9d1a21cd5eb4d0eb74832de18fef0226a2bc390fc18c1e1db196a361982ace20

Analysis

max time kernel
149s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 22:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-02_c928dff0d1a884bb6d2c15d0cd77b2b1_amadey_elex_lynx_smoke-loader.exe
Size 1.3MB
Sample261102-2sh4paxvav
SHA256 9d1a21cd5eb4d0eb74832de18fef0226a2bc390fc18c1e1db196a361982ace20
MD5 c928dff0d1a884bb6d2c15d0cd77b2b1
SHA1 8d9f3a9cc11748d73087a10e26bca11d192d4a6d
SHA512 addee2e4d582efcb9c5edc158480229bc4897bbd74e5b2368e81447db5819d2eaa9d6bd069e47ad66b03ae8f85e9ad28028ef06473ba429b33fb726a3408a200
SSDEEP 24576:74ZZQufMz4MMMMMMf8XB6D+InjiojsqjnhMgeiCl7G0nehbGZpbD:7EZQUu4MMMMMMf8YDtnNnDmg27RnWGj
TLSH
T1955517D195C38CDBD41A0A316474D9B7142A3F246B74A3CA2EB0F5B95ABFEC13F12816
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4936	elevation_service.exe
3680	elevation_service.exe
1564	maintenanceservice.exe
1892	OSE.EXE
5652	PerceptionSimulationService.exe
728	perfhost.exe
204	ReFsDedupSvc.exe
5104	SensorDataService.exe
1140	ssh-agent.exe
4252	AgentService.exe
864	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6fab05c867fac3b7.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-02_c928dff0d1a884bb6d2c15d0cd77b2b1_amadey_elex_lynx_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-02_c928dff0d1a884bb6d2c15d0cd77b2b1_amadey_elex_lynx_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-02_c928dff0d1a884bb6d2c15d0cd77b2b1_amadey_elex_lynx_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-02_c928dff0d1a884bb6d2c15d0cd77b2b1_amadey_elex_lynx_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-02_c928dff0d1a884bb6d2c15d0cd77b2b1_amadey_elex_lynx_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-02_c928dff0d1a884bb6d2c15d0cd77b2b1_amadey_elex_lynx_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-11-02_c928dff0d1a884bb6d2c15d0cd77b2b1_amadey_elex_lynx_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107328\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-02_c928dff0d1a884bb6d2c15d0cd77b2b1_amadey_elex_lynx_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4960	572	WerFault.exe	88

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-02_c928dff0d1a884bb6d2c15d0cd77b2b1_amadey_elex_lynx_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000009cd00a01c6bdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000bd5cea01c6bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a969c29f1c6bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b269c9e01c6bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006e105fa01c6bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008de7ca9f1c6bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\explorer.exe,-22002 = "Disk Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4936	elevation_service.exe
4936	elevation_service.exe
4936	elevation_service.exe
4936	elevation_service.exe
4936	elevation_service.exe
4936	elevation_service.exe
4936	elevation_service.exe
3680	elevation_service.exe
3680	elevation_service.exe
3680	elevation_service.exe
3680	elevation_service.exe
3680	elevation_service.exe
3680	elevation_service.exe
3680	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	572	2026-11-02_c928dff0d1a884bb6d2c15d0cd77b2b1_amadey_elex_lynx_smoke-loader.exe
Token: SeTakeOwnershipPrivilege	4936	elevation_service.exe
Token: SeBackupPrivilege	204	ReFsDedupSvc.exe
Token: SeRestorePrivilege	204	ReFsDedupSvc.exe
Token: SeBackupPrivilege	204	ReFsDedupSvc.exe
Token: SeRestorePrivilege	204	ReFsDedupSvc.exe
Token: SeBackupPrivilege	204	ReFsDedupSvc.exe
Token: SeRestorePrivilege	204	ReFsDedupSvc.exe
Token: SeBackupPrivilege	204	ReFsDedupSvc.exe
Token: SeRestorePrivilege	204	ReFsDedupSvc.exe
Token: SeBackupPrivilege	204	ReFsDedupSvc.exe
Token: SeRestorePrivilege	204	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4252	AgentService.exe
Token: 33	864	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	864	SearchIndexer.exe
Token: SeDebugPrivilege	4936	elevation_service.exe
Token: SeDebugPrivilege	3680	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 5432	864	SearchIndexer.exe	103
PID 864 wrote to memory of 3792	864	SearchIndexer.exe	104
PID 864 wrote to memory of 5916	864	SearchIndexer.exe	105
PID 864 wrote to memory of 5344	864	SearchIndexer.exe	106
PID 864 wrote to memory of 3420	864	SearchIndexer.exe	108
PID 864 wrote to memory of 4136	864	SearchIndexer.exe	109
PID 864 wrote to memory of 1120	864	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-11-02_c928dff0d1a884bb6d2c15d0cd77b2b1_amadey_elex_lynx_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-02_c928dff0d1a884bb6d2c15d0cd77b2b1_amadey_elex_lynx_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:572
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 572 -s 528
  2⤵
  - Program crash
  PID:4960

