e02cb84dcac78272fbb08a07960c7ed66d7c3efee87d6276f67f8695ad3d8a5e

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/10/2026, 17:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-25_a6f666c83a40511ee637612cff26466f_amadey_elex_luca-stealer_lynx_njrat.exe
Size 1.7MB
Sample261026-vk3d2at19r
SHA256 e02cb84dcac78272fbb08a07960c7ed66d7c3efee87d6276f67f8695ad3d8a5e
MD5 a6f666c83a40511ee637612cff26466f
SHA1 2b59f133dafef031a81e27b22f98931f0858f411
SHA512 c904e92c0641d5995d98455d7a4193b9525da5a0beecb960c16cf47a4a7aab47fff09eee450cc52ca4e2951c92cefdc8faea3717a5459ce4519cd0c560ecca9a
SSDEEP 49152:DV91TaStxIRmBdpUcLNiXicJFFRGNzj3:DVC/kdV7wRGpj3
TLSH
T17A85F03172B5CA31E46634318927AAF5666AFD20CF6156CF73843E2AB9302C1F934B57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5792	elevation_service.exe
244	elevation_service.exe
360	maintenanceservice.exe
2484	OSE.EXE
1428	PerceptionSimulationService.exe
3548	perfhost.exe
5884	ReFsDedupSvc.exe
5928	SensorDataService.exe
4680	ssh-agent.exe
932	AgentService.exe
2472	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-25_a6f666c83a40511ee637612cff26466f_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\25244214b68fd3f0.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-25_a6f666c83a40511ee637612cff26466f_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-25_a6f666c83a40511ee637612cff26466f_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-25_a6f666c83a40511ee637612cff26466f_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4884-0-0x0000000000400000-0x00000000005B2000-memory.dmp	upx
behavioral2/memory/4884-35-0x0000000000400000-0x00000000005B2000-memory.dmp	upx
behavioral2/files/0x0001000000009323-47.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-25_a6f666c83a40511ee637612cff26466f_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-25_a6f666c83a40511ee637612cff26466f_amadey_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002af94e046c65dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d99587036c65dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000026a61d036c65dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003cb9fc026c65dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000494e21046c65dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5792	elevation_service.exe
5792	elevation_service.exe
5792	elevation_service.exe
5792	elevation_service.exe
5792	elevation_service.exe
5792	elevation_service.exe
5792	elevation_service.exe
244	elevation_service.exe
244	elevation_service.exe
244	elevation_service.exe
244	elevation_service.exe
244	elevation_service.exe
244	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4884	2026-10-25_a6f666c83a40511ee637612cff26466f_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeTakeOwnershipPrivilege	5792	elevation_service.exe
Token: SeBackupPrivilege	5884	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5884	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5884	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5884	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5884	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5884	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5884	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5884	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5884	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5884	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	932	AgentService.exe
Token: 33	2472	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeDebugPrivilege	5792	elevation_service.exe
Token: SeDebugPrivilege	244	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 5836	2472	SearchIndexer.exe	102
PID 2472 wrote to memory of 2580	2472	SearchIndexer.exe	103
PID 2472 wrote to memory of 4136	2472	SearchIndexer.exe	105
PID 2472 wrote to memory of 3860	2472	SearchIndexer.exe	106
PID 2472 wrote to memory of 5116	2472	SearchIndexer.exe	114
PID 2472 wrote to memory of 4568	2472	SearchIndexer.exe	115
PID 2472 wrote to memory of 3164	2472	SearchIndexer.exe	116

C:\Users\Admin\AppData\Local\Temp\2026-10-25_a6f666c83a40511ee637612cff26466f_amadey_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-25_a6f666c83a40511ee637612cff26466f_amadey_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4884

