512 bf72757ce553cefdc2948314a8698abd04b067b089b3517338fab76f0cfbee1a6d0de6bdf85c4201d2bb649d318643710852f9daa06ae221e6938a0baed2d2be
SSDEEP 98304:fQRQyi36YOcPQLvw2gAf+PN3KL4/dxL/R:uQyiKayX+PNO41pR
TLSH
T129667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d5a0db8eba68ae3c03f36d4bbd69088a11ef933d95d29b19fa34b2460ced6786
MD5 d6d3797172b3c40881fcb85f3d543557
SHA1 f1818af5c7a61885ca1bb0dea7ba8640fa1cdc06
SHA512 5da0d2a4b9436dd9b4450a83761eafff6e12fd479c4ba85757e52c2be1bea5b3c1f1d796f2a7b070624c23120b61699c14fc15594b61f4b75ca56bb7aa9a9245
SSDEEP 49152:I68Qg55nhheWu7PNU3/MCS4g0djtLhVR:SthWRc/ML4/dxL/R
TLSH
T129B54A33B2F600A9C44DE1769F4A872196D17C718FE1E3DB8515720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b3da811e76aade1a38fd0a7e149e9c582ebc1b1408c2d78a1b390dfb9e63cb4f
MD5 029237c8ca0bcae17897e98c743d4932
SHA1 9c8b3714742b4b0cf5a4a9b67d46879d64b454c6
SHA512 175311219811e9744a6197e4bd1b1683b5a9087ce460676449104e024c44fcc3664b600b294023e7e166eb612e2d313e90be77b8fdbd37af96628359b806562d
SSDEEP 98304:1y5112gYy5azzVvL69nLKnhZDL4/dxL/R:YLIHmWh141pR
TLSH
T10B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f5b9fb600a0ae5224a9e9dba15b96d886f96c8b754d35b8ec9a334a992bccfa7
MD5 be34c8ce188bce0ab6805efeee4a27d4
SHA1 d958266171838a7158b3f2cbd2944b34e369d377
SHA512 70ff38242c922cf9c5c14669e8679797daa714c20d7da44bb853d6e6d96ab44cb2e4477bb42cd22a8128ac82fcf8323b800462e92313ed09f049973bed431d18
SSDEEP 49152:yB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glmCS4g0djtLhVR:Au6JmVxd2dmL4/dxL/R
TLSH
T177D59D13F1DA01E8D05ED478974A9233F962BC490B35B6EF0A9072562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4e898a0aa7aeb2389bc68e1e24f0852a3d4b7a23c6c6c113a8b86e44bd34f945
MD5 9319468776a0bd146da2f12862c3bab5
SHA1 07e1c3efa075159242d81b48bb2fd8cc5e6e8880
SHA512 29212c533368662380da12ea2abd7439dbb36008924e1277912f063cac7ac652029519d642d62fa56c91b7f48c33f0fe0efdaa5059a33183fd5677eee5a5dfd5
SSDEEP 49152:q1hpsNoJpF1A6UU44CwH7R4x2CS4g0djtLhVR:qmifPbRxL4/dxL/R
TLSH
T148B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3d29fc28f80651b3199beb845fc542c5bfd32f02b6526e9a84129df7a8af9bc6
MD5 9204971830ee96faae7ceca272d665d5
SHA1 980b492ac143cc0d524e6e763f7a26d882d0d055
SHA512 e753477e6ccb78904c6b47eaa564c48aa8d92f090b58ec423926c5ed9ee9ae58a66a22b54f1aa925561ea6106138ec95a18968e0f5ffccd247865202a27a8c6b
SSDEEP 49152:CSuZQIY0Be2KRRVtOnks6NMHqPCS4g0djtLhVR:c5dKTi61PL4/dxL/R
TLSH
T122C5BF13F2E901E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3dbbd8273a705c484d87cb0f5e7b75dddd6280abdec1b28f49dc8405b4412342
MD5 dd2f9cb6817c5a0407a33328aad8264b
SHA1 67eed6c00027c9a2dc9d26072536fcd3c4ca58c8
SHA512 b4397615d5bf5fb59850666fbf2459af5ea43a1b5019f5768bef9f3622b75844d8f34e4ffe89156ce93dd5758a3f3a718e3df6a36bd20d87761005cfdf86b375
SSDEEP 49152:5htSn8EApI0figngiDn0AP5wiCS4g0djtLhVR:IX2iyphVL4/dxL/R
TLSH
T1A995BE13F2D901E8D05ED1B8C7468632E962BC150B35BAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 b566a171af76f59d2c76bda12c0c14f99662c2b717bdce89a3f65616bfb87c37
MD5 227515ee1ae7173066933b14b23b4869
SHA1 1d91d97a60d688d726b9feb359534edbca6ef9b8
SHA512 c44ca0c88664ef7c1395fd7e5693846d1b791761da68c380fa498e1757263c98ad0e2b048a1d74a0e38ac8dbd9e3d2c574560ff7a38b9ea0d341b1718afbcd24