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 572 -ip 572
1⤵
PID:4448

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3680

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1564

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1892

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5652

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:728

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:204

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5104

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1140

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4252

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:864
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5432
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3792
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5916
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2624 2620 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5344
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3420
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2624 2620 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4136
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 46cf9199aced378d5d2fd5015a648d33d4b5ab19e0917465f708a3777a869328
MD5 d78c778c0d8a97528c7594c2460ffee1
SHA1 f450dfae4f00b2a774314c4d34d3726daceb7dc8
SHA512 ae52a93d631572b13748cc3ce230c4be76012d6315c862f9c91b6f5429364a6b6d21e7f40a4eecb49e81e73b93d68dff6195f8691e524732c351b31790551c5b
SSDEEP 49152:kb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnrDmg27RnWGj:e3q6mjBcD527BWG
TLSH
T147D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 86aa8a0bf756d74ff4f08a3f715ed0d9eb3dd96a803168e9918ffd91aa1f2587
MD5 5ea2364d585a2e4a5bdeffd88cd3d963
SHA1 127ec8e5a280ca6d298319ae684e0d3bce4fb76a
SHA512 f2e4142d8ff18f51b2d733f00eac58169a6725c6838e790ed56fae39f6937a0ff52f74a378fff09b3019ed0fb0297ccd265ab065a925f8423d466afdcb8e59c0
SSDEEP 24576:WXYfDtczA0sqjnhMgeiCl7G0nehbGZpbD:VtcZDmg27RnWGj
TLSH
T183650129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 bd8de4f1e329c6cde0bd6c55128540a35117e4e9465be11d971f8e24dad4cd63
MD5 90f45f67bda47d4e553f2ec5f68ea9d2
SHA1 6124ca07d39c3162269c77c08eb5f3bf0ad57642
SHA512 24646219479d963903ab40675441811fa35526cd4d0c7b4fdb9c82f77fbfb017128fb44088ebd2f6e799b47655239622c5dca13fd5e7b25ca0984c59cf4c1c24
SSDEEP 24576:90Le5ji0hmxhrMdsqjnhMgeiCl7G0nehbGZpbD:9Pji0AzUDmg27RnWGj
TLSH
T197859E26F6748335D073C0B9C5D2A68EED723086573089CB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7debbf3882406b7932159ce7bdd06423c48407e2fdafb8d7e5d6e7a2b390b8e6
MD5 c1be2a3a9fbcb04f74cef9167e924276
SHA1 8aeee06cc87dfb65a75ef0a3ddfefd09c381a554
SHA512 283c47b304638d246559943de56d76a9a38b1ae271c550c07edb86b3c0d9fc63206c4a099afa5b73becfdfaadbe5514b662fc3df7ae7c60141ae3c4bd92eee18
SSDEEP 24576:+a7/ezSC6vUyD/aqgrvWj6q8wyujsqjnhMgeiCl7G0nehbGZpbD:5/ezSC6vUzPv+HjyoDmg27RnWGj
TLSH
T142755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4dac7e4def32270fab7c99cde1bae0c9fc7d2253cb970be1935cd9ec0f2404ec
MD5 c1beb5c3447ad694dd09ab56e6058bb8
