0bc2bb68b131900fca6867ef98e3e9b9d825bb987e7dd0dc77da95e6d0ea5443

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 17:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_3324afe910be95102f426893ee93c3b3_amadey_elex_luca-stealer_lynx_njrat.exe
Size 1.6MB
Sample261024-vramlabs2v
SHA256 0bc2bb68b131900fca6867ef98e3e9b9d825bb987e7dd0dc77da95e6d0ea5443
MD5 3324afe910be95102f426893ee93c3b3
SHA1 c746a70c7d025d6b32b0265a7281a5b6315d216c
SHA512 2ebcd51a871267117675bac873a11190b159f7a3af306c2f7ad83ca17736db199b31e99e8a280a97a0ddcaa49c37c2f15974d65517e3e3efb8cc8680f2c63427
SSDEEP 24576:ij/QugDwp7wkt8bk+ks+Vvwn3sqjnhMgeiCl7G0nehbGZpbD:SXp7wkt84+kjVvwnLDmg27RnWGj
TLSH
T18375E021BAF6C077D87201304EB9E625646EB8314F7189CB73E45A2D5F356D18B32BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5888	elevation_service.exe
5692	elevation_service.exe
3056	maintenanceservice.exe
368	OSE.EXE
3976	PerceptionSimulationService.exe
5952	perfhost.exe
944	ReFsDedupSvc.exe
4696	SensorDataService.exe
2784	ssh-agent.exe
1136	AgentService.exe
4636	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-22_3324afe910be95102f426893ee93c3b3_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ea5f057f7465cd71.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-22_3324afe910be95102f426893ee93c3b3_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-22_3324afe910be95102f426893ee93c3b3_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-22_3324afe910be95102f426893ee93c3b3_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-10-22_3324afe910be95102f426893ee93c3b3_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-22_3324afe910be95102f426893ee93c3b3_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_3324afe910be95102f426893ee93c3b3_amadey_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000040c872f1da63dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bacd98f0da63dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000098d45d33db63dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000014528befda63dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000151dbbefda63dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5888	elevation_service.exe
5888	elevation_service.exe
5888	elevation_service.exe
5888	elevation_service.exe
5888	elevation_service.exe
5888	elevation_service.exe
5888	elevation_service.exe
5692	elevation_service.exe
5692	elevation_service.exe
5692	elevation_service.exe
5692	elevation_service.exe
5692	elevation_service.exe
5692	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5868	2026-10-22_3324afe910be95102f426893ee93c3b3_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeTakeOwnershipPrivilege	5888	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	1136	AgentService.exe
Token: 33	4636	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4636	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4636	SearchIndexer.exe
Token: SeBackupPrivilege	944	ReFsDedupSvc.exe
Token: SeRestorePrivilege	944	ReFsDedupSvc.exe
Token: SeBackupPrivilege	944	ReFsDedupSvc.exe
Token: SeRestorePrivilege	944	ReFsDedupSvc.exe
Token: SeBackupPrivilege	944	ReFsDedupSvc.exe
Token: SeRestorePrivilege	944	ReFsDedupSvc.exe
Token: SeBackupPrivilege	944	ReFsDedupSvc.exe
Token: SeRestorePrivilege	944	ReFsDedupSvc.exe
Token: SeBackupPrivilege	944	ReFsDedupSvc.exe
Token: SeRestorePrivilege	944	ReFsDedupSvc.exe
Token: SeDebugPrivilege	5888	elevation_service.exe
Token: SeDebugPrivilege	5692	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 2752	4636	SearchIndexer.exe	100
PID 4636 wrote to memory of 3372	4636	SearchIndexer.exe	101
PID 4636 wrote to memory of 3616	4636	SearchIndexer.exe	102
PID 4636 wrote to memory of 1096	4636	SearchIndexer.exe	103
PID 4636 wrote to memory of 3572	4636	SearchIndexer.exe	105
PID 4636 wrote to memory of 5596	4636	SearchIndexer.exe	106
PID 4636 wrote to memory of 4892	4636	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-10-22_3324afe910be95102f426893ee93c3b3_amadey_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_3324afe910be95102f426893ee93c3b3_amadey_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5868

