9bdb459012a5dc9eee0e464c33957b71540bd879e970f052e54a72bf091cb27d

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 03:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_e66931a9e4fc8d3bb94fdd071e46a4c4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Size 2.2MB
Sample261027-eka2sa1vez
SHA256 9bdb459012a5dc9eee0e464c33957b71540bd879e970f052e54a72bf091cb27d
MD5 e66931a9e4fc8d3bb94fdd071e46a4c4
SHA1 91714a08ed9a717229120490743a53ee81b4286f
SHA512 4ce4e6fbbb57608c867be06f9f587c0cf9146e5d6d0de9fa70b6fafb49830ea57405b38579a5f738e1ca3cda1c8fc3c4647834e02919f1117280269d4ea56a1b
SSDEEP 49152:1r4rJLcDmg27RnWGj5JO/UsUob/3kEIl+5:1aAD527BWG9MU1oz3FIU
TLSH
T1A1B52312B1D280F5E4B6493409E4EAB499BEBC710E244E7B37C62B2D6E755D08728F73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
4828	elevation_service.exe
4488	maintenanceservice.exe
1532	OSE.EXE
4616	PerceptionSimulationService.exe
3412	perfhost.exe
5184	ReFsDedupSvc.exe
2800	SensorDataService.exe
1828	ssh-agent.exe
5844	AgentService.exe
2120	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-26_e66931a9e4fc8d3bb94fdd071e46a4c4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-26_e66931a9e4fc8d3bb94fdd071e46a4c4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\locator.exe	OSE.EXE
File opened for modification	C:\Windows\System32\SensorDataService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	OSE.EXE
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-26_e66931a9e4fc8d3bb94fdd071e46a4c4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AgentService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\vssvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-26_e66931a9e4fc8d3bb94fdd071e46a4c4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\fa81fcf97465cd71.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	OSE.EXE
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	OSE.EXE
File opened for modification	C:\Windows\System32\vds.exe	OSE.EXE
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	OSE.EXE
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	OSE.EXE

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4280-1-0x0000000000400000-0x0000000000B62000-memory.dmp	upx
behavioral2/files/0x0001000000009337-49.dat	upx
behavioral2/files/0x00010000000093af-50.dat	upx
behavioral2/files/0x0001000000009952-52.dat	upx
behavioral2/memory/4280-128-0x0000000000400000-0x0000000000B62000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	OSE.EXE
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-10-26_e66931a9e4fc8d3bb94fdd071e46a4c4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	OSE.EXE
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	OSE.EXE
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	OSE.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-26_e66931a9e4fc8d3bb94fdd071e46a4c4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	OSE.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-26_e66931a9e4fc8d3bb94fdd071e46a4c4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e299429ec765dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ef82869fc765dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001496c99cc765dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005629cf9cc765dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4828	elevation_service.exe
4828	elevation_service.exe
4828	elevation_service.exe
4828	elevation_service.exe
4828	elevation_service.exe
4828	elevation_service.exe
4828	elevation_service.exe
1532	OSE.EXE
1532	OSE.EXE
1532	OSE.EXE
1532	OSE.EXE
1532	OSE.EXE
1532	OSE.EXE

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4280	2026-10-26_e66931a9e4fc8d3bb94fdd071e46a4c4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeTakeOwnershipPrivilege	4828	elevation_service.exe
Token: SeBackupPrivilege	5184	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5184	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5184	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5184	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5184	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5184	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5184	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5184	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5184	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5184	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5844	AgentService.exe
Token: 33	2120	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2120	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2120	SearchIndexer.exe
Token: SeDebugPrivilege	4828	elevation_service.exe
Token: SeDebugPrivilege	1532	OSE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 4928	2120	SearchIndexer.exe	99
PID 2120 wrote to memory of 4332	2120	SearchIndexer.exe	100
PID 2120 wrote to memory of 1264	2120	SearchIndexer.exe	101
PID 2120 wrote to memory of 1664	2120	SearchIndexer.exe	102
PID 2120 wrote to memory of 3368	2120	SearchIndexer.exe	104
PID 2120 wrote to memory of 5532	2120	SearchIndexer.exe	105
PID 2120 wrote to memory of 3364	2120	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-10-26_e66931a9e4fc8d3bb94fdd071e46a4c4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_e66931a9e4fc8d3bb94fdd071e46a4c4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4280