SSDEEP 12288:nJRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:n5qAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T17B65237DAA19179EE74E46F0CED68280F4D45EF1E212F6ABA748B00F9D38561C86F431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 34380b60a1638b6e93b000200add81a93c5a4a49cd3627e13368aa85d5a6f6e8
MD5 3979fe6e1fc1eb76e641c3c30b656530
SHA1 c5e0c40ddba9b4672694703ed664566988a456e7
SHA512 0728d9a708c5980fcf489b41813dc2fb5705770037892d6c20387f41a3b130a6f9434fdf841e987f7206fbf3aea08972cb868ad4a5e2ae7cebea10f25b6566d8
SSDEEP 12288:ZIRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:ZEqAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T10365237DA619079EE74E46F0CE968280F4D49EF1E212F6ABA748B00F9D38571C96F431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 f1578b8d3da0059997b46ebb54813530188d5dcca1c655e3df419eb4da3928f4
MD5 6977940d3ce9119c7d9e586ca8c633c3
SHA1 515e321661f3dcffa2c863935ca1fa52c94efaa1
SHA512 4699313c07dfed1c0654adf7a573d229d896704be27d3f1dc62e1ed91c7daa4bcf861d34c4385c3ed273bfb4df99ec1c8536c5ee743c706302f2c456b32bf9ee
SSDEEP 12288:7KRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:7WqAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T19965237DAA19079EE74E06F0CE968380F4D45EF1E212F6ABAB48B00F5D38561C96F431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 b4c509d5285b86048c8d24612772c7a79aa71e9b614cb9e7f89581cc97746b33
MD5 7072919e5211fa6d9e9aa3ba5be38ec8
SHA1 3127234ee7bc0c40f43b20ec604b0ab7188b605c
SHA512 48ab300b07c61ca56e7984f9440e5b1b3492963ad75d86c41222cb3094f659d9de25551fe28fd1936a9a60544473179b9d13418f50489afc862fe4c886687475
SSDEEP 12288:LVrRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:1qAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T1C2652369675902D9EA5A82F4CDA68241F5E5BDF0E322E7EF9700740F0D747A0CD3EA21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 e222d3c29f5e452408bbafabef7426c12777cb4ae422f2da3e72f9250f9f68d4
MD5 e53e9c65b2d7da1a7eadad6fceba3496
SHA1 93ae8626206538cb872f72ac14b891baacf5b329
SHA512 2e5672d20f1af738f26dd7a2b62aa1fff89cf92cb0fb10c99102de026ed724ea72eca20caa4ef742bd4c9cf5b2911a409a19e95574b109554e53b6c2b4ad35bd
SSDEEP 12288:ezRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:eLqAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T1DE652379AA19079EE74E46F0CE968380F4D45EF1E212F6ABAB48B00F5D38571C96F431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 f0cf1c206689de8b63f92b4ddc8eb7bb9bf26d04845f762b88e3554840d25f30
MD5 d0911375c6967a733aae5755b47f1d06
SHA1 333c00a21bca21b3d0eed9a5fcf4ad35f74bea99
SHA512 404a0334fab6189a8827c9499e3b5716798bb9c3b797f798ca762fd50390e1ce5d807916271fa888293ae1d207ce47d33b162c7d02af0ea9f62c363322f1b159
SSDEEP 12288:N8RZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:NYqAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T1E265237DA619079EE74E46F0CE968280F4D49EF1E212F6ABAB48B00F5D38571C96F431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 9b86080fb53a08fc38bb311f2ada4207f1fce66f9ad8dff4af1c24ff4389b2a8
MD5 480b50bc21b8fe7c8e91345beec9e3f4
SHA1 0b8f025c34fc501f4db0f0de99e7ff4c802cf137