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5888

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5692

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3056

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:368

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3976

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5952

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:944

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4696

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2784

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1136

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2752
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3372
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1872 2896 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3616
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2792 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1096
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3572
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1872 2896 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5596
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2792 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 70058ef2f4a488dbe4dcb418e28b1d0557370b0fe976b92c724a54eb40600263
MD5 3de4f3d6fd8512ecc2616511569c2791
SHA1 8775f40040f1a0c4250d3cdfdeb13342784072e4
SHA512 932431a2d019e14d8c8a8873c439c4557d0440430c6c6e45ba967aaf7c9e13ae268ec3031fd2bffeb0d84b89181ed9f2739de772f57f2d0f6339cc90e4cb9f4b
SSDEEP 49152:Ib+632BuPkFKRrdE6ohmstBhuXjfS4LWxnFDmg27RnWGj:i3q6HjBiD527BWG
TLSH
T1B9D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 8218a25bb35d5fff3e3ab044caa501d7d15a02bce250fc3bebaa8b6c39c57d3d
MD5 e77a87b582eec6b9bf3f0f6711b6792d
SHA1 d662f0f9bd3ad70ca0cefdf82f43a7951db50204
SHA512 28e19e6554192093922213bad8e40b38291e835960f18cb7ca583a4fe7ac4b89d241627a7eba0af552a8df0cb0c14cb865b5fba770071eb625605323eb7a3b5d
SSDEEP 24576:2XYfDtczAasqjnhMgeiCl7G0nehbGZpbD:1tc3Dmg27RnWGj
TLSH
T184650129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 4ef88fb77dcf9efa97bd56217ea47511e1af2aff70bc2dc18f3367ad07a1262d
MD5 a08d75ae42bd44382668a9d496a5329a
SHA1 0ce4d5d0e843d05c5b5ce701f68d969b5b6d75de
SHA512 832376c674b388892a5da98c7576e4a4b63b8a18e0d1fd3a7dbe963170b7f3851e7ce4bc34658cbe8715d3dae58782f88b0bafc1eb2fa95ddfaed474dde11fc2
SSDEEP 24576:Q0Le5ji0hmxirMJsqjnhMgeiCl7G0nehbGZpbD:QPji0AcsDmg27RnWGj
TLSH
T1F2859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f4c04d065ec1a2cb95a8e8c4df52236f5e1b94becfb3a9ade35249cf7c523ec8
MD5 9a910c0c661939126b405318fe03238e
SHA1 290c6a00aff90686850c0a2c0f19a4dd8c837989
SHA512 d68236c70f76893cb52cf8b70b5a981ab39e0f3a8f1deb6080459b59619c8ec96dc5169f96385faf0c76d13d1f5c435b8c19901f9e033d7255cd8afd310a363e
SSDEEP 24576:Na7/ezSC6vUyD/aqgrvWE6q8wyujsqjnhMgeiCl7G0nehbGZpbD:E/ezSC6vUzPvxHjyIDmg27RnWGj
TLSH
T1C9755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 00f285584e15fe72dc35be2654fd02d2ba8fe9ab76ab81a6d643ea3d40a9783b
MD5 650fe08d7d5ad4efde664241dcc7f15b
SHA1 14fcb195f6d51e2964c1bd14d99d9027e187a02a
SHA512 0ebb50cfee4d2286f578f19a284fc6f0ad20609ee4cd2842580c79ebacd1c70028ae75039b92596d1a908441296fd0d246351c48d1ebd56be072b8630b06e1ae
SSDEEP 24576:1VbqPb88hv/l+6+sqjnhMgeiCl7G0nehbGZpbD:1VO88hXl+JDmg27RnWGj
TLSH
T19F559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 0e8e4fa3ed7542468a3394d489aa353f261fdb95da3ad4bc5c9a0261b953bdd8
MD5 ad5983ca0b1d6ad6c0a200541af70dfa
SHA1 4e094958c09efdf6cb59f9b870500ac1d03a210c
SHA512 994ab5fa2ca27df021c313a3e7d1be5882c48058fb215bd3e68b346e035508c2fd876fa4830bfd6f2b7258b468a52d70d0245d3b6043ea7a946cbf57f11a9c4a
SSDEEP 12288:ERJXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ER9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1154523BF964C50CAEB7608B5C3E9F15EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 8d5b066c6491ca71f24ea09865da215255a625a6ab7c792a195c1ebad068a7ad
MD5 40a2b0500d7d0217e5f91dc96b44dfae
SHA1 0a6b950480ec1dd54a1b557d9dfcb3214e61d1da
SHA512 0b7f6174b5266079ef5f3bdbf9b494c264791381c86ea006837e0a91700ffd343b7411a94d4349f541a458561d53b26fb4a45a9471eb7c67134f8fbcae749baa
SSDEEP 12288:heBNUbTVO86UiXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:hJIU2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T18665CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 273fd4ce74a0c2b3624c19820c43176054bb803cca07c1b677a57267621c661a
MD5 4019d6828902422d2b3a44313d48ca09
SHA1 2a2fa0ebb3a8a14cb6e20876d8debe958c065435
SHA512 6ed0d3fcf846c3c71a16f1abcd417ae600818ca380e3b24b3434c43c21f0c1e90c214fb5e68a276a7c768182832b53f825f84df87cad0c79561686f8448c7d1a