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4828

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4488

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1532

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4616

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3412

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5184

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2800

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1828

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5844

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4928
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4332
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2732 2824 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1264
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1664
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3368
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5532
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2732 2824 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c6848c8f868b705948b24b05bc9d085c45a41f7cba23741bfe51010f800da93f
MD5 adfe9104cd9466175d186d0835661875
SHA1 5bd8fea51094c364a76af64ad00926752c952e60
SHA512 5f1d0576eaf1d63b62ff37af8b528e217ca229c780b3ab24baf9ccff46261c3121f23e1455376729a460cab0141b3318cddae16c48d08563f984b9b2f5287a2d
SSDEEP 49152:eb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnhDmg27RnWGj:g3q6HjBCD527BWG
TLSH
T12CD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 38364e8136b4af6a4f20fcc5f094ee4880583a29cec5f5540d56955a628bdeee
MD5 b2b1fc4a814cae7681793024ec7238d6
SHA1 6c3ddcb2983f25d26facfc53b439056c0efa2501
SHA512 9289580a6943e0b84f1d6739dc63ba861371a73d8b98e1f58a07b74eb8eee02ad267e9d1edc9467185998c0966ab675b545fbe9d6b9db660c5049dd352c1d9bb
SSDEEP 24576:ZXYfDtczA4sqjnhMgeiCl7G0nehbGZpbD:ctc1Dmg27RnWGj
TLSH
T129750129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 c867a6c098e6f6c05dd2d1e3bb17cc984082d509c4789de8a17c272cdaf75e06
MD5 16fd3878f4db05276fad8ba0f3c88bba
SHA1 50da2a593ee29543efee6ff0a560bc0e15e81526
SHA512 bad305d87ee1a369d85f63e315142e08b0aa4e823f8365d4130b6b5ae55923d954844a14687b74ca3ee7e79668e3c00f760573aeee49112c31dc0c797596b308
SSDEEP 24576:X0Le5ji0hmx2rMnsqjnhMgeiCl7G0nehbGZpbD:XPji0AYyDmg27RnWGj
TLSH
T180959E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 115100a98d31f8a7739a809895fdc6b28eed9ad2494233c2e42e765730832205
MD5 f548e6628c627b7e75a838323257baf5
SHA1 153c06b2bf50a6ed4f2cbed4b8c9c270a8fdce89
SHA512 f11c3a2c5a8b256bdb285d5f6f709d57985039c075cb175a67158d74e850032684f08b98579ad238a5c4a8682c5be7f71c1585c54173de3a69f85793666c01e8
SSDEEP 24576:ra7/ezSC6vUyD/aqgrvWE6q8wyuRsqjnhMgeiCl7G0nehbGZpbD:G/ezSC6vUzPvxHjymDmg27RnWGj
TLSH
T1E3755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 851020baa40d032a9b5ad7fad855a48729b3ecb4498b40e2e5f69cfd55f85e26
MD5 18894c505b0f414743808fe7f75e2ec0
SHA1 86365ce0c6f32b3cb95bed1e9c536d3e2d6ea6f6
SHA512 4459e3408868ccd2ee8cd81fbeed3c8f5863912bb6a5e60b5a9c88555450cebe76a88794f0aecf412f0eb53b3b84c02c612912696037405f2da2e32160456c46
SSDEEP 24576:ZVbqPb88hv/l+6EsqjnhMgeiCl7G0nehbGZpbD:ZVO88hXl+vDmg27RnWGj
TLSH
T18F559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 e1f050ebbf5266eff8d5408a3cbc73c48ac5dee368cac8b559a18bd8ee34cdcd
MD5 0ad4f4b77185d36422544411c00ea499
SHA1 62d4bbfd3413dea0042a09e027bc6e5e4d4df232
SHA512 f74b84b05e0aa22dcb2804f3aadaa9e3ab74535a1ea281f15087a44cea47fa975354f44bba7d1a397aba6bea72345c2346b8f36a4df40a52a23adb21646f6487
SSDEEP 12288:WAzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WAzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1325523BF875C50CAEA7608B5C3E9F11EAC137E56982008436A637DFDE6B5458CB39423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 e34c466002284922efcff3c3808a1cfb65b4c1fee77f252f8565e1e46468392a
MD5 5d410907ebf1b36b36f19de31b5ba426
SHA1 ad8604c86d7e223163c6936ae181af046759c36d
SHA512 19e3841224e8bf1b0389bae7a2e5690d4ceb2615d1806448ec009f8199662e95dd1f891e0f6b5306cb829bbe60f7e9a41ebfa3f2a0d9696592be5b394ddd6e02
SSDEEP 12288:HeBNUbTVO86UsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:HJIUssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BC75CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ccc089b9e70e383d18847e35d4afb4e492c6a21c80717c317bb00a49012b1499
MD5 351df87e17e5c7c1f4c23d14552dce54
SHA1 953420fb3926453be28a27febd1f31f94f85c2b6
SHA512 d946abb1d7482958d126459ef433429b03c3529a22eeab4ac1af113351bfdc0deb8e16ece8f64d0c0b970df047fdc7e8a5dafed499b51f8af5a7477eba9665dc
SSDEEP 49152:YQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THD:YQvGAdlCEL8c/yRNw5CVD527BWG
TLSH
T1C8266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 8ffdc9c6659397c74ef8f9d2af9b357f817a31ed272d2f4bfe21d099bf975149
MD5 10b95f22e5699d479e55a4380d96abfe
SHA1 015ac352ea5b0522bc94731ed3def56fa2ce6ac1