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5792

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:244

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:360

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2484

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1428

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3548

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5884

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5928

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4680

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:932

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5836
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2580
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4136
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3044 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3860
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5116
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4568
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3044 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d732a72ff8bfe9470583f30eb069ff06f9f731512e9c277ed7a00837683037ee
MD5 58f8746a5245685b6743e7d0abfbd43d
SHA1 4f4a311ea15471f95ee87dce4a63b189ae9fec57
SHA512 60fe8bc534ecb40a9cd49656ffd4fb26f760ff7252a50d0077e996d6f18187892877770a1ace5e9117913199130dea07286dc289383693b1911fa452cb3e136f
SSDEEP 49152:Ab+632BuPkFKRrdE6ohdstBhuXjfS4LWxnILNiXicJFFRGNzj3:q3q6mjBb7wRGpj3
TLSH
T142D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 21162e9508034a54231c0ffd43d172d147ea75c87787655842ee75f8bf32d4d5
MD5 bbdf2487e21bcc14775fd8d098377a16
SHA1 a1efaf6b6ab413f8b199193dd9cbc30180112c5a
SHA512 9a48c96b1e00d9d0dee1ee1c1da7c5a96165c9d31fd651552b8197943f9de1b478eaf216114f80aa52767ddc3a6adfa9bfc49086d18d85fdafa72cddfdc7b6ce
SSDEEP 24576:uXYfDtczAH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ttcOLNiXicJFFRGNzj3
TLSH
T19C75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 2073de1b7b36a54272ea77bbc6eb77cc103fb2b5ed9e342e6d7c0398201b2478
MD5 5114e7d1b89d20884e5d466469f03738
SHA1 0481b35d78dc409b36d076c23950c6d211e4bdec
SHA512 8c4398d84e46e11de7a9bbb6656fbf64c051fda5ddd10a2af40502c3ecaefa97387b579a54a28bcc70fb547cd1f9a51b030ff7bf8970d64685ee1a37e91f8512
SSDEEP 24576:L0Le5ji0hmxhrMQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LPji0AzRLNiXicJFFRGNzj3
TLSH
T19C85AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6cb2cf35c77680463d111ab56b7b72ffe39205eb100643cfdbf68129e75e5b85
MD5 d46006a640824a0b77021204a812f9ba
SHA1 50b30cf94a1431c5c14e361f07bebcbaa7cf9d10
SHA512 2c5349fc039c279ff79cbcd052eae5414a2952784f3f489f61baac5cf3a38accaf9ea4bd6da7f288763e043069c85d67aec8f950f1e97f4d6fe72348fac65235
SSDEEP 24576:Za7/ezSC6vUyD/aqgrvWj6q8wyue/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:I/ezSC6vUzPv+HjydLNiXicJFFRGNzj3
TLSH
T1C0756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 bcd44ce336997beb1d4382e15c8d0b2e1368a3e9981248da6656621dcab1eb33
MD5 95e5de3a735897e253cb3dc829c3e351
SHA1 79f0fc18d6c31351e8a6ceacdade511e36da43a1
SHA512 537e6048f4dff54c84dd5930cebfdf2f8cc89ecb3f9aa29f5c913cd6ac61cbaa289cf8fe362f8ef0ea74620e5fef928f265dd4cb79fd91b35d836e4f8854353d
SSDEEP 24576:/VbqPb88hv/l+Br/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/VO88hXl+xLNiXicJFFRGNzj3
TLSH
T174559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 2fd65f64e0d7e0f272b12a74474ce139869c7f3b471d272557886136471cf2d7
MD5 5639ce0b8711b3658bb40768c28fc09a
SHA1 3748bd30b759d708bc6c3c98ffc55cf36b1aec0e
SHA512 0aee3965de67c54703961beb532aa15d98316671317c85b18148ebc098dc7002302724ab508e25fead6c2b4eb9989630ed7e57f4b19ee64bec44ece42c57abd2
SSDEEP 24576:bGU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tLNiXicJFFRGNzj3
TLSH
T1A45523D3468854B1FBFD003A867A5828B5845E2CCA595DE2D2543E5EA13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 80b10b3cab4081e874aedbeb2eca8cfdffbed223227c6016c342e965c2ff1767
MD5 56d3ccfbbc4ba0b4c0c10a2e04460aeb
SHA1 2548c7cefc5b21c2309ada8912b1c53c697b7a94
SHA512 e966e748d9b9a72d1022b25ea041f494209902fbb88db3cc18d18321eb1e02c478629361370594172ef67e89ca41ba797b477d49bf076cadfbc5e606b36419e3
SSDEEP 24576:GJIUz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GJIUzLNiXicJFFRGNzj3
TLSH
T1FA75CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 9beff63861950e45cdef12bf9008985e6dbb5d0621fb74279173b88737a69c15
MD5 a340154f9a4209736a9bd281fcf4256e
SHA1 1cd6ec74445b4ad45a863f48e176a4fa8d79fe09
SHA512 979d180e2b93d8b28b71644111cd5a006b9d6b947f90dba5843201fffbd7427ac213cf219962a385f4de0069c965ef0ac144c0c30962a98a997cdb5645daafc2
SSDEEP 49152:uQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THX:uQvGAdlCEL8c/WRNw5Cu7wRGpj3
TLSH
T17C266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 d3be77e8f068db7fa9e52d1d3b79c48d2dc9ff4547624d31fb005777c1d1d80f
MD5 c9f34d7a7bd50eaab84583c2e7a49fb4
SHA1 b06570cd44a39d2d5c27a4e3d0e53500d360bf86