SSDEEP 49152:sQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THB:sQvGAdlCEL8c/yRNw5CXD527BWG
TLSH
T1A8266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 55c116e2a9c7681d04e91b62d5eb7521514268456f892c256ca6172b34e61c95
MD5 6a24ddd24e14bd911c96e425f9119a30
SHA1 35cc15ff8dfa02ad725eec2dce5db4e0303ae703
SHA512 d72865b787a9a9a05e31a6cd6d0921d5a8aa9a8d77895cc272dba504d8f646c2cb31370e48dc8c7483028811be456bb2f78b43e401425d13cba5b98d030f8bb3
SSDEEP 12288:9AwSfxL/2Dc34DLLmt0LDQewsAjYXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQK:udewsAjgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A375E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d7f922bdbe520d55d42243caf696db53be4d58734678f086127e321ffccad641
MD5 c6ab3f33adc47699c11b6d672736b66f
SHA1 f400d5065a698fd8dbe77675c3ff642af9970200
SHA512 d8b3785a9b3d2839b9fb478ad9a46099835f4e2642a401e2dfd40a4987d56c8e94d9c4f0d743da925155240d0fa2ecf5d5d0302b2c156d84b4295439e72c414b
SSDEEP 196608:6UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHUVQBWG:6UEtQevvqc2W1cpV2EI32bB
TLSH
T125474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 519f4ff263bc6137b4bf82ab86f195eb57b7f12c76cdf7379cf3de77712e76fc
MD5 e23720603b56cb5e3ce042d516b190ef
SHA1 2266cf4a810ab051ca622ebba368c57f0f6767a7
SHA512 3fc22660eaf640ae5349b4dc2b57f43e57a871b92dae844c7d735def242bb417433752e38a6b1a291773064555e7587706b4ef944d8834129801f78c534f75e1
SSDEEP 49152:GCbRquA/m2yL5zQfFiV+XenmE3/z8Dmg27RnWGj:roqtVjnmjD527BWG
TLSH
T1F1D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 44ae386bdbcb8f93d1d3ced56ed1d97b7da16de876c1b641de2ed63847c445d4
MD5 6cd4070f5261334e00033e66d73d37f7
SHA1 0c16b8669b578f83f49b5dd7527b353d6a09192f
SHA512 3f8c77621678dcac1bed917a4c8a3524b9e16b47d01cb89d8850955ee1400f3b95d9e6a9e6cc39375946a9738d1acf60580d9bc9c4b60cfc667a032b42b41efd
SSDEEP 24576:vAhGLJIFoiwtA5l7S53fsqjnhMgeiCl7G0nehbGZpbD:vAMyFoiq5TDmg27RnWGj
TLSH
T114359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 8261ec965e8cff7abf3671ca1c0230e766796a23dd3b8028120cab9f4b9e5774
MD5 3e93e160688433dd407d3ca478e3b767
SHA1 2355235d2d0ff18cf4e31b1f0f5e5405552f1475
SHA512 09935618694b9c826ff1621c3cdd434ba1ddfca50e5e95032d453443b1bfb8b2b91d48e3055d2d6e72d4521e15f16c90c2b708323944229c6432b2e8432b343c
SSDEEP 12288:Mmw5HEjsChNVBFgl0WDm+CDXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83i:pwuoOW8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D465F14A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 25f898d027a3c5bdb29f554d0bf41e297d3b1ec73f250941887ad5d069e5042f
MD5 4043688192dce02f697c405262b216fe
SHA1 e0cbf89aa650e70222ec97e1eaa2b9164e5c1bcf
SHA512 3e5e77d3bea0411d80e3928e2fb40ce27655fc68727d59c91ac8580ab832cd31a2ab4fcebc4eeaf1e877e61298f4ff270e6bd24b8730bf2d05d2f356e84f8a46
SSDEEP 12288:JBZ1IyIXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nZuhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16C5512AA239820FAE163417CC5E5D609E7333C62673043CF16665AAA6F739D44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c48523c66717ea1de18f52d7cc0b0ecf6b86e031295b06fea159209049206796
MD5 8bb2703e0f73d5e145f98e48df3ac8a3
SHA1 eba5dddbc861f64d95c4b85ec24d8bcef383096a
SHA512 6edfe1bf3308c02099a8edc4fdf4aa3d06103c313546e0e68dcdaabebc5424c7a269f4cadcac033160d699503ab94af5ee7c9db3f7a84ac4e6d5b14845bd49b9
SSDEEP 98304:mQRQyi36YOcPQLvw2gAf+PN32D527BWG:NQyiKayX+PNGVQBWG
TLSH
T141667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 dd5dcb76299490c390c89b9697c3512f4566721d8bef867ef0af0fec1b157d43
MD5 92eaf3fbea9902413a7131f8ffa1a5c0
SHA1 216bc734083a9d885f25cf6df068282ca26bb20a
SHA512 24da4189fc0311e7234c1211bd4d3a420b6cb067ee070dc938f09ea8c3b94ec319f393c7f771fabcdb6a7c2f72465c0937b65617567e8cac333d76c30c2d04c0
SSDEEP 98304:IQRQyi36YOcPQLvw2gAf+PN32D527BWG:fQyiKayX+PNGVQBWG
TLSH
T168667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 af7b03d911acaf608bcab1c5e603847d27c2766361cf2e0e60e5bdde35f256dd
MD5 403a3d14e241957dbe785c5f3b805d57
SHA1 bff6a5ab9cf3a4eb2c645ba3b869a413568a61a8
SHA512 e47035e31fcb604aebaaeba8aca8114fedc70db8eebf6392e57b1becfea6d306ba6ba47f8ccb8cca3efb00d3dbe720f9468a0c501c9e4b0978305253264f6998
SSDEEP 24576:GwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0xsqjnhMgeiCl7Ge:Q68Qg55nhheWu7PNU3/sDmg27RnWGj
TLSH
T18AB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b1d6cc922abff726c30fade84c909e635270c2fcd63e83d6a09ccbf653bc2528
MD5 f6dd9b89314e01cef0c72019a8292898
SHA1 dbc4cfde8f2b45033d56aa3d6e62da989b267900
SHA512 319c89ad85f68723a0ddc0026bfc785438103e7a6cf7c6393b594a3bc809aa876e8ad77658b523e32021ddd4ec1eaa1bdf0eae0b42d63556e99bb50f6f52691b