SHA1 44ca082a703ee42eefbd63f293839cd681e54691
SHA512 f0bc2a5f091818c2a09494a17189f2ba468f657918e03943c40859224fb919000a2dd2e8cc9dd83e8813455fff2ceeb185a564331745873f56f236eed375baed
SSDEEP 24576:dVbqPb88hv/l+BSsqjnhMgeiCl7G0nehbGZpbD:dVO88hXl+0Dmg27RnWGj
TLSH
T100559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 621d0243bf80b5e6086f883703ffd7a543878aa80c9f94d4565999de225af5b0
MD5 96f9592b0a85d476d2aead1bfda5385e
SHA1 a0a7d107bc471ac6adcd18dadebf3d599c708a2a
SHA512 7b613ca1d3e6dc3f5ec8fe9fbf2a3290f0c9b4c6ab50b59e6407cb6f6d32c42f95525c49f1463f198f666651359585f074dbfa7f5f2b9f52b2d8cef40b0a77ef
SSDEEP 12288:KGpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KGpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18C4523BF874C50CAEA7608B5C3E9F11EAC177E56982008536AA37CFDE5B5458CB39423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 fd6d72b06b1e3a33b237514fd4d7b8bde0887612c350af4afc8ae5d80f3d1e6f
MD5 8ed640aea48cb86d47ca69761cc75635
SHA1 1f9c05ef25a533f25bca3c7394e1d5418625dd41
SHA512 1f44091f95aebb53d2ae49576622e30dc3e3e4d869a4e60262c0fe482907dd3d6911c354a9371ea710bd3b339cfd2df6fd0406155248199cf881674770c4f90c
SSDEEP 12288:JeBNUbTVO86UaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:JJIUasqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A765CF7BEE28FCD2C27A8DB85791C600E76278314B61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 017118719d38c05c6f4c2ec687b16202c3c80af61d795f3d1bac2396ee75bb86
MD5 bd3f5167c60a77137a074ca6438d9ff0
SHA1 63625057040e1a777ea8ff5edba12ee7c6ddfcad
SHA512 51be56116927a06ab553c07a23f2033c629183e309a59fa78282857c5129b3e9b88670f3cb5d0ec78d7a7687b7f0a397365306ec288ac9046a0a9c1150e24a23
SSDEEP 49152:zQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THd:zQvGAdlCEL8c/WRNw5CXD527BWG
TLSH
T1FC266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 1152877dc953b587a5b25a3c41e2c29952029347db0714d1621b10df1f2de357
MD5 fb4c34f781036b3dabc120c490697aa0
SHA1 91ea85166d36e03ab51ee1070e0d7c84d72fb05d
SHA512 df7cda09f31242f445e7510a810f785f664b61b0a01176ede2a0941bb51de032134317572cbb0fd2b342b9d7954f40629cd24d38587d4686358006b1499360fc
SSDEEP 12288:9AwSfxL/2Dc3mDLLmt0LDQewsAjYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:ufewsAjYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EB75E031FA74E036C77B0DB20B36D71A582D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 fbd90d746c9048815aad2cec4d77be5ca0f5ad418e9ce90a7ef7f216fe0d5b9c
MD5 75b153b330725bfa8056453caec18b9d
SHA1 ee4bcf51da4768af9a77e9682444299f553cdf5b
SHA512 c585c84d03cc4ddb93da51c44dde116da337a1db4dc19e8082d94de7820aef7fbcf939d9e18aaa38a7458e18e394f00c80b2ac86bcb7b5718e286b8edfd6a7c6
SSDEEP 196608:HUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHsVQBWG:HUEtQevvqc2W1cpV20I32zB
TLSH
T1AC474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7152ff5763fb756ff5481bc42e1658dbcd6f0ac1be43c2ad0c6a1bb5cc75bcd9
MD5 a71a6b0ec4e18512cc386ddc4f150322
SHA1 9bd73f64a10fd2759332be8864f3cd5720c6ea77
SHA512 735dcd7c9893f9bcc8593647748a640f276a5102a080c93b86da2decd140f84df45cadb2af5cdaedd0db761bf0a77a557d07c639083287cdae495a95bf587ada