SHA512 7f492a99acf4a1f5b052a7187638af91b6b6ff7a5bec009323176b9d53482fb883ea16902d4a3241ad9e24afe7cb7bc7914452d9676ce50356f5c41059a2ddac
SSDEEP 12288:BAwSfxL/2Dc3kDLLmt0LDQewsAjOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:i5ewsAjOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18775E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 96dc29ec15668f344470af02b22c83adb147ea00b721d6557408af4443acc939
MD5 35b6b2a544d9fb3a5611c23e81c5b671
SHA1 54a4475438843f49c31b820f1bc4e5c212ce25bd
SHA512 4391b63625a3a7fd28be76b1806df34f39be585d03a2964e5453ddc83b2bc9b11630dff0621ee44741199fda3bbc2e84afc819ed6573be3258183cb2698cee24
SSDEEP 196608:UUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHqVQBWG:UUEtQevvqc2W1cpV2EI329B
TLSH
T148474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4afa25f167b972d5526e1342ff46ff9f99d13c5c963c89cfbf44649c1f54e0a6
MD5 0982811f6bf6bfa04ffdc408c23d67d5
SHA1 69b91491eea0b1b2c99bd8636e29621402b56d22
SHA512 64abea6d978729f3e3d221b3eb8f9d8b69d041b1b136f4860a7aa628dc338a4c6ffd4ac02901fb61e32e620f3cedc831c8aaea2807ccfb2a43380eb537a88ce0
SSDEEP 49152:/CbRquA/m2yL5zQfFiV+XenmE3/zCDmg27RnWGj:YoqtVjnm5D527BWG
TLSH
T1C5D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a02d070ac0e1ab2891ef55c00520dd8c1f09d6bf27f120130b8b8f11dd45a730
MD5 ad25b171a3ac81b63cc0479aa80ed20c
SHA1 4f0760624a962e169deee18edaede97a8624dc87
SHA512 e6b3390208844c1213ad76dc1243b04d65f457f78e481d25adcd77f13bc4f286ef3246af83a08d63e37f90f8a06cf7d7a3d76fd0eb348c8c7fd57f83b6d69eb1
SSDEEP 24576:HAhGLJIFoiwtA5l7S53lsqjnhMgeiCl7G0nehbGZpbD:HAMyFoiq5pDmg27RnWGj
TLSH
T133359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 c393aadfe522b69c0f08e6b571f372852c043e95a5f4c3e0528d94d4d2940927
MD5 93d3dc59244428762fdc38b398e808ad
SHA1 27ab412077bfe20300d8e6cc83f9f5cdf74d8b62
SHA512 be3801a598456aba933f8c741b8bd922c6f779e929e977d4de910a7bf36caaf5e302907f4c2ede11f70e356a845c224284f8bfd6a0b4eb427805c797f4cf3eaa
SSDEEP 12288:Smw5HEjsChNWBFgl0WDm+CxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:LwunOWCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14875F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 2290ba38075aff7a482682f72ccaf9fbff7012f83f6fa2b4e7a137eeccb0e52a
MD5 a03abf400fd94afc297f086c7937cccd
SHA1 6fb50349e2f6c5968ee588f735096a0fb6320199
SHA512 1cc2ec158df90bd1ea165c95b6c32459cd22e4a30885ea14f218ccaacef88da644079699e300bc534f33494d8a59663b53e515d938d90b4ac31d6a67ee15903f
SSDEEP 12288:6GZ1Iy+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TZuPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1296512AA239820FAE1A3417CC5E5D609DB333C52673043CF16665AAA6F739D44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7a9fa74669a276a1f13ec34ca874512b2ef94c41d6c99485e3c276e0201a2ecf
MD5 a497ebe6f526a79dfa08e4345c8ddc6c
SHA1 71d65e7a394dad8a5a0a6cec7f29844a9f82a33d
SHA512 8109c38eb4c8de9dd69358385f4c0716b62c879cfbf42e4ced4c6904403b9bf51a9c4467da804c257c3a9e2deb79ec7eac25dcf28e7d0af1f8ef2ae9cd8a9df6
SSDEEP 98304:mQRQyi36YOcPQLvw2gAf+PN38D527BWG:NQyiKayX+PNMVQBWG
TLSH
T1AF667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9722c97370b6279cc06b4e9b3099e2a890945cbd9e795dd29eafa142f6fad634
MD5 dd54b87e2c6b8af7eab6e1dd61555d05
SHA1 2de95d3293a340c37d1f1ed1c0c1f8ce2ac9d225
SHA512 cfe8f52f8b4b95ed76e559a6f2278e7fe9ae08035fb02102c4707b255e987b0575ea782af66caa6a0427a03440e6ee83ded7e27502e2c783e93d56a0574102db
SSDEEP 98304:7QRQyi36YOcPQLvw2gAf+PN38D527BWG:KQyiKayX+PNMVQBWG
TLSH
T1DA667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 aecfbde50a801ea5d597cf98c752aa7be3a76c2298238906ff8552a712916533
MD5 9bd5a4dee701cc10893a22d262fe161f
SHA1 141edd62043834737551ec7ca16910b256d910a8
SHA512 4ddc3c185ebd9fe7cbe5083e80e93896233ec673ba843860afc8f07650136e4356af59a74e34e3ac26f6a44cf9f7bbfb679a5b11123c2b9f9a37bbb085ae55bb
SSDEEP 24576:+wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0fsqjnhMgeiCl7Ge:I68Qg55nhheWu7PNU3/yDmg27RnWGj
TLSH
T1DFB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ca1ae5bad1bb831e0d140bf9d76d95e015abc0a30ef21a70a7ea3b00bacd3d27
MD5 c6a980be373b2cb9ef3c0a801ce706a8
SHA1 846829650bab725cfe285aa128bf7312f037ad01
SHA512 7aeb5b26aa56443b0a3a30734e6c4e477988daa2e1ca8947a160dd838fb314a6e21a14aacef486f2b00ed0e52153470169d09e09e70ade1dd241c92328e0fb52
SSDEEP 98304:Dy5112gYy5azzVvL69nLKnhZ3D527BWG:eLIHmWhBVQBWG
TLSH
T11F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 76b31548562fbaad1f94748face5de423a9e33c514832613bdd809d4dff61d7a
MD5 2d2395a8cdd1a92439a3418dc452f157
SHA1 c4cd0c558d9c53e302b83e6c685258464b9396f0
SHA512 3f28d6d994d77e5d7cd7c62fa839ebcbf1bfa8bb588ebf178db3b832890b6bf16fbc5ff1c9186b718f8cd6c5de70a7d785b546ea2797183333decec9903efd01
SSDEEP 49152:bB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl0Dmg27RnWGj:Nu6JmVxd2d0D527BWG
TLSH
T17ED59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 892aa0bc0be7617c17f1ab33522557e975d53cfcf79495bff6776c53d902b1c0
MD5 2eda0ebd431d42cbdf23537ea6d62ea2