SSDEEP 98304:dy5112gYy5azzVvL69nLKnhZhD527BWG:ALIHmWh7VQBWG
TLSH
T1D1167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 3184d5e3f76a631a7d7f7c7fad91160af560f891a96052c552ac32f2dcab5731
MD5 19874760af56b2ee95d22f96cf325c3f
SHA1 f04c4b93d15ecdeec2803a10e0763dfb370af3cf
SHA512 74595b3e1a7d01c805be99878974a914363f96e531cf5859d001cf8987ee5ca76feb2e6b7b50bf69cec45155fe1631eabd34a0ddc07b3977b69f358a8e4a9687
SSDEEP 49152:8B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glNDmg27RnWGj:Wu6JmVxd2dND527BWG
TLSH
T175D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2c54ee29df1010d57e7e3504312cf2826925a9f5a620268180be5a25c9632730
MD5 72cae5bbd1cfc34ad6c8b47a72510a80
SHA1 acff043b853a653c8c001e1253755b0c6a6a5569
SHA512 502299b49772b214772f2f7f43a478b4bebd4307759da0fb0684e7230ece6f38fd5e4427490bd9d6efa58efaa4431d51cdc13deeb454884db43d7b89acb1346c
SSDEEP 49152:A1hpsNoJpF1A6UU44CwH7R4xaDmg27RnWGj:AmifPbRjD527BWG
TLSH
T1BFB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4e1abe87d556f61527e79e832266fabc0213557a68185f91b16f9dd28401b5c9
MD5 6cfd703d31b0faa1c6f8f627a143dfca
SHA1 e0f4c93126bbd4422a7726b3fec188dc2d3e7605
SHA512 3ad5e8fb7ddd255a1241255a25506fb08f1d99194da2649a755e14c17ba1309b095fca8d927fa1405edfda411ea43f26306eddc5bb85f61e63acf3318aa2494b
SSDEEP 49152:BSuZQIY0Be2KRRVtOnks6NMHq1Dmg27RnWGj:P5dKTi611D527BWG
TLSH
T1D3C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9bd94f9c51b9844d332fa285a8bb81ab79016a1ccd9cca2ce5acdd8ead965857
MD5 44df5404212a3f08b11a51d863d6c98b
SHA1 5393b337621a0150fa8541d40822f532bfa25374
SHA512 9101f60a857476cc1978c306412d854d854f60ecdeb232405d9d7f42d0bd44c8b911fcd0324beb15fa8be393c7e969b99510bbb00ca8f372805310ebd5df781b
SSDEEP 49152:ChtSn8EApI0figngiDn0AP5wuDmg27RnWGj:jX2iyphPD527BWG
TLSH
T1CF95BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 9a0ee89128dd8020b60a0f73113ae71f41c57823ce799da0dccb0571b3aef3ce
MD5 d009f9ade151aedf66218173fd41a7e7
SHA1 6d06b124ef37561fa00b2b3c3bc0a090d4849ce7
SHA512 03c57e91547930238538b0cd1acf036141e5b9db0725f67151dac2e9b9b0ae8acf26b85974a046c02b8bc7b3d781593337775d17376d084be6a188d020b9ad15
SSDEEP 12288:WxXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F94523BF965C41CAE52648B5C3E5F14EAC073E5BE92004837A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 24dec510d22c03155a6edd807e6885c03e477dbf2764b93129612da561f3f69f
MD5 df5cf5dd27303c7fc3464d9f2ecd9e34
SHA1 28eabb7b594bbbe34820e85ca78ece1c4c5c006d
SHA512 d48487f65ca3dec1ad83ca214b2afd9aa9049ed7eca590c4c49e0fc4225756f5f93c9cf0d5e8d7eb25ef1525d44870a13655326b2c29f24566878312c2546fd5
SSDEEP 12288:GsXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14A4523BF965C41CBE52648B5C3E5F14DAC073E5BE92004837A9B7CBAFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 94b5b133e985f24cd46b6b503d0d3d4f950bd0df1b71e5920f366adfd3f03dbb
MD5 915c58f38d181399097085e31f040d28
SHA1 05caebd8b3fbb4d5ac41b18828fda5ad8a437299
SHA512 e2b0c0376ede576dd8541a2b6e7d6ba02cb61033dc2e96e79ffa1e653eabf18b416c0d8413970a6a89f4b67543b76c247dc8fbbc6da7446eb36b8759c75eaa1d
SSDEEP 12288:5qXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5OsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B34523BE965C41CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDFAB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 5eb195641ef7067c213fbe0e4a5f456b064e6e0822eca689fb05ed7d679868ce
MD5 a9fb590e20dbcdc306a378812c8267dd
SHA1 2f7c419d81d12d050d6955add06d847148b86964
SHA512 e8f8cd09c1467c18721bce89114bf75b39f380d70239c11f2ed87f916203194b5bc8b4b48568391d05548f640ca3ac48346d75cdb977f33c2f6f8f174b516d5c
SSDEEP 12288:FV/XXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EE45236F675C01CAD83285B4C2F5E11DE8237D96EB3005DB6B532CAD9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 289b8c9f9695c8e31c338b12bb636504d287b7240443353489a5b9d140ddce54
MD5 bbacfecfefeac66d410bd9a5252a3736
SHA1 4491d4d8fd6256abe31b634837a7a1a57292b5d6
SHA512 881a66eec4b9e1aff3e7efb4f977a5cd4f4d3ba86403936c9595b7d48e934b386f28870fa571d96aca0853e11d3a543a736d83f37ef19c746c8f482e306bf55a
SSDEEP 12288:XXXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B84523BF965C41CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDFAB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 4ddb06cafd255d86d1b88017d80ff70cc70a692ef65c614bdf4ccd4bfdb6acbb
MD5 f939b4bebd0aa2559979d964494e4d3d
SHA1 e3fdb7c4e4d627f9160038679b740350896f150d
SHA512 386011c2844cdb46fe260be7bd2d2562d7a96dc688075ac8d09f0e04ca82ddbfb3c50a96f153330d7e5888f5933cd3933eb10d438fdfae96297b5f7a187a1809