SSDEEP 49152:1CbRquA/m2yL5zLfFiV+XenmE3/zkDmg27RnWGj:ioq2VjnmrD527BWG
TLSH
T1F6D58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d01327689989ae595b66380cb06876c369ed43787203353de551ddb648a6d56e
MD5 bba17c934535656e155e1fb5fca8cad2
SHA1 ff8ec5fa5c46273ab91e22e0cacd8ce158738622
SHA512 f7617afc0579abf26be7d9acffc924b799cf7505d2f7b992f52e330a8ffe6d1b741b4f049f2c88185ecf69a91282881a09c8fbe43c3c3a2675c38480e6455494
SSDEEP 24576:+AhGL6IFoiwtA5l7S533sqjnhMgeiCl7G0nehbGZpbD:+AM5Foiq5bDmg27RnWGj
TLSH
T1C2359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 4678118e76bc000298e504ff5e7aaf75d7d39f12771ade5256a8f060a38407a2
MD5 2d531893ffda77f988789948666885d6
SHA1 f418699a0ba244dd38ef82e1576fed59a6a9205b
SHA512 df24625300a8c52a7bbf7f7056fca74fc51cfc6b739479e2cbc06bf1a76f547990a88d7ef9354fd98c81bd8339628045902af432f001b39905115b5a26993361
SSDEEP 12288:Imw5HEjsChNEBFgl0WDm+CVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:lwuROWSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12A65F14A76A80CF9E9674139C697D136F7B3BC122A20C71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 72ba7ded219d3f3916944306aa30fb41ebec510ba47b079fc036148421c38966
MD5 2f361cbc5552469f865dbaf88b3f8631
SHA1 34e4ced8bef9183684dc9a18dc8aa2ecaad574e7
SHA512 1927ce60d2563703d98165f0f138f7222279142b298a00a9ba68df53169e83de8df27ac1716033a1999efdd48e021403641cc12f53cd58995801ccde9204edc8
SSDEEP 12288:EyZ1IyIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5ZulsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1285512AA239820FAE163417CC5E5D609E7337C62673003CF166659AA6F73AD44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 53f79c7367a9a9f1280d9ffce740c7f7f01a7226b77a5782eee2c3a001bc79e1
MD5 7ede123febebebbc05d2330a645d8218
SHA1 727b40245473734c06b7110c8f53aad110b9bd87
SHA512 fcedb807b37258dd32f1944e9696c30477248f33f43b07b1dd8520272ef0c0c4ac1bbbc5c17b9a151c0a91bc7b468006baf617e9156f6e093f707f428515a0e7
SSDEEP 98304:qQRQyi36YOcPDLvw2gAf+PN3SD527BWG:BQyiKanX+PNiVQBWG
TLSH
T12C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d83a4ba3c66b4cefbedb5da6b668a037a55df5fd8279d3afe5eb0ab2fdb0917b
MD5 39d99aebed9d54e65e8520510aacc17c
SHA1 7cecd53e93fa0c01b681078bfe7cdff01719e2a7
SHA512 79417d84665097eccbf3b6f1040c58263d4129439c32a0f3e5aa4bbf4b60ea7aa95a4760c0143dbc5c7ae0d0ac6de942a10cbf34487b6039bb6a10945d42b35f
SSDEEP 98304:2QRQyi36YOcPDLvw2gAf+PN3SD527BWG:9QyiKanX+PNiVQBWG
TLSH
T1C5667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f187cfda8048bf0b47110c460cce9b290fe602cb95fcd3a230d528d24e2d9fc8
MD5 2a2509de8c432990ecf9f945a6936409
SHA1 d12b358ea4acf257dcaebf59bd334880e48ce873
SHA512 6f93317a748cdf777d9112def1f3a4534ddbb737d2c8560368b7b0ea85f4199111047f2b23559b80dbf18cae660ea6434d5e264081216467eb32ea0d28fcfb32
SSDEEP 24576:xwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL01sqjnhMgeiCl7Ge:d68Qg55nhkeWu7PNU3/UDmg27RnWGj
TLSH
T134B55933B2F60099C44DE1769F4A872196D27C758FE0E3DB8511721A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5f276bb5fe9f5a5931a5c63972883cf475eb5fa006c6aef172e9bb884559ebfb