SHA512 39c4935e0a6697587308cd5ab94488206ce5029ffac0dceeac15b1eb3b41035c188eaae442e33c5746d9c53d099a1d8c4c12c0237e903c6d513ee4bb1715c7ab
SSDEEP 24576:jfewsAjh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zljhLNiXicJFFRGNzj3
TLSH
T1B375E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e4808612c533ee16f26a9d716ce7668124a47c7c2a22afe97b008e9e70adb6ac
MD5 0b1d0ad40cb1f2c3b0cee14f50ff3f6d
SHA1 b3ca725af7ec101704e35b5d01be01a659072e57
SHA512 6bb893c743b0f37bbea8405ec093236c97d2f51b5f03859b133b20b400e233bca4344c62dbe225c3ff2ae5c5a3a6cbd0077cdf0541998e9641257dd2411eae0c
SSDEEP 196608:JUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHtF9:JUEtQevvqc2W1cpV20I32T9
TLSH
T114474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6a8e5346bcb2f6dae1dd0bfe629cf714d894ad604165c12add0fb9c02caae6dc
MD5 29570e3383545cf8dad32c1c1c1ea64a
SHA1 4e0ae40c57221eaf85eb86f80fd3b49c111b0abc
SHA512 e78261bb40676cdab3bb3f5149f6bed3bf8b782ec2042d43ffb34d295e745170e747d5e8362d335eec2278093e1d4efb9353fd8d22aee43388a90d07e019dd25
SSDEEP 49152:yCbRquA/m2yL5zLfFiV+XenmE3/zBLNiXicJFFRGNzj3:Xoq2Vjnmq7wRGpj3
TLSH
T1CFD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c1b3eca07430bea67609ea981f14388b16018197feb264cb3e0d969e75954fb8
MD5 642d43389a42cdc78653ccd39a9121c4
SHA1 79b8926fc2c2a10745cca949b33eb2480893846e
SHA512 7a71504cd00a63840440bb2613d62b5a3c1a42e6d05d33f70c233478454ec0c075dfb2a21a970bf6a4f5fb35a4db4027779fbcffb100f1815f4dacf57f1f4850
SSDEEP 24576:3AhGL6IFoiwtA5l7S53K/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3AM5Foiq56LNiXicJFFRGNzj3
TLSH
T18B359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 a9b6b341d83f2caccd5d33a26f9d8fb46037e1ec8e26a6c9a71f04e0db8f352e
MD5 bad3a29f2b0e1ec9d210a71084cb1e0a
SHA1 d31bb5503a9081b4c5d672567c7779e30f23fb04
SHA512 2f67e7237aa93b05974750c4e29dd8c6d22098f5427c7f1620aa1753d74fb2f1a230b87b59f68c16c7d410d7fd55fb93fd2cd7d57ebb114cab1ead9e8564dff6
SSDEEP 24576:PwuROW9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PwSOmLNiXicJFFRGNzj3
TLSH
T18165F08632940CF9E9BA41398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 309c3c8eef38cb69314f8cce3dfab063557ed5b8489f9ef2bee36166d37ba4e9
MD5 4dd3419fdef0d35e87198be69374c910
SHA1 61ea18ea6d2c41b2324b4ab42dd5c35f18e64d1f
SHA512 91782b6e1039cace745421aee58242ae7cf0761704e7cb28abf77ac6a042ce129356164ef2a3fd09cf13fa46cefa8d55e903833d93db45e91e34b9dd5f5b5973
SSDEEP 24576:AZuY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OLNiXicJFFRGNzj3
TLSH
T1A055129622C420F5E6BB403DC9F54504E7A17C2A673643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 635db2886a3d1bee6e5341d48294d02e8998ce9e4507519148686618fefcc5ee
MD5 b8a55ae2763ebc1d595ed6dc91f4bc40
SHA1 2cb376cbbd9127876b1d2311fc39a528c5ee7d7e
SHA512 102217633e0081e36698179fdb483f42d2ef3e2a73b20a8d7abd02f08ab5e77c097d8b350b5e005f1b379d193fbfc75655ac2cbe70cdf7f81a4a3e89f8144f67
SSDEEP 98304:sQRQyi36YOcPDLvw2gAf+PN3P7wRGpj3:zQyiKanX+PNjF9
TLSH
T1C2667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 3cfba6331bcf0d82c61ef168458ddcebe7727af577fe325040b8c8857667b0f0
MD5 db4f5a754d50c1405169be0ef7400f23
SHA1 fc995749f2537e56a51951322acc3265f3126df8
SHA512 b403234652b6e70475ffc89e8461741ce7f72dc35bbcabd0ac6bde89043d824a34a5af81d797892f0e2e23f60f49dbe652658f0bf26891a544b9ec97735b1cb6
SSDEEP 98304:OQRQyi36YOcPDLvw2gAf+PN3P7wRGpj3:VQyiKanX+PNjF9
TLSH
T1DE667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0adf1c7856efcb3b87998bda6f1d1351bf5d847cb2fb5b65ad50ff8831d9c6f4
MD5 91b5a38cbd493f3f6e9827bc216746eb
SHA1 638523f863d52fcc11084708f1af42a6bd5e939c
SHA512 eb4c6bc24cc8f6685798f710f60a7bb8d4c6c6f10d294dd40f5267861aeab5e941836864c855c2ec903a476d00477ae20d5c985a8310639c77f9a60ea0e575a5
SSDEEP 49152:V68Qg55nhkeWu7PNU3/RLNiXicJFFRGNzj3:jthTRc/R7wRGpj3
TLSH
T18EB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1195467028b0cb31056429fe982201f104d974ce4b220b68f37b0ffedcc81792
MD5 8502c21bd9e2838175c33145f3bdcfa5
SHA1 87f85b735ae87ae734f248ee9cfa539a9a5f3280
SHA512 0c799ed6ba6becb6de20d92df945d82ce0fb026a93dfddf170e971d900457028cf55f0c444e85ceffd25e4c1df53c23f4d70d6a2cff34e0de672e53e5b0e5245
SSDEEP 98304:Vy5112gYy5azzVvU69nLKnhZU7wRGpj3:4LIHRWhmF9
TLSH
T1FD167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6718cc3458ed5a4f398f0a9bb3d825038605fcf75699964e5b06b0d48eacaebd
MD5 411ad1d6bfeaeeab8ceffd68cbb0f497
SHA1 ef700b74b5694ebba3b6dc34aafaaee72962187d
SHA512 3f4609572a7f2f9dd662d67ced228d36da7da49a360aa3912fdb4bbf6b828cd654e6cc50c170d838b588b6284ef62c7411568bbebc7401097c603b0899e9882f
SSDEEP 49152:gB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glHLNiXicJFFRGNzj3:6u6JmIxd2dH7wRGpj3
TLSH
T1B8D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 af5664cc49343c4ca76baf36698d4c1015aac5f9ec544b98e6e87ab46d08f376
MD5 ca2938fd02c528fcadb4ccb838a6a42e
SHA1 f8b4a1096285977f3308cb94cc8abaa6e536b521
SHA512 c2e4d11beabf31a5d9bd0f37bc84bbad8d8a0326d4dd6775de193d619e69d897089c7d0d16c61470c3648f823e2f798194c9748efb7ea32b8070d00d53ab50d6
SSDEEP 49152:w1hpsNoJpF1A67U44CwH7R4xTLNiXicJFFRGNzj3:wmifPqRq7wRGpj3