SHA512 879be88e050219e4ce49ace5491130c0a0fffe51d367d26276362d9efa56451b151198aae202dd2277e2b79c405529b4f97f8c5bd31cf5452fe0bc4c4ff7fc54
SSDEEP 12288:3QRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:3cqAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T13E652379EA19079EE74E46F4CE968280F4D45EF1E212F6ABAB48B00F5D38571C86F431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 1e03478dcb091bef87ba94c2f56c44a056952aca3912db98c087f9828e3cd4c3
MD5 3ef61baf6f370a71b82e6a4f4e32422e
SHA1 e01340b6f504c642ce280908450da5cf4fc28fc6
SHA512 5c739d25c86ea5acd2d5a68de5a49e191c064ab53629f4f5004d44d8b7cdbb768f36c96cb5ad849012f47c060be8033fd5bbfb5b7f0f39b427ed78c61b1092c8
SSDEEP 24576:4ZMdzFVSOkqAC/PT+S1g0xHnxC4bZtxoEgmK0:4ZMdzf0CS4g0djtLhVR
TLSH
T1827501A9B35018F8ED67827DCD558902E6F27CA64760C65F03A4362B5F333A14C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 b8042ec0dd60545cabd779a81c4f8a74ab617691ff91c871972f27b1fb433d7c
MD5 de0fc2a5475981de93f6315f06c1fee7
SHA1 53f15818a57c60c9520f77b9f96bd6b4dc1590bd
SHA512 41ee0b4896155a051f6bbb6886c856ca606830b75c4296ad46f69c698b0b55499e25a0fbbb085740f159c5a32c2f51ff2a83ff70aabd36906ba24b70596a24f4
SSDEEP 12288:tVRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:tVqAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T1E365237DA619079EE74E06F4CE968380F4D49EF1E212F6ABAB48B00F5D38561C96F431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 20bde97d73f65fc0a475df967a60a3c779d334f9f1500a7bca9056911b629f45
MD5 c849cc99c714d29a23537fbc6e696ec3
SHA1 116e62c46f42a41e321818107e8af922821edb68
SHA512 c8cccc85fb5c19967e038f8e5277e0fc109529058f9cecdbed8975740893c26a931eec80e2b03ecfe8cfd2e9dd8e9f20346a2b0ef1338193f0d63e18d3ff55db
SSDEEP 12288:5hRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:5BqAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T18165237DA619079EE74E06F0CE968280F4D49EF1E212F6ABAB48B40F5D38571C96F431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 958ecfd5b808afbcde56fc418b37349443f213f99cfde8358c25184ac600625a
MD5 4624c2bb35d8f40e71f956e23e7517e2
SHA1 3b9e2c0935d21fccdd1ca20d2d75d7aed583443c
SHA512 f65f02782654097e9399011c1f36d6ec5ee6a641c837492d988d484225659c3c349fb409a84ee597c550707b8e374fde2a678ee3786e14ed105814617d336a10
SSDEEP 12288:1yPz5L80RZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:czyAqAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T1A575021773A531FDD16A8278CDA20A01F3B1BCB14720DAAF5754667A1E376A09D3EB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 a28b0357651fe2db1fe2fb8e910cadffbc959c6169f1a7eccfe28e75a66c36b0
MD5 aba55124741b11d9659c7185dbe7b888
SHA1 98211e55a39a98c663f4b8d70967192657c17219
SHA512 5526a2b58d6ce37e60aef1613361bda2126e9c67f5b48b8cc7173fd49450eece6777a000a1af3bc6db369168487e8c563cdcaccd0621b946e02e4ebb72fa45f0
SSDEEP 12288:YVRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:YVqAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T19965237DA619079EE74E06F4CE968380F4D49EF1E212F6ABAB48B00F5D38561C86F431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 0e86775255d5ccf143c170db6bfe2d723d99e146ab81ba3c7319259288865f44
MD5 3c199515bf42020a3a80852dcba11fd0
SHA1 5bb5e13c41de455ed6d6706e417cf2d2374cc705