SHA1 b5b9066dc8da036afe05be7a8153e536749552e0
SHA512 287f719d2d0ba41a66443bc56d381aae1094c8cbdbf7dbe5ed85243f6bb4c49768dc3161e4feb843ea74247523eb064bf2723728a2411bd1d1f469ee160014dd
SSDEEP 49152:b1hpsNoJpF1A6UU44CwH7R4x4Dmg27RnWGj:bmifPbR5D527BWG
TLSH
T114B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e7b3eb78dfe8d18ff8e13af4806d354e1bd23f9e9b0745411d7dd26f3fa4fece
MD5 66812d15b53884ece006576cc97a92f8
SHA1 cae660b4f4c9c6fc1573bfe4689da9ba21586437
SHA512 b58446a7fdf3562a69508bab8a37f91e24c1494b557b39577793482ab39ec8b772aa605e906f6bb505741c0f830b48b035e1655ebeaa98d962750ea2c5b00b41
SSDEEP 49152:4SuZQIY0Be2KRRVtOnks6NMHqzDmg27RnWGj:i5dKTi61zD527BWG
TLSH
T1BDC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 292cd68b5e81c26b7d12d33566f5de32e77c1a64f3717fd61d183882b7298578
MD5 1bf57bd07c676f559d8a81e8af59042c
SHA1 d1f748d9f561cb96c60a10dbf0e35baf2339ad81
SHA512 60438a8b973bbbd2f88a0a86bddab5e4c2f1ae22fece3bba5044f2eba90479dd356d18aa2f3cc5cfe8563234007c4d48340976af82f79066b3c09321f2b7692e
SSDEEP 49152:KhtSn8EApI0figngiDn0AP5wkDmg27RnWGj:rX2iyph9D527BWG
TLSH
T1AE95BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 fffe0290b6dccc3309d519f02cda53609fcd11364d3636d104c57c9f30aaf263
MD5 62e6c95be2d7aebb9b5c582568a09f85
SHA1 514b4e6b9b703c054883cf5a6dacf8f4b8d55c5b
SHA512 078718da7e4ada47c6b8125c53fa4a19a211e5ba7bd2d56931985ee5d69ffcd0503c78041191678a09e39239b788a4ef8e27b171a25d0d898c9bfa0825977a57
SSDEEP 12288:37Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:37sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1515523BE965C41CAE52244B5C3E9F10DAC073E5BE92004937A577CBEFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 71b5413107741192b9abd0bc7f5db5e971e8785630da66540f7f25ae6b9d131c
MD5 ebd2bed278ff8e8e49c7be25895755d0
SHA1 177a08a6cf9f6319e2eda77c80bfbd475575b1cc
SHA512 8e14678f40c7f258dbbe248bf3a4663fe305d67a446a9a2f566e680aaeac0bff663b380cf36b283175bbc818bffff408f25bb9585da2ce8f7b8103be28446dcc
SSDEEP 12288:raXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:rasqjnhMgeiCl7G0nehbGZpbD
TLSH
T1685523BF955C41CAE52644B5C3E9F14DAC073E5BE92004937A577CBAF7B28584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 5670eb898913d38d7b7c9b24bd30d45833067aba4f33ee1878ab8f3d1fef9d93
MD5 3c4738859a4599575bdb95e3b673c437
SHA1 cf7b66d6a5ebaa9765f4ba060c9d8f0f49a8c0f8
SHA512 0ca7c3151e9cb439bd979afe959be53c2989d3f8bc52566d48de02e68b46db5f777cdbd33906ae37afc05249d966f2a00e29739e8281b8717bedcce557b39b54
SSDEEP 12288:XUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17B5523BE955C41CAE52604B5C3E9E14DEC173E5BE9200483BA9B7CBDFBB24584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 426569dd3e4ff3f76b6f6e7aa84b6a8c2804399fa25dcd5bdcd3b1edc0685889
MD5 2a4bf5857eb9771e8d15cf104861f58e
SHA1 3b3a65296f5eba657207001ca887bb1af7b8d755
SHA512 7bffd7ff23600795f34697e289ba99a935251a0e28fad1b13af13776358d367710c369a104df28fb44590398aeef3d49beb50cd39649e8b59e35fcaef1bdee25
SSDEEP 12288:VVFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T14D55236F575C00CAD87285B4C2F5E11DE8237D56EB3005DB6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 fca9e98de817e216a15cdde117aeccd29bba035de6d5e19fa0618a88b55dc15c
MD5 6bb399b2f63e3470316339491a55775c
SHA1 b0eee08efdd1e3b410c127825c967587bee67522
SHA512 693cfa8aae04b495b34aaa73ef7e8b0f448d64a062a1acb064eb59c0b623f28fc83a05a5e5756666fa7911fd2f27fe5a2e48454878d6df88757db9d77d27e6a3
SSDEEP 12288:59Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:59sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1125523BF955C41CAE52604B5C3E9F14DAC173E5BE92004837A9B7CBDFBB24584B38462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 fe554f79fc0f6145dabce403b8dcf6a1d2ab377fab849dfbb93171c74bdafe7c
MD5 ba56648d4daa1ad08e6c85878c8bfa56
SHA1 a29504b2c88e80be2562075785edc4f2a6d33e67
SHA512 4891bd9ee775328fd3de0691fcd85345bcadb2393686cf0b94a7186a62f1145bd073e59bbdbf6479f1b2e2b858aada30600a691eac81ca3755408a77a2ed4d1c
SSDEEP 12288:FWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1185523BE965C41CAE52644B5C3E9F14DAC073E5BE92004937A5B7CBAFBB24584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 23872c3106c5352fbd3c3844356b890ef3276cdcb0112e6bcaa5d8ec4b187fab
MD5 32100bb7526e4314e852c3995466871b
SHA1 74984d42d7fc695079f4e6113d0c95528b51adb6
SHA512 f22a2c7f9f9264b4065bccde8d37437796952993409a426296535e9b280f68c32c6d7b7858712d892bc16c110b5a780798f75d53ff5fd4a5567351d0fd85d3ca
SSDEEP 12288:pSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F55523BE965C41CAE52644B5C3E9F11DAC073E5BE9200493BA5B7CBAF7B24584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 8f2e0040f8a754bb6319236d2f1885e0735ce5678cd965350059b8ed591584fc
MD5 a2b3a3eff95f88cb92cd0b05da27c87c
SHA1 2b4965248daad25f577e631acc7f10c61330435c
SHA512 239074b8f2e0cb49151cb9baf1b8922d6e1db8c268d68e0eec5716448f61a6453a803e14af59512ab41bed1d498a96634d7437e3d6aab58585bb8e34a9dde68f