TLSH
T193B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 1b18f87fa12c950a2f834ec18ea4d1ffabb8507b6ddbb58a5fcb076a2081de6b
MD5 e1f8919a56cf0b64f275c1d8ec0512bd
SHA1 1e8f7835ddeaf6b5bc9f7c13070e72fbc1118e49
SHA512 5cc066ef40ae0f857910b7b660102ecbdf28bf883cd657eefe7dbaa4d966def80d589f0dc48300ee4e7058a7a270936794b95af6d4efb31ab49e8f70d8508a86
SSDEEP 49152:jSuZQIY0Be2KkRVtOnks6NMHqYLNiXicJFFRGNzj3:B5dKqi61Y7wRGpj3
TLSH
T1A8C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 24f21d47387a4a4317043e5beb7d69cabdacc1367a970c31ff37bd67d4818834
MD5 11085cd4829598e331164b07548329df
SHA1 11240fa7e8ed78c45ccbae0e0a98a059f2c1de41
SHA512 6c6790614690623e3c722c9a05952bc92828907bc79d8a8e7d6d64551fbedd79cc1698ded35af98037722bd5d3e31679e09ed5249de6e3c306d56f7d944e7f5b
SSDEEP 49152:vhtSn8EApI0figjgiDn0AP5wHLNiXicJFFRGNzj3:+X2iWphG7wRGpj3
TLSH
T1E395BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 96a188bb466409b2e271c19aa6cb99920d161eec0e6e662ece083a9baafa2bce
MD5 4a9c03fb29b322218bb524c6ba3816f9
SHA1 67544c25f2e93fb3a0d9cd06dcb9d7f508e43e3e
SHA512 6c7ca02de2123ab28fd4f0bd2c2f2eadac711c25d057e191536bdbbe3bc879c0ff733898fb0453ff8189f8d2a08eda42142b819de9cddf6c22640f8256100c30
SSDEEP 12288:16iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:1c/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E75523D355C955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 1de575e214bcd6079c76e674dd5f2f3fe477b49a23daae6c5db4d17d07d6ed77
MD5 0200a18e29b680eae69e200f21f36235
SHA1 f477e4743b3cee744f1f9d23a539c568da79f67c
SHA512 3c276881dae4cd9724f8555838b56a22fd6c302ad9934b22c58de981a92598a3240a5f255b2c3f49f43eb9710ca001de16c3dc62e1301c78ff9565b6c97afc52
SSDEEP 12288:2JiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2V/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1095523D3548955B2E6BC003986764428F5881E2DEB5619E3E3483D1FE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 84548033e696702c79f1b2705ec1b7643e183b1488506b559271c1a5e8afb74d
MD5 0fa25e46b7c2e19b96142e4e333c3240
SHA1 a0043ea53f0a06d2017a433cf84441e690708cfd
SHA512 cbc93586a97080e7f8610cde20e3d9c594eae7843c34256b63e30a1a9444d0a27c8a6577f5fc22c85d9052f785107c90491ff317eb028e307a412939bafcd2be
SSDEEP 12288:xviJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:xb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C45523D3558955B1E6FC0039C6764428F5881E2DEB5618E3E2483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 50fa9fc6148f7303f34fb415ea3f8b3afc53223cbeaadd7131014a95acbbd87d
MD5 a0a7199552821ea8cc97e2129b570dff
SHA1 f04f6fd3ba5fd692be0edec55cac6f5e933c73fe
SHA512 77a6659e02bec92f95a5dd6005e21237643cfba958f13a9c01049561eb2cb82c889fa1948c6140c018444dbcae2922d2fec89427ab56a945756f98737fed1321
SSDEEP 12288:iVYiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:t/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T174552392168900E1E9FD8039CA764424F2A47D6CD7365AEBD3003D1E5A74FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 bff3c506d1613b455b2ee50c1af672e4c79c6dd913201c8b40deb7dc9023ccc6
MD5 594c3eb82075fd44d7f35295a9b311a3
SHA1 a9e80c7b6543ce0f0f027315d2259767ddc624b9
SHA512 bc88bf9a0320ed84af6918da29455984f322a7587d0ff111006fc7b0a8339f5231d13b28a5024776236195eadc5f322ae75a46d9254a23e64fb39960c9ae19da
SSDEEP 12288:0wiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:0i/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F25523D3548955B1EAFC0039C6764428F5881E2DEB5619E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 53532f27a27c03b639a2963693367126ccbfd83df4b52fb86be4cb33b7aa2e61
MD5 e32a2d867f4ba14f035df79d85d07056
SHA1 5d56a08ace3302e17f61bf78b1422bb7209189ee
SHA512 736756bd115ec98c004f7e283bb2a8fa9956b39a1b307f212c713f53916b52e08a488ea808cc096482a2043a2e6241692a89f4a0bce741b975f6b797a0abfb96
SSDEEP 12288:3liJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3p/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1895523D3548955B2E6BC0039C6764428F5881E2DEB5619E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 0ee33e5cce04c9ca6b45a7201cb61fdc0ac012186c1f08b216e04d6a2bf33377
MD5 c282232fd57ba27f4d19d014e4d36026
SHA1 342c116743cfb509d696198363585f6101199e86
SHA512 6f2a0824044a4e139573a2cd0ee13f6c918e23e4c0b30eccd24f42b3ea30236827ab6abcaf323ddc954e35420b7a2496a63eb52a6438fcbdcf86041061dc4a71
SSDEEP 12288:IBiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:It/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1495523D3548955B2EABC003986754428F5881E2DEB5659E3E3083D1EA27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 33a677fa0bf6a450c0cfffc8a7fc260283cf14fb39344afba25710b3b0834898
MD5 58c818c578ff62c6522aa3877635fa69
SHA1 8234cbfa1cc111fbdc4f8878d8b9777c2a1a6aa1
SHA512 8882352dfcb1a672884cff63c62355bf769458b0f0210bf02555f27957aedb187bd1a5cfd9805677531fe49d342620796b396993afa8ffe0ca5c20d601d2006a
SSDEEP 24576:OZM3zFVSO1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OZM3zf5LNiXicJFFRGNzj3
TLSH