SHA512 f555fac1866360afa57eca06ffe11a20fd5e8a31b1806a4cbc1b7ac6bca73676e400f6c3d4828df03bfd428f1a6a0159000b33223608e85ed78015b777ac8eae
SSDEEP 12288:UVRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:UVqAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T1DB65237DA619179EE74E06F4CE968380F4D49EF1E212F6ABAB48B00F5D38561C86F431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 dab1df91f315ac3a8a70c2b4e498c23dfd4be8eb83ce2bf2b43da3580da6a92d
MD5 50f2fe087ddc7edec6a70b74b584758a
SHA1 230cb235f1d54f30de038dd048a2db0200b772cd
SHA512 fbf61ae67bfd794b74edbc02bc3b0c460544b3c66233ed31eaf57a128647e8139366ee3da396f6b8fa55620d280a07f013f49c560b2aee2fcbe036aa51ad016b
SSDEEP 12288:LyPz5L80RZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:mzyAqAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T1AF75021773A531FDD16A8278CDA20A01F7B1BCB14720DAAF5754667A1E376A08D3EB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 6bc2067555591d8d949e84f797e24fab9b2c6b05eb2c0ca2595fcc9f9eba3e67
MD5 2212e9832aeb4b3d608c2b1692f24afb
SHA1 09a7ff2fcb10e22293bbecb6ae801e558f88f061
SHA512 6d255d6893d122cd4df2474730bf3137d9a5ca5d061577a146ec6d8cd936e093cbcf2ada08971852c7f8cfbed44c8bcb91028b1d9c2c318e94a044bc8b2dec95
SSDEEP 24576:qTGaLl3z0zDmqAC/PT+S1g0xHnxC4bZtxoEgmK0:qTFLljNCS4g0djtLhVR
TLSH
T16F7501A9B35018F8ED67827DCD568906E2F27CA64760C65F03A4361B5F333A14C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 34d6dc9421fda70f183a9014b630741928127c9a6e73ef8fbc852a1ffcedaeaa
MD5 351d7d32c3d1d507f9059073494be208
SHA1 01f8787fbc1c70054dafaa5994aa495caf14c929
SHA512 c8ea3e37b86d311f8f18b657d871b4f3c0cb4c95d62a52a75a2bf778d4b1a89b5794d6376b55300ebb787ef194ca5c3c64957729cd1b1a7635263940b5edf56a
SSDEEP 24576:V3nd9CHKy7GZKqAC/PT+S1g0xHnxC4bZtxoEgmK0:1nd9CHKya0CS4g0djtLhVR
TLSH
T14695CF90F3E410E8F1B78A75CD768511DAB67CA95B31DA8F03A4251A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 fc7abadbda0a6131ff095e15655fc33220f2cb77bf4b68a207542431a0c77cdb
MD5 c55089c53a32d5e8a0622c828acd4156
SHA1 51bc19c2566faaea6923a86f87d742597a71e05e
SHA512 56e8f895b918b1c984734ada4734dd525d722197909d5ee4edb7d4eb28674250af34524fd7ebb81ae56cf5f479ba6aefc40e0731331093604f790888dd9d08c7
SSDEEP 12288:MqRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:M2qAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T153652379EA19179EE74E06F0CE968380F4D45EF1E212F6ABAB48B00F5D38561C96F431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 9c6f9cee52bda566fee67db28ade057b8da66a366b18076799eddf1dc2f6dc99
MD5 9768d76b47a2a3660cee8e8b3894d3a8
SHA1 65ee3a28f991a726ab02ba7d0233320bb975ceed
SHA512 8048e57eb5e58bdf457bada127d9e908ca87eb7e43ee3a259a3888e665357c16004baf5b6367026094c6be32c16f1ec8c25e2dcf59ffedd7988f6e6878d9544f
SSDEEP 12288:/URZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:/gqAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T15B652379AA19079EE74E42F0CED68380F4D45EF1E212F6ABAB48B40F5D38561C96F431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 885f6b03fb359bf2116670ba640c1eb153b9dd0171ec7092419a0cb9f73e4bbe
MD5 c58776375eeef7b7af2d5abd7e5b9733
SHA1 981175407b967104ca7ef4fef84712f19c408020
SHA512 4ed7c27aa364ea9259e9191e3ef77662c650e9a8cb28657d6b2dfc631d6fee1c1c8247c53e43f75eb417df588cca7911d3989b9e082036e6849dbfb225414392