SSDEEP 12288:RAXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D34523BE965C41CBE52648B5C3E5F14DAC073E5BE92004837A9B7CBAFAB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 4ea701167fd74086db23b65870469957a4062e7de4ec74527c08eb65d7a382d9
MD5 1a0542cabab34f7153c65949569344d1
SHA1 2acf9271eb57dfcbe3854a3bad219c94d5ee2a64
SHA512 a92e3eef64b7ad79351089adf0e8203db75a8d8c2238eab9001baa53c89d56d7a78006e849b4491e0f87a6b2c893a4999d6650dd8556752fefc7c8ef3479a2a0
SSDEEP 12288:GkXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1984523BF965C41CAE62604B5C3E5F15DAC073E5BE9200483BA97BCB9F7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 6534645b5ea5028d647fc1abced369b6f97576760bfe867d9e7985c95383e884
MD5 8473e7ef49c831afb6af4e14900b82f4
SHA1 e3ec3fa7cf999be4e427b74bf493f964cd0265e9
SHA512 624405e7dd2a6113e2c08de59260d84f74b9c57e8103739f868c2f906b0fb7080aac80b86044a6fc56a48472c2f21d07912b1154be0989773196e8833b37a520
SSDEEP 24576:UZMSzFVSOksqjnhMgeiCl7G0nehbGZpbD:UZMSzf0Dmg27RnWGj
TLSH
T1096501A9B35018F8EC63813EC965D90AD5B37C5A0B70C61F13A5366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 328e9789f864e17025048040cc958b9234a4781e7bea7885da32ad94ea0e7feb
MD5 bf0bac37e1dcf8e4369f97baf7ca52e0
SHA1 171e82da3253502276e1a1efd470e6b2a256d07a
SHA512 cf9b1071cb29e08b26524ea90c55ebf8bc90a074b2d04479fc43b94c1f05e4e1de8cdd25e0e11869c88b54230f6208157d12d65c497ebfd43acb9177c5f1c09c
SSDEEP 12288:R9XXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1594523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 58797c86d20acfbf3ccf0f1604f2b55bee0d5f4a23b19038b5aba2c35841547d
MD5 95e0df3d03d43e58c3a32b4c2ad5988f
SHA1 4719c36a86addf253c1572c7bc3edfeb40f87206
SHA512 29a34a62cfd4ef14afca4ea461675d5c688edff863184ab8cbb1275574eee99821603ae4d65feceb5f1cca581d182873b0583de53847abaed20c5fbfb8a082c8
SSDEEP 12288:V5XXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F14523BF965C41CAE62604B5C3E5F14DAC173E5BE9200483BA9B7CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 19c0134022c12499f9cc7fdf248c031fff242e4eb31ae78665dbdcb40df7b516
MD5 985debdc464bc4de2ebf38a7757e5135
SHA1 b42b89b2cfa578a57d76695f409869301c140c2a
SHA512 860b57814695966397ae2c1233dfab49702e923cfa0931c8758b365924b6f461ff1b2a155655bbc0c58cacd0c98591aacacc8acc90da14b29e125aef6e13355c
SSDEEP 12288:eyPz5L8IXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DzyQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FD55125B73A530F9D1378178C5A29A06F7327C3247204A9F17A516BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 f77f3cf70f933d276a4c07e411d2f357d3912680b1e9f240875c1b7cd24b5db7
MD5 6c4bb940ee365ae67b63f6fcf2ca7f9a
SHA1 8446ef9a0fc3c1b2a2d72b2638932de8676c98e8
SHA512 e62e81ce4475c6214ce5f2a8f35bca79263f470e7c7d68ebd6e5929db3b0ace9ebf36386337f3b98a04241be13ea3b6bf04d627e4e1bb59ee8c0c855391eaa7a
SSDEEP 12288:V9XXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16F4523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 c63fe0500935143ac48614915c700b843d6be7ac72e58892d398433ad86aba3e
MD5 b9c8c88684aedf77941656616377b536
SHA1 d7d18803648a23e302f45c7ce17185d4bdac336b
SHA512 df0296c0b34c61a5aee5ba53818e5571400aefaa4908135b87b7c50393e561af9ff301e13e1aeeb881ead311f1708be0a98625713ebc884d7e773962a31faedc
SSDEEP 12288:D9XXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11D4523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 b5baa489b45ac18c24c68f6992ca2bb52df2a060f66772d8be6b7f7fd8672625
MD5 a6c5372fa7e23bc869856ab7936a484c
SHA1 7bf3db4e604b982adea6a783ed7d6e55d72367ad
SHA512 7eee750933d85b69e4a36f6b66a7eeec1c432c1518047ea1487c5d82242fb6ad524218e307e915812a60523eb8caccbb44e4d85275bf9232ea3f8e08fb77a642
SSDEEP 12288:zyPz5L8IXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+zyQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18755125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 538146a55ad7ef56ad3c1c95ac5399cbc28a107d220fad4212e2d61e8cf12e7d
MD5 95292bc58bfd67fa95e80075497615a7
SHA1 ccd35efcfaed448bad5ac095d1a52af7bf898bb2
SHA512 f2328dfcdbccb6608ffb60d43698ffd4884a43bcdbf70e7da87c70db3f67951862b1a43dfbdd27d3d6337bdd966f6ac471b0d686501a855430dbc0a3e9d5b599
SSDEEP 24576:bTHaLl3z0zDesqjnhMgeiCl7G0nehbGZpbD:bT6LljnDmg27RnWGj
TLSH
T1216501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 86f696284edd8e90d3ec57b66c6a87f2f1d317170e693bc2b0de0b370e803cdc
MD5 33d26d83ddcf64512274c8632805c665
SHA1 ce0cf38440ee8079376ed93eaf5b0708942cf5a1
SHA512 ca66c8ab33b7c75e6959a16c2a79c4a5cbb1965b8b85ad1b68f877091b507c45c46c38fa0ad52515ab6c492f3c1cfc508ee433dbdb1e12717cfbe36dc6d8900a
SSDEEP 24576:t37d9CHKy7GZSsqjnhMgeiCl7G0nehbGZpbD:N7d9CHKya0Dmg27RnWGj
TLSH
T1A275CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 ccc7b3869cb663416d3fcc18218e636d263e8cbd90c8afab7f380a60bdc663dc