T15B750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 7efe749005fa89180d2c46de5f9f3caef1130368c6b5741bc578ed6c1f2b2273
MD5 33cecbf42048cda22057e5341695475b
SHA1 515c9bf63789da87ea2729a45ad48ff8718e014c
SHA512 d75c21888d8a450238098818adafddb4646a6e57922057bd4edc669a23ace99742749415d64e6b92ef96de02d4b2a5c633451846080b6ba8509bbcc91d47b283
SSDEEP 12288:FeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Fo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16C5523D3548955B1EAFC003D86764428F5881E2DEB5659E3E2483D1EA23CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 9fa0b2c7423a553eca3f35e9bac4a19688ab295fc837516afe3f47127bbca416
MD5 f01feb3ebbde09447c7c681fb7219d1f
SHA1 73dea4fbe05cb6f3b86ae9f1418783c913410f5b
SHA512 65b8f3cc5c668bc6bce69a11e270e7834a279d4d5175e4bac9d04575558a2eb516fb288460ecd680cf425975b0e7db25e032133df8dfdbf27bd16d7b45413bee
SSDEEP 12288:1iiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:1k/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F35523D3548955B1EABC003986764428F5881E2DEB5659E3E2083D1EE27CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 f1e021824410c53982014484dfb032d5e787480228f30a31971c05f5951a6581
MD5 386c8b1fed30b7a25c943d8fcfad13ac
SHA1 31c093f806c8cf108cba6a940e20c1388b119a6e
SHA512 6b854c6e73883d373daa67bfa0a43502f285ac106615cfe942ae85b86f04b97abe4237c17c6f7a87c9896eeae7f11ef72915e174c6d71952bde69311dceff580
SSDEEP 24576:Uzyx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UGLNiXicJFFRGNzj3
TLSH
T1A9650147629530F9D17A8139C9620911F3B57C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 8b30baf90ddacc65c72b7069145bb4854b25c9700703613169ded9099a294430
MD5 cc77970c0d2e6949584a447b9b5ab5c1
SHA1 75196cc43d07e2a1553289e589c678ddb30d2909
SHA512 9d87856516be1bf3afab939148d72415966ac24d3c9630b4cf82c5cee4aa2e7edef5e4e033b3b957a3176ac0b4116110e97d0d2219fdd2c266033ad8b57b41cf
SSDEEP 12288:DeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Do/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1485523D3548955B1EAFC003986764428F5881E2DEB5659E3E2483D1EE23CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 952664bc94ecc05d5ba34e0b7338f0c302216964ef081282a3ed4124b2391b07
MD5 8c9264b94e3b7a451f2769baa1aadb16
SHA1 828713ce39fc0a8e57eeb3a1aa00ac2d5aa1b77d
SHA512 b61f25d5d26d8388b5e85307545aaf2843f33021edd3c6f79592c3b0b74ca3218f169a89a402cbe610a3025e698d8dca3ed8ec956259f23adec654790b08d1a0
SSDEEP 12288:ZeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Zo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D55523D3548955B1EAFC003D86764428F5881E2DEB5659E3E2483D1EA23CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 e7a78b9bfe25bd386ecd98948f385c75905aafdf0d8b152fb320e57b9c3e4123
MD5 cf38b425fa1b8730cf3dd974a8db81bc
SHA1 0eccc05f6060a558c18c0bd803465251d5bd88c9
SHA512 e38fec29a8516ccc48bc57cff2401e69992686f6b5455060120351ff9149e3fb10de274f608a6d7d6b42640a38b78a2a2887a7620c25f4cb9f18d62c107e1788
SSDEEP 24576:szyx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:sGLNiXicJFFRGNzj3
TLSH
T18E650247629530F9D17A8139C9620911F3B57C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 b9d841118785453535ad5358d15c1d15576fce606dbe64828e42bc18665adaf4
MD5 8ec923a7d0fc89425b6f35f31041f49e
SHA1 e442ac4fdd98f53f876fa145276104e751d2f4c1
SHA512 f158728a41d5079da9edab5ac9f67325406543b2a8ef97adf31314a9cbe7d05c063f55a8b6bd17225e79faec6283f63555416cef6495cf38a5a1bbc880afc4fa
SSDEEP 24576:5T8aLl3z0zDL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5T7LljeLNiXicJFFRGNzj3
TLSH
T1897502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 6ba6d1d95ea78407a706b86a637522783e9d3044488ce8664289343b860b8a0a
MD5 249964190840812d4133ecb8707a9855
SHA1 e8aac91109520c87ed19053f19e6b9c8152c1a36
SHA512 32c446df87fa04004a20288022fca37d485d8989ff79d3ef232c946495f11ddccb3f72b47620d8216402f9dcc0a8c8b3b01cade98024b47c9cb7ca98e20bea4a
SSDEEP 24576:Q3rd9CHKy7GZv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ard9CHKya5LNiXicJFFRGNzj3
TLSH
T15485CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 8914445a74273aa5819c29b93bb23d67d2a89f1b069b169d0e0c4e7459a283d7
MD5 00f4fdc47c5c5ca7078bca415538db14
SHA1 478da64e251aa8f896fbc56aa2226d2a3b327684
SHA512 f939bd597ca207e263c6bb6ba935a1823c0824cdb374f882180ffbb5c8431406ed2191be5313f80a59ada67142668cb8182f056cc15bb40417909f2475d41d1a
SSDEEP 12288:OPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:O7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1265523D3548955B1EAFC0039C6764428F5881E2DEB5658E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 f897e6758cd5fe2b3bae8c819ed55ba4e65a4abebb44221cbf3e262cec5a12d8
MD5 ec68b481ee8b945af8a74a3d4f8cb0a6
SHA1 84451f5f57445fec0803ea8459046d8cb0f5b49b
SHA512 9204d42901961b19c9fe3bc2f97df59c088955f367e444cd6cb6b5b7420d34a28a8e339722eab5b3d98b281944fd386ec9a6e9780781021c806fd02e828d6c0d
SSDEEP 12288:yNiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:yR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AE5523D2558955B1F6BC0039867A4428F5881E2DEB5619E3E3483D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 7c36de32d747c5bf189fbbac63366addf02be90801c0024e92813eecdc2f870c