SSDEEP 12288:zHRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:zPqAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T1F5652379A619079EE74E06F4CE968380F4D45EF1E212F6ABAB48B00F5D3C561C96F431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 8ac1b47008ef0d34e3abdbe279f606fb719582d6305fd8a693eb2f222eafbff3
MD5 e3ff1f7147cedee9301ec21472ca2d1b
SHA1 93a2af5e35ed5f01925e8b3d62402a6818848f03
SHA512 b66cf060f68dd808a5fc8ae7d21ff385a99cb3ca9859fd49109f958599e214ab501159844724eab49a336d201d0bdc2914e3b9082e848dac2eb2e332fd626e8d
SSDEEP 12288:lVRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:lVqAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T1CE65237DA619079EE74E06F4CE968380F4D49EF1E212F6ABAB48B00F5D38561C86F431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 a23cce4d6ef8e5c31f653aed4d399448c314f354035d5b4ead28a227b12402d8
MD5 c0909304b41410ded1c8289b90084474
SHA1 3845943a899017b1b0ac5072794a6d57adf9f156
SHA512 90bad0bd86cdcb5a2aeadfb7b970b281f8d1420e9076b454fbede8b136b484f4d3e3695894ff5a4b1885a81cb796104639d051ec701255af8a227cf422848942
SSDEEP 12288:zqRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:z2qAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T174652379AA19179EE74E06F0CE968380F4D45EF1E212F6ABAB48B00F5D38571C96F431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 39ad0bf62dbd3991bc5b4b93b3414e43c562122aa06c6618c8df2823b60d13fc
MD5 3fea4ed4b84c0fff9dd6820fcd104531
SHA1 304b842bc23c929a9ea73ee3d0e08155aa4d2933
SHA512 84cc85a4c901514dd820372346f7bc49c7f74fddd3ee24d512d48af4050bc9c33eab9b8aa4c2b9fe4d75f69335ad48a47e41bf78e685043eb55f9abad3be534d
SSDEEP 12288:LdRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:LtqAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T132652379AA19079EE74E46F0CED68380F4D45EF1E212F6ABAB48B00F5D38561C86F431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 7850deb29c30a240544728ce0a6842b36edf78d2a7a90acb5528d8d70dfd08b5
MD5 41e9fc658e09c0806ed7ae2cb6a67537
SHA1 80fd86079d4309c718aea223a3ab1872ce0e59b3
SHA512 947e1d87e10fda445bdc750393828cb91b368157e3e2d179e9c65ad6464be56377f111590e928d68083b327435a82da36ea0bd4743666fba1d7223877adfd6b4
SSDEEP 24576:VfwvJk9RX6wkyAIxqAC/PT+S1g0xHnxC4bZtxoEgmK0:aMnYIjCS4g0djtLhVR
TLSH
T1E795CF29EBDC04E5E177927C8DA7460AF6B178691B31C2CF025A536E0E37ED49D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 008a69d14610808828170f27235271991ff76e99d249ba82c8c6b9d8ce94449b
MD5 e350f48b2cdee7412af662ccb1289c2b
SHA1 720c633c5a88e2004babb0cbcaa6e660b70193b2
SHA512 7e20e63cad887780b5dd3b71eddbc3baf3b87b48a09ce2aa048541bc38f716216ff6ce3b23726d2da7b6ca10b689439cba258dee88ba42b4604d709b864340b7
SSDEEP 49152:yYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0CCS4g0djtLhVR:sySzPqL4/dxL/R
TLSH
T177066C56A16801D9C1B9C1B98F1BCC1BFAB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 30dd7f8a17a123ac8b0bbfb2023e252bd6175e44c6eb498964e6f8e2c7f34cf1
MD5 01314a08d67549e06361eb022548fda2
SHA1 adc9acbdaf825ee4f6e208ea508a47593f91de2a
SHA512 61d94f73d262292b4bd02b5eff3e36002b9b3c98220525ddc15e056e2397e548c362b8e4d896c4b7681489a9368e62d66d8ef694eb3062d45d2d13b9af0b67a8