SSDEEP 24576:rZM2zFVSO6sqjnhMgeiCl7G0nehbGZpbD:rZM2zfKDmg27RnWGj
TLSH
T1F17501A9B39418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 8b3c94a8f35cda6c7e835374116591a460a2a4617625d7792219bdd2a0f5b0df
MD5 90bfe3da48e9271ef02d823fa07d2712
SHA1 0ee4beb90dfb5543f1af5b3df5f4e1b7c711bf08
SHA512 2d66cc7ef406568001b4f28a62d7b4f792c47b0bd4d8b9bd3a22094f38571790eb7ba544c79429a2a4aa42f5f85cd2bff7327773f2482f43880b8f3f3507b309
SSDEEP 12288:V/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:V/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BE5523BF965C41CAE52604B5C3E9F14D9C173E5BE9200493BA5B7CBDFBB28584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 73ea11a8cc3be4efc083f02346c12f09f2afe4eb2d8849310e03a1d01fd8343f
MD5 20b49031a4b8ad6c91c96920a5966ec4
SHA1 24daaacb1ed08c682f6e659abc3ef4326e32ee4d
SHA512 8917c8020003213719bff986ae99b08cbecf01bbb33b371fc729991964990e3ae2a023f9be5870643a8afe02d7144bf0074e7dcaac4b322ce85b4613039aef5d
SSDEEP 12288:ejXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ejsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1265523BF955C41CAE52604B5C3E5E14D9C173E5BE9200493BA5B7CBEFBB24584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 256030fa9d356fb826039d38f021be351f0314c38f12d6f9ffe3c71e56e24aee
MD5 8369f4f8c118befb93839c4be87f0f28
SHA1 5036455c459b8d0d63eb8b596525ecdfe5b7d84c
SHA512 4d6de42f1b8140521d289994a899ab41b7cffb4792c0c677c95d3c29ff0a73ba5ed22cc7a747bc692fecc75d1b2251ff33061ab1651801d1883d62df3435fe8d
SSDEEP 12288:pyPz5L8+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Izy+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T13265125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 708d04584d37834867073cf0d7c268fd93cf67c46cc1b37476a66aecb6ba87f2
MD5 739b4e80db328cf28c1fbc67eab3b39d
SHA1 a1d095af25b084ebd36c7ebb7f09f1725c1de7c5
SHA512 2cf0e2d71a6db3633f0483c6c502d9c6b48673ad52e936eee530290a07c6a2fd4b1d34067f0fa9c85c083614371a61b62111a0f3fbe4138466fa1e39341bc024
SSDEEP 12288:h/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:h/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T19D5523BF965C51CAE52604B5C3E9F14D9C173E5BE9200483BA5B7CBDFBB28584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 279b5712d292dcd60d3b146d0dd2bdf25966ab43e12b182ee4d2c1b0cf1ab3da
MD5 110d876ca021a5bc0f548b684c44816f
SHA1 7399ca9c9fb9a3bdbb90a35155a96df18f622747
SHA512 c11342c398d9618393fdd85d70c79f6eb13dd90d739c1505cb47cca8c49a9dc783c9272def4a39ae9e6450fdef800821c84868649588c4906a66f9e159370410
SSDEEP 12288:C/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:C/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1015523BF955C41CAE52604B5C3E9F14DAC173E5BE9200483BA5B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 74945bd26c0548d8a79e3c58abb4e59d16116998d097e410a450bb4d018abe19
MD5 da1081acab4faf49ff9c1c93e68e7846
SHA1 1e0237255d76e7279f199b902eb845283d6f5772
SHA512 07550da728e1036f0d764a1deda1cd02dde1c84ad1320f9006356b0259aed4d2e15aacc31e22aa6deb9efe70cc23cab9168ee43653c53399e215b6d34a2b2211
SSDEEP 12288:kyPz5L8+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9zy+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T11765125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 610790bbc12eb06573fb9c2daf776d6dbe07934099da47e8bd5387cb1921f1b4
MD5 a4e27eead82187b4e7e7ce46a1d1efa9
SHA1 bb41617b8a5fb8da1affe554a46253c752e56b15
SHA512 b9c687ac2302321815cd945d8c5427338b8ff85c9aec551686a7318bf19b4590f91cf6ecce355557488c66f82f1ff52b134fe191b2f1db8106fd00543c42c820
SSDEEP 24576:2TDaLl3z0zDksqjnhMgeiCl7G0nehbGZpbD:2TuLljlDmg27RnWGj
TLSH
T1B97501A9B35018F8EC67813EC965D90AD5B27C5A0B70C61F13A43A6B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 a76542dee06b860986960e3c1471571b5a993853bccb749c5be75e12e150d2b1
MD5 f3e5b0a5bf6fa5cb8fb6080ea4719ba8
SHA1 221a2932f9d3436cee3d184f5ae7ad28bc79537d
SHA512 9c9ebda999dbc88b2662a5d7bb0461c52cf5c3aa5454f75a268684543eba5d4bcb642c07709e5cf02616df3c0cbf69d705ea46b2bdfecb1a8e870e0bf36c15cf
SSDEEP 24576:/34d9CHKy7GZgsqjnhMgeiCl7G0nehbGZpbD:P4d9CHKyaKDmg27RnWGj
TLSH
T10785CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 b76ace3f839ca7e0ae5999002b0c6314fe10d388b6406247b3b71e6dc1795ec4
MD5 3c0785e8240be4e1ba3e4e9463475ca0
SHA1 fb0cb90b68819070f24a91fef400c3c35762065f
SHA512 8b523da6f1e39f91dfc4d47a27ed554604c6999316b7ed439629d714cc8940115c0cc62f165407f031cadca88d777736c8fd30abab7d140cfc69465c585bd736
SSDEEP 12288:20Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:20sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C35523BE955C41CAE52604B5C3E9F14DEC073E5BE9200493BA9B7CBDFBB24584B38462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 daf610ae3288b0a598b0da1aab6a425394413dd4dcaf1bc79eeeaf24671b44d2
MD5 a88d313e8a83f61949165d257c625c05
SHA1 d9b0d4da13ef416b475226d32f23c71e438ad816
SHA512 cf3eb88b4f6276d3f1b90756a990f7c1f84ecc9721ceffb865db7d9fa94133dde0ba27ab7428e823a096b959ffa998b9a7f52d2e8b696aa29e0d431009da5c98