MD5 169e081374ce5e29b1813834c441f56a
SHA1 791da5f563335f4d7223c936be7f8d620bc7eaf8
SHA512 535ff9c81a9fd06a4618f0dbb896eb39faf5f6f019ea8003999288326324899624793b0553ad54778a211942de3e7dea836153c82691876c1e2eb62a1d7e7314
SSDEEP 12288:4siJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4W/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11D5523D3548955B1EAFC003DC6764428F5881E2DEB5659E3E2483D1EA23CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 299bd77127c33efce1678683858b83576ec5f3ebcfa7b3241add9d6f24a83eb6
MD5 2b612d98eb0a73e42b1d0b728db5a3dd
SHA1 e36f6acc5a7ad047105bda6f73a13ba6c57e0667
SHA512 91ee3f5a0b557ff409995b4734b37956f83e2c1664fa50f364f9a9313c4829f18be0f1ed2204a6b35aa50d62f5d775e430ec6e9814d83659694a0a47b9c7a26f
SSDEEP 12288:ReiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ro/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1415523D3548955B1EAFC003D86764428F5881E2DEB5659E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 e9ff3009e6b950c7d2d0cc4d4a13905f057f9656e7777dd81aa0a898ba2e5196
MD5 da9169d1d429e284a3e64927c775342a
SHA1 8acbec21fa131b824de2a59ec43795e68e17c8d5
SHA512 230f23368beaf1e37833c686833ad665b64cdea8d060785c0b40294ec412cec73194f87634bd34c6a30976aab94e1502700c2b97f41bcabb77f2c5ac0e75b1f0
SSDEEP 12288:YPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Y7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19D5523D3548955B1E6FC0039C6764428F5881E2DEB5658E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 920ab293cfe216fe6a6c7eafc6a40d42d3727724b3463dfeb512799dc1aeba24
MD5 4e5f2394569601c3d3c44955cdebcf19
SHA1 60bd5dc26925ca29370a654b724e8f0182fe078d
SHA512 08706b9ec487fa082e9f1fd7058df0304bd7d7adf741a06091302646515f622ecf9d5aa6127b9232d5505d0d9f880aa1c3fa70119fbee3a1ce2a2bde302a6f03
SSDEEP 12288:92iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:9A/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1965523D3548955B1EAFC0039C6764424F5881E2DEB5659E3E2083D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 00f988c035c02282e829fee8d1463ee1d4327eb5ae2b972daa3c7bee456cc09d
MD5 37222e124fac80b52d6798d656e0d1a2
SHA1 a6d57c794a7828cea9e112d78086480103f0d1d3
SHA512 d4b9bd3ed5a72efb9346d97600a3ef9221bfb4e797be6cc4d249475939bd9cbf668cf3ca0dd882dd0b6468ffbcce6e5f5e7bc9175aa352abc26b1c9c883a62e5
SSDEEP 24576:Efwvzk9RX6wkyAI0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PMnYI0LNiXicJFFRGNzj3
TLSH
T1DF85DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 48908459195049887a9053455148e579dffc44bcf4f27a70dae7bd5b0bacb087
MD5 9437af07a3bae3d9210ecc0cfc1ba385
SHA1 ef38c6b297296c8991499d349a92c7c314e5a6f2
SHA512 0ef7bfceda68a24cc4dbcfc96ec95d1238a3c4fd6128a198e5187140a4134a06e7fa0b193e73178fe1cfc91105c336dfeb5e00560bf4d77d497f4924ee4b8c4f
SSDEEP 49152:LYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0nLNiXicJFFRGN:WySzPv7wRGpj3
TLSH
T1F3066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 dc4d323399043ff1475953d68cc0baa3d4bf7592ce9dea2c0a5e526906a7758f
MD5 25fa9c9d9390ee732e3ec6b219e48ac2
SHA1 f579e0d89491150c883e27afebb950f376031710
SHA512 194fdf10b7c4f16f581fe05515d56a72c2a9fe3e1edf72b36f9e7045d89cf3315a87df36ff612595dd6f1b33087a2f49250698ecbeb429d7d4418f9a7f76778b
SSDEEP 24576:847Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:847JUQjqirIhCnDHUPfF/3LNiXicJFFS
TLSH
T19A65AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 800e44a9826a3102cc19d6d4ca6f169156f57d63e0947b7a160fe59d8eebee2e
MD5 9ab72ff7baafb5fb5cc5b847ad70cb99
SHA1 4af1256d285caebc36c01e23dc973a3edc8bc204
SHA512 183d60f926bff763dfaca41d4f68da349f2fec5233e238731db720d8bb0a73b4b04bfb83594f53e3d87e84f99f3abded955bb2e8b29ee4f74e02691bc24269c6
SSDEEP 12288:qpsfuiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:jY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14B65F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB92D0F93E1F79AD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 21ea5c9e17850357f4ddfc6f11df2f8e0ec4e8740aad52619e19c897d359cf59
MD5 bc0a65517295a428c67269823ca2470a
SHA1 afe089ff6f40a09c32bbb6a9057ab0a1817a0673
SHA512 09faa8a92397b7667380734ed4ed6614a8fbf96902ec50ae66cb2f0a3dcef3b8cac47f222938bc96053349e730e56dda864ed15a72546c0f086ee731905936f6
SSDEEP 12288:ThRicfbGdubN5GS46cz6E+VJTvNLVuH6Vqv5o3:ThzfKdutPc3yJJLVuCqv5o3
TLSH
T10C3528117666CB5FC6A940325E33C1CCAB707D41EE04AB0772CA973FC576658BAF2682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 29ed09a195dc1e4da60a4c94b7c8e2caf0b8fe1f3a74c53d76cf295a0d555072
MD5 faf4e721aa7b2896de7359162e6be256
SHA1 0e99259b671b4361ce2d461d1ac7ee68759bbee5
SHA512 277f9e060ffeb5b0b4477cb31b6131c896aa399ee7085a260324e5ca19595ead033cf8f179c58cdcc7334b4bb507ab2006954499552e83126d2788822da2e283
SSDEEP 12288:ulHwr92qU+YkzF4ZSdLSqSCSkSdSOb748XYB:uoA7+Lz+s0l93YObE8XYB
TLSH
T1CA65F981A537A7CFD1BA2032072A4B4C7B64EC07B7095F26B3C9153AD82A755B0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ACC.log