SSDEEP 24576:A47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYUqAC/PT+S1g0xHnxC4bZtxoEgmK0:A47JUQj1irIhCnDHUPfF/yCS4g0djtL5
TLSH
T1D465AE1DA3EC01E5E1BA827885154A5AEA71782D1B31DACF1270937D6F33ED48F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 b95643ec87e1f832fdd89a99cd9f05cefa4b403bdd5d647ae698c8201424eaa5
MD5 eff5a4cb0edd8a957f55a31ad9a95060
SHA1 c7dc90deec36d340c4392fd34150ad7162de2571
SHA512 4ff0a5cdea73fba47df329f65ba4244032df765d49788a634bc7b1e88d881152cda24681fceb619d6d4fc855c47c804753e2f3408b79f54155876d1bd338798a
SSDEEP 12288:J+sflRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:/lqAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T10875F11AD25802E8D16E52B4CB968641F3737CA193E1E3CB57C0F53E1F396909DEAA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 958bb5640966b865b6642d41655fe5cd916dba5472fab73ef5d7c02005b09a16
MD5 2acdc2a4a43fe7fcd200f30fa45f57d2
SHA1 ef4ccf0988c405c3c73303dd73e6ceb1eb721fbf
SHA512 92828674e4a6701116782573da1eefa0114902521c58a4378021b88b7579ea4c250d0ae8878b4f5036162f69fe3a75f3f9c273575af3243f686334d6167ed684
SSDEEP 12288:bIpfmEU3fKFyAr+YHXmE0A7GIBdkaagcUPvefE/mCT:bIpuEUPKv+YHX1ZrBdka/DPGfE/x
TLSH
T1AD452850B667CB4FC66980361E32D5CCAB707C45EE846F0373C9873F9576658BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 bef0e5bdb11ef58575712d85104d7b39ff1faac8fbd05742e135dbb77c2d3e5a
MD5 3c0e74b9ad6c9638d1c68433534ddbb3
SHA1 59ad67d08b65a530c0967857c863e6832e14052e
SHA512 9e146e869f121429ee753fc8ced407f77842209224f5e28529f99560c6dd71bb613a5bde7316daf490ad4ca00d60d6e52bb914868d2bef8e8f7cd55a4b06ef05
SSDEEP 24576:poeaOnp8mHmqlpq4XxX6imI7YeBzyG88HJS9jGM:eOnp8mHRlEZimI7YeBzyG88pGjGM
TLSH
T1BE750A406537E78FD1B760320326AB8C77A49C0BB6456F26B3C9493AD86BB1194FD3D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 8f1e168f91593cee4b7f1fb5cf152d08e8201b4bdc5f49c1b81af8be6dc235bf
MD5 0a702299ea51b6d86174b8930833f4d6
SHA1 b8a5943309b8065479ef3f3d1b793035e30af7eb
SHA512 d6b3d057b5e47baf4ce391f8956c10132582302d644850619c9abf91c7fd0547fa1b096d2922b8547493553c3fd2a39b3574e5bebeb7351023137071e6ad6c8a
SSDEEP 12288:K47tRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:z9qAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T10A652336971C1A4EFA6E06F0CD9AC210B599BEF09711E6EBE604714E5C389E0CD7E522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 aec88a244f80aee2e23fd081e8cd937dd6b6d364229c26196ff6204ebbde22aa
MD5 9907d686e506cc83b35a499be143a0eb
SHA1 943b81a8b5e46fd7dc19009347415de29f54579b
SHA512 c293e8c38e7c027150efb5c164c2d9aec1c8ec88ec951b08241973af6e6d0b327f3464f889aac5e53cac75b73666c56b4ee66d8ebdbe5f245aa37cb8a99caaa9
SSDEEP 24576:Pgb6bmBIi49WNNFpg1rSvFv7bYXqAC/PT+S1g0xHnxC4bZtxoEgmK0:Pgb4mBIBhGFYCS4g0djtLhVR
TLSH
T1CA65AF1E22EC02F5E1FAD2B8CDAA4417D6B278161731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 e19da0170e95ca7f3d148d2859aa58b3d5ebaa4044e43ff69593e5e6970e2477
MD5 6441c99463c13cf0707fc51923af7797
SHA1 3a8d8a41360a5f44dde6da8eb01b43f817d4cc9f
SHA512 9340d89e98725eb4999b5f53b82b45c64cf655a08fb16b65c0dd3398ead57219e43e888935776430c1bdfec020aee37cfd28c6c96894abaadf55dfd0e20cc242
SSDEEP 24576:PG88u8FpJqH1Kzria7/mkqAC/PT+S1g0xHnxC4bZtxoEgmK0:+7ZFPqVVa7/lCS4g0djtLhVR
TLSH