SSDEEP 12288:jeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1515523BE965C41DBE52644F5C3E9E10DAC073E5BE92004937A977CBAEBB24584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 6ff6e4f57c004ea4f53a2d82c8951e8b1fbe233ffa17dcce16eb1c48b49828c6
MD5 9aee6c4346b183bcf5558631c207ba7d
SHA1 1b78222e1cd23ea331d4f98b0762bd5283e457cd
SHA512 a43d5055f10d012b3bfe928ed0d152132437a357c87a90d3165e1e8acc09f5392df0b7aa99f0787470344f829980e0e3b5840e3da232bd2f375b402f84d77bc6
SSDEEP 12288:FpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AD5523BF955C41CAE52604B5C3E9E14DAC173E5BE9200483BA977CBDFBB28584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 85f4167646584fa2a535a98d8eb0084c0ce541a28699fa6eb05886db4fd44598
MD5 f0d2bd350539bae01976f090545f8c75
SHA1 e17a023cc9560fffc55165aeb604a7ce204299f7
SHA512 9d392c5530aaf981cdd0fc7040a6d3cf2a573efe9b8b359b7ab5f7c8af25389144c37c51c7f1ff1ae10e7bf3c3694afa218223a5d29e38ec78ed56cdcf6730f9
SSDEEP 12288:J/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:J/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1165523BF965C41CAE52604B5C3E9E14D9C173E5BE9200483BA9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 717bac306ffe3c726bf9badfc2f698cdeb19ba05d048d54406dd3204d8ce5d83
MD5 101aa2ccf73a02f9e2b4fec95df294fc
SHA1 bcfd4e3d78bcdcc414a9c6c8ba8d94670dc70e4f
SHA512 96c830c64be410550bc3a2c52e81462661512c79afbe74f200d93951f26dc78ab68067d5ec1849957bf7f3dbc2e63256cacfbdbb41a976886eae890921deda6b
SSDEEP 12288:N0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:N0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DB5523BF955C41CBE52604B5C3E9E14DAC173E5BE9200493BA9B7CBDFBB24584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 77dbae05fa03b092acc727165b6360a033faa8922f3f9adff379fb3c22f8b610
MD5 06657e502926a030fdee27f4eabb0211
SHA1 cace8a79c59779ccb77d9bb5806ee5c288051f39
SHA512 6db86f59ad81c6f3e4ab4b7ddc2c254bc19a445a999722662e7b71fb0af291c34672cc9a9ed762085683ad3b7b76e9b7369683c49f6c8415c6c2357d9f264641
SSDEEP 24576:KfwvEk9RX6wkyAITsqjnhMgeiCl7G0nehbGZpbD:SMnYIXDmg27RnWGj
TLSH
T10285D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 8b975d858ebd92f56f7012a2c31baebe12d5e36a2f988e5bb5f9f445d4f4c797
MD5 a08cad80c5af56667b3089368b9e4cbe
SHA1 23f37a2ac20748a834214d6f40a8b4abb62f1b98
SHA512 d854ff9ea3ca643deecb0943d77a3041a29ea5e0da8b92b5a7d32edccf45e3fc1b108190eba4fab37205225a153d863c1bbb28bac069583abea99b91d05b4248
SSDEEP 49152:dYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0EDmg27RnWGj:dySzPcD527BWG
TLSH
T139066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 75145ee5793792b0b6fde3d205793c40f4d5a4a09797896af5451a558c789c30
MD5 ac3aa159dabfc48db543991bedb4c7b6
SHA1 0424d645636911d2efe9179543ca3f40355f3576
SHA512 c350bb37b3c2a03f89ae1546c5387987e260101b1a45a4d6c07d745486721c93a38a77ffbe055b3937c28d4bfb14217afebcd73be55ef9a0c24a244afc0ca069
SSDEEP 24576:w47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYqsqjnhMgeiCl7G0nehbGZpbD:w47JUQj1irIhCnDHUPfF/0Dmg27RnWGj
TLSH
T13765AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 3ac3771511a2f643c0f53b8268a2acd920c415c134f1ed546157f5e1f252502d
MD5 3cca47d6f41fc78f0ce00f575db68efb
SHA1 939fec44ab5d08a98b78624319fcd795e6b92d1e
SHA512 ba32332b43d1da14fe9d0f2625189a09cad7330852f11d05f80644e5010df07ed08cfe40f9bcf0533dca89e6a744e2523a1fdb80dfec0db3f2445cc0092611f4
SSDEEP 12288:xMsfPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5PsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F065011AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 78a4482bb5c8a9ae107709d2c745827a86d490a8f2016f9d2119768159fd1954
MD5 d2083d97c9d6aacbee09f90bfe805485
SHA1 0c99486fd9dd20850c95df7b5e8d065e482897dc
SHA512 212b20b3ca4b8814d14cc596c17b15cfbe926f92e180f6485e386b6aba4f1b78c78f9ac2e20cdefad642bf468c93d951c0f2ca15bac40066565ca9b14a2494f5
SSDEEP 12288:Ad3KQXGU3f7RwaPXbXUC8M1LHCs+x2rOyLtlQaRBI01CPrwmwq:Ad312UP7RwMrXzlrzbQaRyaCj7n
TLSH
T18B3528417226DB4FC6A940321E33C5CCAB707D01EE45AF0773C98B3F9576659BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 99c809cd499a216b2b8c4136738c5ab2a404f8ccbc85c40f00e0d25deec4aa9e
MD5 bade47e009b14403c540701b47dfa59b
SHA1 231b319c8cdca151e5c840f9f46c372b7fc2a8b1
SHA512 92b4fec61226aff1c49de7649da600492c366293b27be05b1d47d7d381062a0da9a3ff01893d3337c0cffad548d40dc429ed31eb5bdfaf7a68311240c1290238
SSDEEP 24576:tE0MwVMif6YmctblQ6ck3Z4fkVS7b3x7JVM:awUzM
TLSH
T1A365F8819136E78FD1B76032032A5F8C67A8DC06B7096F27B3C9453AD82AB5570F97C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 5e45ba6b7519cc7e2153774a85c859985bd12e083c367f403c221518d98ba265
MD5 e4ab34c09afcc66a8c7dccd3238a29e1
SHA1 7cb00b4ef925b4e475f5051197e4516dedc51a1d
SHA512 b16a15895a8c4599a81beffc8a3bb240f43c0c1cfd879d4c06e6e2a02253298b5d5adc8fd854ff17dd1ebb19ed2caa3a5c1708c90a019657bc0bbd106092a143