Path C:\Users\Admin\AppData\Local\Temp\CreativeCloud\ACC\ACC.log
Size 282B
SHA256 30d1459470210c406c6084f2f6e0729a79ddd030596095ecd612844daa8b4949
MD5 b8e6b106139f66d43aab50bcc1851ab4
SHA1 1529f86adb5b3d5b0ca5f54e9b34c39a9c1c9dde
SHA512 b10b56ddc60842e5361909a1fbd6b224667f4b549f17ddc5f30d30b1f2bf6f1f90f750cd9b3b249c0d779cf256eb09fda76431326dcf00faab54566263120089
TLSH
T19AD06713827A490D35379B454EE69011F133BDB71934C2060120220E136EC40B8E4B37
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 a8b81d04b3d357774726809bfc179902812cb9435ba2f9f09ebe943a91873e87
MD5 03a7db9a92a6978a491320bc35ffa4ec
SHA1 20cc9f0cd06376cea7331431129f4c7284968fca
SHA512 62224581bcaee94be3ee9c93e427c68a06f50442a5011e9b60e3b7ad1e82d90231131b3418bb712984de40a6eadb49ce06017c79b9efb96da387b778ffb263e8
SSDEEP 12288:uF7GiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:6w/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1185523A3568859B1FAFD0039857A8434B54D7E2C9F1598E3E2043A5EA138FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 105c19409dc35fe452823eed68a7695572abd9bad530a8c9cf07c6b4b9466d06
MD5 60da372cdb0ab7adf077e8ff88fc14d5
SHA1 6f9c03e736995273ee87bb54e56e5b0ad9b7fee0
SHA512 9596c48fe6bea1b7a117f52f113f0cdde2c851ef2f408b876c59d1f664dc62b35472033fa47d6dc7f734dcd1dd3aa114e99bcbf09ff0a41bbcd5bbe4dd0d9cf6
SSDEEP 24576:Agb6bmBIi49WNNFpg1rSvFv7bYe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Agb4mBIBhGFFLNiXicJFFRGNzj3
TLSH
T18B65AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 e5b3b9b62272715c5f4a970770e69d9d219b82a0a0428fd9a584cf42198a095d
MD5 cdf446f3a67d1766ca306ec7b283fa06
SHA1 23b990f30ac2b42da5ce1de89426b0d2b5b7ba00
SHA512 337ef100ef22c08687edce4ba64e273b058e75532863688f58f1cf542af8bba7203c3211fd18199c8c915ef29440b3534ea77561b93adcefe06bdcf7fac4f66a
SSDEEP 24576:5G88u8FpJqH1vzria7/m1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:s7ZFPqVya7/2LNiXicJFFRGNzj3
TLSH
T1B785F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 9146f96f5932cdcc87635e9bff63022b40d293a789cb722b5df397f36ad92ba8
MD5 aa6270ba0855b3de62da4aa6f33afe48
SHA1 51557d844069a4184bae6b61c54618042708c40f
SHA512 8e42b1f0efb3846e6af8aa75b0a6d435d970fbf0ad927a360f536295dcd7d35d29371b464484bb77fa979b54239a52a4f75ffb1499d7a6f1b8236189565468d6
SSDEEP 24576:SPUr+NQ5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:SJQ5LNiXicJFFRGNzj3
TLSH
T15E65F16F22DC18E5E67AA03D85828619F7717866071292CF02D0917E5F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 df25bd1d4ba7b0f92431beff7507d18d4ffdc85de7e99e6035b9719498bb2eab
MD5 b3330952e7120fb01549ca528ba86e39
SHA1 bed679c30435e12d1f6b52f42a0e020293899171
SHA512 a86916b70cf2b691ae6ce42b4a18f1ae72296b1b3d1d20905d2173b7ff81c530e63c2c350c01e91d8d18288c923f28584b508e22e2a0cbb2440c865d9184e829
SSDEEP 49152:UBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjpLNiXicJFFRGNzj3:3G05lO43bs7wRGpj3
TLSH
T1C8D5C06E62EC11F5D1BBD07CDAC6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 28b9d9f08fa70f62e5512dd2854d0760b80eb4926ed990fa2859abb89d23d5ef
MD5 308b0c03910d728641958b2f2c1c89fa
SHA1 9c81c46eed01139b4d680745e04e7e1bc8ca31be
SHA512 92934cb1fb729851481b1e5e5806d87e0a8796d3b3c66412c536329dc58106b2f0e52dc1e3f23e4b0e56a0527ed89fabe3a860e8225bb5af6f3e0fec0aa09c33
SSDEEP 24576:Ifa5POZ3dpyWVM50JicR2hG0lasx2+47eidnn/TwSfVcYG3K/cJHlnFR+IGNe8jg:wa5POZ3lJt2pasx2+mRLNiXicJFFRGNf
TLSH
T10665BF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 bdceb6b3baa7eb482f86a9bdc18cc11a7945ddf29bc4f1821cc7b862aff1ad71
MD5 5d119d212ba18851d0726c28bb7997f1
SHA1 dfb4bd812f2a9cf35d83ba5d8e84cea33648a50d
SHA512 72c079c41c17a1004defa7d713ece07c78a3ae6d864a85f87ff04f6f9aad04f772f7ceacbc4fe76ff739e4fd9a5993d6368aaa093c973e2f819dc05746d720ee
SSDEEP 24576:hNcwHdjbyQ4nLC18lb/EOjowL7Fkd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hNc/zEOVHFWLNiXicJFFRGNzj3
TLSH
T182858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 62e8406e24d412759daaa1a5181c631a6d8fdb43d170d6914bf84ce2d53837c7
MD5 bb6b9737c26134ba8c845a80f8a14178
SHA1 805927251ed7e4f05e4054c049d1895ed99d5e7b
SHA512 2f44bf876888149ffe5daabeecb863651603dfe559be71cdbf88fe246ae634ffc8ee5784ead4ca4a4d6517b80a349e369c2794deff9450ac45cad11112d22c0c
SSDEEP 24576:r6DIrPVMM7m5AMLtVM9xkSZikEUJKYEje:r6DIrtxIRmBdpUs
TLSH
T14325021D237A10B9E267E03EC5520256D6F2B170C7266ACF46D8C47A5F93ED8B93CE42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 271a6ac9ce8ec4c8a9f2f54b400f394a182816b9dfe7b6774c96f56dfd96243d
MD5 472d5f6f9415bb7afadbfc0f8c725b45
SHA1 84f8d63cee496a9365b7df358e8d07bddfaf22f3
SHA512 0c3c150bb11626d0bfcc90e6b95c175af98304e6876c8958cafef98116b72f1861c8d7528958f39c6a26c8c0a867951a323d86615a14775d1f74735ff31a3c58
SSDEEP 24576:WzkNvNnaFeYhJNtmZBmD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WzMwBtOmDLNiXicJFFRGNzj3
TLSH
T17255AF6EA6E846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 74ae5d16bcb31d87b706d61a411009ffbe065d2aa4a64bd820f6b2a92af3bb3e
MD5 98e55446a6e39883ff6bc450f2c1d38c
SHA1 8c35868c4244c0cd8a9fdd6e341eac44e2d75759
SHA512 8fc96fe0dd946e1a4af4cfd72ce2f2f04608b660f1bdc21bcda3d17b7bd2e5b50f4aaa6707bf30499ef682e683d770151cdfff73b35f8308d55b41793c7ba7d9
SSDEEP 24576:dD3FHshBIYQgA8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dDVHeBIAA8LNiXicJFFRGNzj3
TLSH
T19A75E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/244-60-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/244-52-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/244-165-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/244-59-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/244-53-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/360-64-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/360-65-0x0000000002380000-0x00000000023E0000-memory.dmp