MD5 dcd3586123366237c5f2c8c50af446e5
SHA1 f71244ca55154f9ddc2b3516b02351a31540bfb3
SHA512 cdc1f5c372adea6cec98cd75b3d5b90e1ce6ab8193e9e2146d18176c889b43cd01ae42e2008410b2c8c8621b1163106f2ad183b4c10e9702a4f217c1a90ca54e
SSDEEP 98304:yy5112gYy5azzVvU69nLKnhZtD527BWG:7LIHRWhTVQBWG
TLSH
T150167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1f7858a90f0a7a047956360d6d63165a5b9ca4967f6c08201ec855cdd658a7ce
MD5 bed97e8f13c3c6e7dc02de74a310c845
SHA1 801b003afccb25df3554ec05745067f26a47d4b3
SHA512 ec70a375df04cffe8f1e996bd2ae4aebb1e470ed2281bbdbd636776473cb7bc443c405a724e83b2e8e35ca51dfdb1cfcf45862189527bfb23dcc89900bd8c45f
SSDEEP 49152:uB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glADmg27RnWGj:8u6JmIxd2dAD527BWG
TLSH
T13FD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c73d09360efa7804598b21e3ac910c6ca6972cb7be54cd3f6ef9277ff72f0388
MD5 cb620b759cb7ac533d6e68bd94af84ca
SHA1 62710f495671ba5b4c1c57502b76499b5aabb76d
SHA512 c631e29f4c6f08117c016081c280ae884b194d5d782b088d10d941164737d4b13ed09e85d3b50578009fd84b412c3edaf0c00bf09321ff0b3ebe3c633fc06660
SSDEEP 49152:e1hpsNoJpF1A67U44CwH7R4xODmg27RnWGj:emifPqRrD527BWG
TLSH
T177B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b88b34133398160ad525a224d490771e3309d4bdd37cf0bd7f3f310d0cca0138
MD5 c13ab71c04e1aeba8b4453f14e56e6be
SHA1 e4e2ba7c697df7c4d814fd88d6c3dff5f1ca26cc
SHA512 d7430a757ca654dbace702a10dd32e4e4ef6dde6cd39df8b3928553c13191966095e08769fefe79b8089e0bb145e820a607b85fae63102d6f010dabe6ef61915
SSDEEP 49152:BSuZQIY0Be2KkRVtOnks6NMHqZDmg27RnWGj:P5dKqi61ZD527BWG
TLSH
T1A5C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 96d645375f01aa8b4aa3f696014d0c9a94ffc7a522de0699b7e0657492087672
MD5 33ee244acfda5ceafbfc672eb2b302d1
SHA1 3121384143275a6a06d4fd8c263af6049b3192cf
SHA512 9afc782e20f1218d7b1b08b166a52fd60657e7cceb78275941a1abe3b114d7a31f3587a85fb9210f4718872ea41eba71050357a4f3af95ba0856820418d1f3cc
SSDEEP 49152:thtSn8EApI0figjgiDn0AP5waDmg27RnWGj:8X2iWphfD527BWG
TLSH
T1CC95BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 4469146c494d4e78b9bf92f57336ad36083934ebbaff9507e9612bd4804b4746
MD5 a7f1e4db8f951afae47c3aa15e0c0c11
SHA1 b1da64074ed6efc112fff0cb09ebffc5a5601cc2
SHA512 109860b7254df6615b11fd0051204cdbb5c8cb62b141a8ddaa48842d5df1aa99b79629e839ea2cd3cb151aca01540da2e395e73ba1cff47dd15618be721b0848
SSDEEP 12288:8RXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8RsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D64523BE965C41CAE52648B5C3E5F10DAC073E5BE92004937A9B7CB9FBF24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 8cf134aec8813357088ed6cf6469ad153fbcffb915fdef973bf4ac93b4b01234
MD5 3d8b64c98e4761510af20eaf23ddd232
SHA1 be087731f5651e830610870ebfe1f3e051c6c324
SHA512 1415dc0bfe964d4bb2ea5f0c39b06448ad1f5d49648df81ef427853c7529c93e2635f8d7631587c46de093ad4f9112930f37dd20fd4c09c2076a183f1c2df2c0
SSDEEP 12288:40Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:40sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C54523BE965C41CAE52648B5C3E5F14DAC073E5BE92004937A9B7CB9FBF14684B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 dc8e6b812c4d61e2707adc8b26cd795704bbbd21aad661248fcd14ba504be55c