MD5 d9297037813113cd74dac72ec4439d2c
SHA1 b2d2526d3e6126b24b0958e1eb33267a2f8a563d
SHA512 51735acb7de5b1caecfdc7b470a69d991d7599c1d4177b89c1d91da6e63414dc6760e26a6f761c85318ef62e538d23b361c734bf68ada34e162d44726b39b1e0
SSDEEP 12288:QKXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QusqjnhMgeiCl7G0nehbGZpbD
TLSH
T18B4523BE965C41CBE52608B5C3E5F14DAC073E5BE9200493BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 d283929143c01881db7209b30ed824e8c0288300bc42034eec642229c38f1ac7
MD5 2404e4059b869cfd8e236a90bf709f8d
SHA1 ae808f5681314a6aa553b5140b561674c0ca5151
SHA512 0abaa58f11ff955e18e9ae921732c062c02ed9dbbc6099a429668bcd54bbd767072b046a6d56d2777c22abc13a29111666d235e551dc5d636f7bfc4e351f1c76
SSDEEP 12288:ooXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:owsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A04523BE965C41CBE52648F5C3E9E10DAC073E57E92004837A977CB9EBB18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 da8af839aeb77f1482527bc3b41ed95ffe12f4c4189ad2fa5592e923b2e569d0
MD5 a3a5a320a34d6a681fd86add12daf85b
SHA1 94e2dddfbb0db4621447250763833ebf95d4fd88
SHA512 49f0ed4ffd8c41b11249708e4d255b77d438a1adc62cee3bfe14c2e072edf6cf6e1aab1b12df86f8962bec17ec507feb10c82516d5f292cd073faccb653a4733
SSDEEP 12288:P7XXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1544523BF965C41CAE52608B5C3E5F14DAC173E5BE9200483BA977CBDFAB18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 1d392cfc9c2f786914ef55c26c22de19eb2000f083b530ce9a7cf64e125d1b10
MD5 9dd19e7e5ae1a6f8a68a7d0c14f93030
SHA1 0b30b892936ba049acd558ceff3dc2e8ca0e4f25
SHA512 4126b6f6060fcf72236ba4045cd56805d9d020b4ac60ffed476dcf0dbfcd6dbea037ef7ef3138816860aa969e800cdeebe0d5e03faf5ed97552192c9c411d621
SSDEEP 12288:+9XXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+RsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AC4523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 f1acb3f683fe64ce12686a2825452597c7cadb1d7ddca7539236701b43587390
MD5 37f4c8f68b7fbab3c8a9726f3b6bc0de
SHA1 58ee304d65c6c5ed834de57bb4f60dedee6975d4
SHA512 73afcc4b58274b6b180b51877b6f0dde13932b11f2a83d1b2d4b89c3b06c7eee6841f20b595b9b54d6a48849fb4181bd092a36991146a86766aaaeb75defd9d5
SSDEEP 12288:8KXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8usqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B34523BF965C41CBE52608B5C3E5F14DAC173E5BE9200483BA9B7CBDFAB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 f82c351c2c6448e3b0d61275723af8faff07071d51e616b238e7b646d68405b5
MD5 a3719cf12c832b71bd47948ee1bc1e20
SHA1 9f32baffbff5d2795ebd874a0e8f944de79027b0
SHA512 73d28231b1eba428bd7f7c5904d65e2d5e5b9a8d9eec2dce1659a06ad656295c383be109feb20d5766ee559cbad46e926097b8fac06ee8828f6dbd215f6320cc
SSDEEP 12288:XVXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DB4523BE965C41CAE62648F5C3E5F11DAC073E5BE9200483BA977CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 531f2930b4bcb9f21c8b7b5c95b35d4e4d46b5edac2f1e36d3bc8d113529fe16
MD5 07eaff3856ad14031ba4979e8d2ca597
SHA1 736db6ed5f440d9e32a359f4c5cea596b573f56c
SHA512 d7645a80134a740aaed186f9e90c7128320fc505bd21c6403384af6476435400ce832fa785407f83e02f18db12b9737fd5af90502b780c2e5a743da803bd7686
SSDEEP 12288:rXXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:rHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1114523BE965C41CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 26721135240782fab009da753ed63cfdec76102a2df92daec783e889257935dc
MD5 a7dc3e4e518a3b44011651363ad18abc
SHA1 94825550d760f271fe23382de8c5db1ca8f5029e
SHA512 a223c28f922f397615bb0a19041639da1aa6db04d9813b08d168bb0c8ab2b57113200485418a6dda61f872abc37e661ef4b0ed1d59dc81d99a0661662bc11fee
SSDEEP 24576:bfwvok9RX6wkyAIdsqjnhMgeiCl7G0nehbGZpbD:9MnYIBDmg27RnWGj
TLSH
T1B185D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 ea2a00563596eab7239b67212c6f60be1c61c71981e586258485c27bb2553621
MD5 b5502f02dee46895312231210af4eaa8
SHA1 eaafe536e17898af1f6051ad1db7c9fa15330a67
SHA512 d1f056d602f400819f18b908770708b26f290156c47bf272e7204b952903b3c01db2d3f9aab297a55a7469a6e3ad44fa2c2b3e162ba60c24a66cee9d5e14dd0a
SSDEEP 49152:WYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0ODmg27RnWGj:IySzPWD527BWG
TLSH
T146066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 b1890d6a97c3064a4aab0488c843d655c77a69cdb3e5df52bbd9254fb2953980
MD5 a2ea2bce1c24b210db59eb36585c03a1
SHA1 67d5aed11c6766bf744c184c7c2845de909de1bf
SHA512 50d5c08d2061f3a5fef37a3b67e1e03ed9fece354f4828e82fbf304056b144f12209ca8ef842ccc58b939c0dcdad42f958d956d5133f7023ab141836722323ed
SSDEEP 24576:s47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYUsqjnhMgeiCl7G0nehbGZpbD:s47JUQj1irIhCnDHUPfF/+Dmg27RnWGj