Download

memory/360-71-0x0000000002380000-0x00000000023E0000-memory.dmp

Download

memory/360-77-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/360-75-0x0000000002380000-0x00000000023E0000-memory.dmp

Download

memory/932-149-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/932-156-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/932-150-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/932-158-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/932-160-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1428-91-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/1428-318-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/1428-92-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1428-98-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2472-340-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2472-173-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2472-167-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2472-166-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2484-86-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2484-80-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2484-79-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2484-302-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3548-108-0x0000000000810000-0x0000000000876000-memory.dmp

Download

memory/3548-333-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3548-102-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3548-103-0x0000000000810000-0x0000000000876000-memory.dmp

Download

memory/4680-146-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4680-336-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4680-144-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4680-138-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4884-8-0x00000000023B0000-0x0000000002435000-memory.dmp

Download

memory/4884-13-0x0000000003060000-0x00000000030C6000-memory.dmp

Download

memory/4884-20-0x0000000003060000-0x00000000030C6000-memory.dmp

Download

memory/4884-35-0x0000000000400000-0x00000000005B2000-memory.dmp

Download

memory/4884-6-0x00000000023B0000-0x0000000002435000-memory.dmp

Download

memory/4884-1-0x00000000023B0000-0x0000000002435000-memory.dmp

Download

memory/4884-0-0x0000000000400000-0x00000000005B2000-memory.dmp

Download

memory/5792-37-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5792-136-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5792-44-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5792-38-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5792-45-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5884-352-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5884-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5884-354-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5884-112-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5884-119-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5884-118-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5928-335-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5928-130-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/5928-132-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5928-339-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5928-124-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/5928-337-0x0000000000830000-0x0000000000890000-memory.dmp

Download