SSDEEP 12288:8Z7HXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13B55237BD35C518AE83605B482EAE12D680B7E669F1044C3BA4778FDF6B18D48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f1261543a194d0e0b120635b953775265f02bd6646fbe4577ca87750e2805201
MD5 c009b0790c5f4750886630cc819ce6f8
SHA1 f994d696eb2b54ca45966c2a7e42d6b87ade70e6
SHA512 5c23147d7af4a35dfd085a4cbc7f33f92f51e69510c2a29ead7d67adc0307c04501bf629ac99208bce3f9b7356790e3bd14382bee018ae34970cf4941a921cc8
SSDEEP 24576:cgb6bmBIi49WNNFpg1rSvFv7bYRsqjnhMgeiCl7G0nehbGZpbD:cgb4mBIBhGF+Dmg27RnWGj
TLSH
T188659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 832KB
SHA256 614352ea7fcc47035a549e30258fe5c42a00853455d2db39290f345855617f4f
MD5 ad089865d37f8df86e7aeb2550d70a83
SHA1 4d462dcc5a7da1abcac72aaac1608e92980edb3c
SHA512 172b294d396ecebdf2a0d5554a42781db5239b2f284729afaa2f7c251dee37d15f336bf199bf4876659fa88b4c638dbcf17a15b8d03777e3dd63fae20f97695e
SSDEEP 24576:tGMKJO2bFtiUs6AwVTib/0eBO/lEI4c+z+s3BkY:tGMKJO/UsUob/3kEIl+5
TLSH
T17C05231E52E539DCEC7CD9794449E1A7B672387157091AFF09C2B138AE26EE06378F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 21245a5e9ac27345882595f90beccb0c542f5c243578702936e5e6fcf67a64c9
MD5 900ada38125e362076d61603f1301897
SHA1 bce25c01afe95b302a35ffe086ce72363c7640f0
SHA512 5fca8897e3f5475913842435026f276e9e133da23662b594a9fc205cbbc79efd18aa865bf3936e20dc73b4b7ba13e7afa8b62033e58a955b43fce695bc0cd9df
SSDEEP 24576:sG88u8FpJqH1wzria7/m6sqjnhMgeiCl7G0nehbGZpbD:P7ZFPqVPa7/NDmg27RnWGj
TLSH
T1C295016577E401F1D477D138CA868667F6B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 9d5b1d422d4b961319d04d3a17fb0bdff99af377774406a47592b66165c838f7
MD5 468c1cde6db0af045a404fab73e83122
SHA1 74cc6db917786f22417ca3ab43ec8b3c19a8f977
SHA512 c70c600b837ef18ffff0e72e517ce96e6c13bc077c75214cc008cfce024b6a9ca44da332901342ef7aca5d35d85949bbe9cd9a0f231e85f2fdcba1785dd5b878
SSDEEP 49152:cBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjaDmg27RnWGj:/G05lO43bfD527BWG
TLSH
T187D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 bb016a1d252abb704e23d5ca40da0f427e2f85aa111464ef205e1157e5b8cece
MD5 d73d93f1e4ea419cd61aefe4267adc52
SHA1 924c7071335f02321652c58e75453f11f8823216
SHA512 f3fd363eea36ef9598e98d5803fb5262b2ba245e1b955e1c03bb63d1b74a3525074902fac02899354e874076e6892b0bdc320ee43e242b6c43699e679e708946
SSDEEP 24576:5fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnYsqjnhMgeiCl7G0nehbGZpbD:pa5POZ3+Jt2pasx2+myDmg27RnWGj
TLSH
T1C665BF5EA3FC00D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 fb4c143f04c8cf258d676609346cde90ecd68cab0f6d6ece20a30069ff77f726
MD5 95888e2d7ba86507a89752a6b373fd9b
SHA1 c7776f23a50f7fef9d9440534820368f0d70252e
SHA512 b825402439893651adac867bd60c30be64816dce5e22960a243e690acaeaa944f7943f97aa1c87e036b0d5b046ce89672a7369324ba1b1d672c9645071b4fd10
SSDEEP 24576:hNcwHdjbyQ4nLC18lb/EOjowL7FkisqjnhMgeiCl7G0nehbGZpbD:hNc/zEOVHFtDmg27RnWGj
TLSH
T18A857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 948KB
SHA256 d472e6f8167df32d347e4e29f37f1ef474396beaf369306c6aed56282794c08c
MD5 6b77d8ae8c52037ce5bb65a49f0c2f35
SHA1 d40527a7c7cf0158a6b19b1bfe8c12a977045463
SHA512 f68a91e15a867b17fa0fb5fc31cd3d06ae9b09320119386c324472ce05c618594c357e82166de2c5c37fd9bcc6a2fe90a4e934526d4b0c76b18383008982b0d9
SSDEEP 24576:bUDI2QJO2bFtiUs6AwVTib/0eBO/lEI4c+z+s3BkY:bUDI2QJO/UsUob/3kEIl+5
TLSH
T17225025D63BA21F8E0BBD03E85834152D2B2B47187161ADF0BC4957D5EA3ED8B938F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 f11d23f523154691fb0c477883741d12c93715a2de2485736d8525fd84057422
MD5 d6b5bf3661f1846aaf7ec5bc471bd41e
SHA1 d420c6c05bb8fa75724603b8fc7465e989a8b274
SHA512 40f7bbdff8c5cb08bc06e84626bd8aa2209aa15ff49e9ebfe031cb401dda2b29d36298e644f729dc8b394ba1ccc4c4ec65737d9343f7159f0e8964754560e036
SSDEEP 24576:nTkNvNnaFeYhJNtmZBmFfJO2bFtiUs6AwVTib/0eBO/lEI4c+z+s3BkY:nTMwBtOmFfJO/UsUob/3kEIl+5
TLSH
T17075B06EA6F806E4E1FEC6B5CD238512E6727461073293CB5390C13E1E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 6825a8458811a35db9dbfa744e25c644dc9f3c08e192c9b5c44cc088c4be6aa8
MD5 bcc9c383670dba69962915f2a7e94ad6
SHA1 dcc963e230803600d2ffb194162b0ec9557c8eb6
SHA512 644e403a1d27866932fab5d8e436adb2f20f8f455adc0b3a06f459bde74c4e0af95094e664f9e9a2d98526e3a27a39dc5da0ba2ae0cbb776e0a40245ea2fba23
SSDEEP 12288:PHvUrBFrEjwaQGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:PPUr+NQGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E875F12F62AC18E5E676A17CC582C70DF6727862171192CF02E1817E5F63DE8AD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 42400c149dae35b9c95717c54ab8203cf5d30716bc031bf6994f9cc2cbb32e5f
MD5 21eb5cecf36cfe1e017602105fe16a72
SHA1 fd0988684c730ee78325062dff1766b86efca4a7
SHA512 13aab90131b185fa9cb90e7e36f3afea4f33c2d28e60758cc818daa123faa2261ff520e3fc9fd9f5098d12c4ffc36ebbc3c1b1820e77c65ed3b1c9f459dad6c4
SSDEEP 24576:iD3FHshBIYQgAbsqjnhMgeiCl7G0nehbGZpbD:iDVHeBIAAPDmg27RnWGj
TLSH
T17285E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1532-71-0x0000000140000000-0x0000000140184000-memory.dmp