TLSH
T1CC65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 9f4026cc7030771529f2ca3c9e78d9470ac4dc57f639540773ed114e221d9809
MD5 2e01d6bbe91fba45fa40e3e933db86b6
SHA1 f1efa683309e18970bd6f781464c2f1d55af7860
SHA512 cc5dc00c4fe75e9d27ac5163beedbf6affa5943007fb30e90e6fa56d8325999adbc2ef8b1e997fa4fa902652a65cf73efd51c63845ed9b0026aefc7cd757e788
SSDEEP 12288:INsfNXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:phsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19355011AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 417f92c26722cb3298a39ca4fcf443393915cca5e311e3ad076f974f354b49ae
MD5 b23b648f10d51d04928163d1bf6047e9
SHA1 203bfa5668182807e42a21a44c1f301a0a8526b5
SHA512 b52f668680c2c5251af4405758d7e5273864e3d61a55e3911cd303f7a88652ec924946dad011efc22b614594cf0ec49f2145b0e86bfeb227431db50e85618fb2
SSDEEP 12288:FwNvxXTU3fgb5twZlB/TFfCYJqwS49aRMEAB:FwNJjUPg8Z/ZC6v19aRME2
TLSH
T1393516417626DB4FC6A940322E32D6CCAB707D41EE046F0773C9873FD476659BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 2db0240a8817a93d4ddde8c426ff43a8e7aeca0aa8585e61fca013dc6b19ec14
MD5 beb059cda8a17ebee44601c0c8d354b6
SHA1 cd8f7e8d7eaa22f092567b6ad8a7253343c33865
SHA512 904f3136d8052986c1f5a8601c37c2842bc2001ab309af793d8826ed36a8889e95183ad17ccbb3cd3334b0f31a6f1412ef733251909e103c2d26b24be626a209
SSDEEP 6144:pnyRp5u7jJfs2ywtvi1Hqv3vXOtv6y6YjSkhVNQytMx9QytMxr5rv+doLdOWs4iY:pnyRp5g7ywNi1Hqv3v+t9LSKVJu4GMz3
TLSH
T1B96509816136E78FD1BB5132072AAB8CB764EC06B7091F17B3C6053AD82A751A4FD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 3aabb18db2d252163d5cc9f5761c926311ccfc263fa791bd0e948f82adc21327
MD5 da3498e441ca0e08c1573bdfb19f1b73
SHA1 9f39d8ce8d7e6b2c58b06c3189cf1dd2566b14bf
SHA512 ad3edfe84d0d339f803a6b7146ca36674aa1b57e4117c8904f0038f7b26ffd68926435e6bbeb7331de1a8ab99bdc13bcdbd9e632c7cb9c752d35d1c955748866
SSDEEP 12288:HM7lXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8psqjnhMgeiCl7G0nehbGZpbD
TLSH
T18A45237B934C518AF93605B482EAE12D681B7E669F1044C3B94778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 4a65194963fdc5f2937027dd879a28fbda98be33b5fae337d9eb4d4deb98791f
MD5 922487b5b06db45e53f08b2f5d4b1010
SHA1 5d72fdc2dfad3cf68ebcac61d398066785fff82c
SHA512 dbba701223386bc83f71d3a83ea5d109ccbdad46647dcade75b0578aec7a9026ed41d5a817b69720a41c6592e7e8d2532782f36ef824c31a1bd2b0eb4d08c797
SSDEEP 24576:vgb6bmBIi49WNNFpg1rSvFv7bYjsqjnhMgeiCl7G0nehbGZpbD:vgb4mBIBhGFwDmg27RnWGj
TLSH
T172659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 bacdd1ac953c4c0149653fc0147993f0a386d3c0c74973db8713c8f4c95f3b5f
MD5 f662bcb0f93ae5e35232520bd262076d
SHA1 31ccf2bcbd33eb711af5fc436c82df7737ed05aa
SHA512 371164ffbe9b10d0e57b4ad083f3c7e7ca896b2e69041a4c8c24356a5e14862ec37c38bd44021529a62b4468b385c527bb81229561ed909dd447b78b4959bfbf
SSDEEP 24576:iG88u8FpJqH1bzria7/mksqjnhMgeiCl7G0nehbGZpbD:57ZFPqVea7/fDmg27RnWGj
TLSH
T15285016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 566c07c3b2e9ec926aa911a0b0d8926badde40c2a3f3d410346408279000b066
MD5 9e463730297c8b3bba326b3e0bb87729
SHA1 5b96cbb07b4a57308a2ed8412bfb4a1150311d1b
SHA512 065a3aa140613ad6c04f2aa2aa2209971c70d886996d094dbea212df093330021d14cca39af0adff5b336bc6535871a5f9606d4b223ed1c22e65c584862da27d
SSDEEP 49152:ZBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjEDmg27RnWGj:6G05lO43b5D527BWG
TLSH
T149D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f9dd4f760f4128458b8a016e44028a59cb556e835b27c234524b437db51c6920
MD5 75cc0397f16858d155868576646bdd07
SHA1 909efb5d789c752c4122e4ccd7e7c13e83ae5db1
SHA512 d53416c1be1bb96937484f452b2a549db60d87e753a670bc581881aa55faefbf93a4511cfa031f4257d5371f37bd8a392052d9f1dad29738e0f3e3fd44dfcefd
SSDEEP 24576:Ufa5POZ3dpFWVM50JicR2hG0lasx2+47eidn6sqjnhMgeiCl7G0nehbGZpbD:Ma5POZ3+Jt2pasx2+msDmg27RnWGj
TLSH
T1A765BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 71b10ec34254c91f9ec1522ca69a3d6c4b12a27616ff84641749bcfed36fe29a
MD5 2215fe68b487327faab7c360853c4192
SHA1 bc18f8a60a30db08d8cd3be2a391c2da36f2ea46
SHA512 cdeb58377ba5acc1256d72833f30f3aeb982b9ccf37eeceaf61d39c35ada5c687df518a7034a0b0373d9651cef958c128b8d77607bb9d00202efb978991b29df
SSDEEP 24576:DNcwHdjbyQ4nLC18lb/EOjowL7FkcsqjnhMgeiCl7G0nehbGZpbD:DNc/zEOVHF/Dmg27RnWGj
TLSH
T17A857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 241c5421e57826bb223243ffcd087ca9ab1a8117abc2823ffae19489755f9554
MD5 f9cdf47e1cf2b048ff878740036cf67c
SHA1 f6b06108787308753d033de73b6f450f7c7f3d03
SHA512 f6d565470d07ce89a870ff7576080a0b2193aed3ed72def93044343561f2858aa91257478cf8ec9104c92240a70054972f9d3c7a04450467a7b7c2ea0e0328c2