T17095F16576E102F5D47BD138C9864663F6B2B8210320EBDF07A89A551F33AE14B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 8e1c89d6b8f13eb178b63859e9c07a55ca1ea2df99fa8838df02f58203cfc01f
MD5 ff485bba9f345259ce1854c69b3c796e
SHA1 40323d8e0bcc3081ae63dce88dafd72255b5895f
SHA512 3e1e4a6aa487ff3d51e45a7f972a58c07e87e96beaf601514b6276a648f252e17d82ddeb91745bb63308c5a4ffbbcdb411307bae5cee6f0f2a5071d0ac49eb87
SSDEEP 24576:MPUr+NQIqAC/PT+S1g0xHnxC4bZtxoEgmK0:MJQ0CS4g0djtLhVR
TLSH
T12175E22F62AD18E5E67AA17CC9828709F77178621311D2DF02D0917E4E77DE8AD3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 7933c5816039d0a4cce4c2824b2b365a938857ff921590ecf87f53e487df3aa1
MD5 4ad3594bb398210b7402b6cc09215cdb
SHA1 7736606742ca09220e82600635108876fb35e061
SHA512 2c0eb5456601c31ff4f3661e4a4e84441f82dde8740ab302aa358b7cd53a076a40a4a1c03ebf38b367227100d09ef8f9500410e55eee91aecedc2451b42007f4
SSDEEP 49152:FBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjECS4g0djtLhVR:OG05lO43bbL4/dxL/R
TLSH
T165D5BF6E62EC11F9D1BBD17CC9C6460BEBB23825032556CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 08fd0714faadf3dbaa2fecefe74089e900d6b53cc0c6e06b715cf1a241b48ab2
MD5 1e512e9f3499895dfcbc524c99f3a6f3
SHA1 822eb1cc598adf0adcf86c1a7082425447fff496
SHA512 232a10816e91f7d6b0519bfd64f28e12aa47caacb541ad5938e190d396419c493f6459ac03fc900106696a330db93da6267c74f613da699904b2480630430b5d
SSDEEP 24576:cfa5POZ3dpFWVM50JicR2hG0lasx2+47eidniqAC/PT+S1g0xHnxC4bZtxoEgmK0:Ea5POZ3+Jt2pasx2+mMCS4g0djtLhVR
TLSH
T1E465AE5EA6F801D5D5B9D17CC583861AF5B1346153329BCB022182BE3F37EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 34f407611d2ec06c92173058b7dd13b58a9b6b8e41b5985b296b5fcdf3dbfe4c
MD5 2074fd64b6bf0d783b7825be7548257b
SHA1 df7de72a98036e681940c59f5945e54fc7e4a0c6
SHA512 2f93cb893250151fa13e594369dadad5317731b4ba49291a59aad677d2fda03b4e886ad4508be761fadf500afc292a56b0b8320c882a96e2785d7fd70835fcf5
SSDEEP 24576:kNcwHdjbyQ4nLC18lb/EOjowL7FksqAC/PT+S1g0xHnxC4bZtxoEgmK0:kNc/zEOVHFFCS4g0djtLhVR
TLSH
T152857B2623E901E4F5BBE1BE89679546FAB17865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c45759f5e77e19a83dae790c227f4ee3b58e1d5185fe5c8746364ceeb47c6953
MD5 063d85bc2b54eb510b9aeadbe1062b55
SHA1 73d2636bc27778e5020a529096c73d7a08f81dae
SHA512 85f93805cbb9ae3a7432c262467d9c98e82789ef56c9bbb332c369514eab6dfbcf7bb63024c246ca7acd99132f2003df4b30e0416c631e18e83be9bc9e1d1d33
SSDEEP 24576:C8kNvNnaFeYhJNtmZBmKqAC/PT+S1g0xHnxC4bZtxoEgmK0:C8MwBtOmqCS4g0djtLhVR
TLSH
T1AE55AF6EB6B806E4D1FEC6B4CD238512E6727861173293CB5290C13F0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 2180e75165d6be1a0264d3b6f6b6fd32ca4f7563b795974d113b89d50574a56d
MD5 a99ffbbf7d17d86010647e584f638c67
SHA1 8285910f296bc9dda63c8ddcbf7d0d3737811c8e
SHA512 02f7416d398c3d5c0529995dc5d7bce1be922ae596afbe691b433c3b27b51d531882a43087d7c923eff0ed5db1f7144b415cca2ae611a64f106c9ce16af1d1ce
SSDEEP 24576:QD3FHshBIYQgAZqAC/PT+S1g0xHnxC4bZtxoEgmK0:QDVHeBIAALCS4g0djtLhVR
TLSH
T12285E17DE65C04E4E57BC1BCCA538606E67138B9032266DB029491BA1F7BEE46D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/256-312-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/256-81-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/256-87-0x00000000009E0000-0x0000000000A46000-memory.dmp