Download

memory/1532-242-0x0000000140000000-0x0000000140184000-memory.dmp

Download

memory/1532-78-0x0000000000960000-0x00000000009C0000-memory.dmp

Download

memory/1532-72-0x0000000000960000-0x00000000009C0000-memory.dmp

Download

memory/1532-79-0x0000000000960000-0x00000000009C0000-memory.dmp

Download

memory/1664-345-0x00000259B7D80000-0x00000259B7F4A000-memory.dmp

Download

memory/1828-131-0x0000000140000000-0x00000001401F3000-memory.dmp

Download

memory/1828-134-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/1828-140-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/1828-330-0x0000000140000000-0x00000001401F3000-memory.dmp

Download

memory/2120-334-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2120-160-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2120-167-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2120-161-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2800-124-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2800-117-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2800-333-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2800-331-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2800-329-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3412-95-0x0000000000400000-0x000000000054C000-memory.dmp

Download

memory/3412-101-0x0000000000990000-0x00000000009F7000-memory.dmp

Download

memory/3412-327-0x0000000000400000-0x000000000054C000-memory.dmp

Download

memory/3412-96-0x0000000000990000-0x00000000009F7000-memory.dmp

Download

memory/4280-8-0x0000000002C60000-0x0000000002CE5000-memory.dmp

Download

memory/4280-19-0x00000000036D0000-0x0000000003737000-memory.dmp

Download

memory/4280-128-0x0000000000400000-0x0000000000B62000-memory.dmp

Download

memory/4280-0-0x00000000029C0000-0x0000000002B34000-memory.dmp

Download

memory/4280-7-0x0000000002C60000-0x0000000002CE5000-memory.dmp

Download

memory/4280-14-0x00000000036D0000-0x0000000003737000-memory.dmp

Download

memory/4280-21-0x00000000036D0000-0x0000000003737000-memory.dmp

Download

memory/4280-1-0x0000000000400000-0x0000000000B62000-memory.dmp

Download

memory/4280-2-0x0000000002C60000-0x0000000002CE5000-memory.dmp

Download

memory/4488-56-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/4488-67-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/4488-69-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/4488-55-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/4488-63-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/4488-62-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/4616-85-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4616-325-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4616-91-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4616-83-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4828-40-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4828-132-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4828-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4828-48-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5184-106-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5184-112-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5184-105-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5184-350-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5184-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5184-348-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5844-144-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5844-151-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5844-153-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5844-156-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5844-145-0x0000000000730000-0x0000000000790000-memory.dmp

Download