SSDEEP 24576:L8kNvNnaFeYhJNtmZBmlsqjnhMgeiCl7G0nehbGZpbD:L8MwBtOmZDmg27RnWGj
TLSH
T1C755AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 ea92bcf3a7175a58a0c6c43edd579a00093fd05fdede8d5c64df4a688ccb86fa
MD5 2017a44425b1477df191f9a6f3acc07c
SHA1 a50d91726e7fd056910c6f1ce44ad026b40c7e75
SHA512 a73c2f764b2dfa3a50c81c81a92a1c87a4612ec2eb11bd0f44b1321497235e7e14747b7d2c9ac7af0fc8e099bf917c4de802f7dec2c234b797c1f5e485b48d1f
SSDEEP 12288:4HvUrBFrEjwaQwXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:4PUr+NQIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F665F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 efd23d114fbbfc18d4530cf614e5698b83e9e10b07aecef118a68615c604be91
MD5 815f47f7bf9249b4b9280ac06f86a76f
SHA1 a0638aa3e11a8586c35426247044f025ab2e1c02
SHA512 882200055c6b6088ad5a18e9d9fa77ea09f81d3be19ce2b59f0d179d35d6b12ff3f15e36f1706dad47b431f1e725ef34fdf8934baa0b0d49f7333e647f454cb0
SSDEEP 24576:lD3FHshBIYQgA1sqjnhMgeiCl7G0nehbGZpbD:lDVHeBIAApDmg27RnWGj
TLSH
T1BE75E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/368-286-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/368-64-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/368-57-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/368-58-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/944-91-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/944-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/944-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/944-333-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/944-335-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/944-97-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1136-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1136-136-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1136-138-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1136-130-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1136-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2784-317-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2784-117-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/2784-123-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/2784-116-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3056-42-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/3056-49-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/3056-55-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3056-53-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/3056-48-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/3056-41-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3976-310-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3976-68-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3976-76-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/3976-70-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4636-152-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4636-319-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4636-318-0x0000000003030000-0x00000000032CE000-memory.dmp

Download

memory/4636-146-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4636-145-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4696-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4696-110-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4696-103-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4696-314-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4696-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4696-104-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5692-29-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5692-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5692-127-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5692-30-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5692-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5868-0-0x0000000000400000-0x0000000000642000-memory.dmp

Download

memory/5868-15-0x0000000000400000-0x0000000000642000-memory.dmp

Download

memory/5868-8-0x0000000002550000-0x00000000025B7000-memory.dmp

Download

memory/5868-1-0x0000000002550000-0x00000000025B7000-memory.dmp

Download

memory/5888-102-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5888-23-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5888-17-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5888-16-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5952-311-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5952-86-0x0000000000A10000-0x0000000000A77000-memory.dmp

Download

memory/5952-80-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5952-81-0x0000000000A10000-0x0000000000A77000-memory.dmp

Download