Download

memory/256-82-0x00000000009E0000-0x0000000000A46000-memory.dmp

Download

memory/1124-125-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/1124-119-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/1124-117-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1124-315-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1292-280-0x0000000140000000-0x000000014019B000-memory.dmp

Download

memory/1292-64-0x0000000140000000-0x000000014019B000-memory.dmp

Download

memory/1292-65-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/1292-58-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/1580-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1580-30-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1580-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1580-116-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1580-36-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2408-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2408-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2408-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2408-319-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2980-98-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2980-330-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2980-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2980-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2980-92-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2980-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3996-131-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3996-139-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3996-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3996-137-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3996-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4160-43-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4160-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4160-42-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4160-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4160-54-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4160-56-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4304-8-0x0000000000830000-0x0000000000896000-memory.dmp

Download

memory/4304-1-0x0000000000830000-0x0000000000896000-memory.dmp

Download

memory/4304-0-0x0000000000400000-0x00000000005A0000-memory.dmp

Download

memory/4304-14-0x0000000000400000-0x00000000005A0000-memory.dmp

Download

memory/4304-6-0x0000000000830000-0x0000000000896000-memory.dmp

Download

memory/5116-16-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5116-23-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5116-103-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5116-18-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5116-24-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5364-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5364-104-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5364-316-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5364-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5364-112-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5364-110-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5860-297-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/5860-69-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/5860-71-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5860-77-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download