MD5 877c09b4ffcc6da71ab84439293d0a78
SHA1 5ca394c8fbecc0f7810ead3e1e2bb0ec65abd9cd
SHA512 955034404c1604ce7331a2e44833c7741c330d398d137ae3331de2280beb3573179c1c5ea6bfd42da5f7a2df1db19c8e268e1bb8890b2052edb59a7f36086416
SSDEEP 12288:2iXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2isqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B84523BE955C41CAE52648B5C3E5E14DAC073E5BE9200493BA9B7CBDFBF24584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 c5b490418b6a549457bc5b2f11190ce23419b116a7519dc0b4db03037120356f
MD5 936be29248f8109ac86f71f1c636d8ca
SHA1 39023e6cfe6fa2a8e810d7c8e394a4b67ce4a310
SHA512 0b32ed00b842dd4daf89bb8a223cbd1eb30abc1f2db23407963380dfaf28a22f2111ce8f98668a67eb6f75d4cd998aaab7b0aa76599e4f2b2fd5a310ef1481f5
SSDEEP 12288:uVXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14545236F575C01CAD83285B4C2F5E10DE8277D96EB3005DB6B522CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 7ff666608d27f8d9d41cd2bee9572ecc07c27b1cebc459fe74d7a0855ef12b1e
MD5 f22b4d01efab5ce7eb8609bf987944f4
SHA1 e6ef10322893dc6f38611258589c7cc9967f826b
SHA512 85e256adad1c3a10bd5e65aa33080bdc031e9400ab7ed7cafb318b42bb242f137aefb63e789693e45268b73d965d4ddbf61ae92a62db1c580efca8d3801db647
SSDEEP 12288:jPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1614523BE965C41CAE52648B5C3E5E14DAC073E5BE92004937A9B7CBDFBF24584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 30f856f79fb1d2b69716e0f7942a21313378c8110feb47cb494acf28830612f8
MD5 54a768a6fa9285b9598e1e2b8c337839
SHA1 d7955afff4f0c1d0e2eb70164ddaad449fe4ed89
SHA512 dfab97982b385d273220272af3b9676d073d66abd37d2e6f1fb561cc59b9173ef5820f49567da97c82496a3a42d703dc61afef0dddf6f140abbdb07c9d072901
SSDEEP 12288:MgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1554523BE965C41CAE52648B5C3E5F14DAC073E5BE92004937A9B7CB9FBF14684B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 7c4b4263e8bfc6c271b9161db73845c3a6f33cb9fb4f767b8991c568f7151d7a
MD5 86a1941ae1191b77b9da21cca2a132d3
SHA1 e7c3201eefaef350e9b82b88e8334b2e7e7fe9d2
SHA512 e4fff3ea504abcea7037e261cb5db7a5bf61eac9820deab908c0af32d2ff5d241d8291e3ecc8ddee0d54eca5e141ce670de9218b472d09daad58a194ce1b074a
SSDEEP 12288:PsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1384523BE965C41CAE52644B5C3E5F14DAC073E5BE9200493BA5B7CB9F7F24684B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 2f14f0e4d5d8f8d7e9bc6020335552507a69c425cf0800a5d6ffad1b718cd015
MD5 82a2e19ca9bf5e534b21011df8c6cbbb
SHA1 1aaf1370160f8023abe00dc26205825c1102054c
SHA512 275f9b2c7b43f20303039774966aa3e5df373d090a6673f0ee89b2ca74445571d665c2c6a7036da3b878b7a016e1ba2082f80849794d589405d66803de015c4a
SSDEEP 24576:pZM3zFVSOUsqjnhMgeiCl7G0nehbGZpbD:pZM3zfMDmg27RnWGj
TLSH
T1EA6501A9B35418F8EC63813EC965D90AD5B37C5A0B70C61F13A4366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 8e751e7ce54454ac78c7b844867391845263dd3cd43027e09b16d199da35c7d2
MD5 901f01c0e796b30d7937bd6c103eb8f7
SHA1 49b54ccc0107a23084f367e008c59b3cfaa05d5d
SHA512 242f4e8de1cf2928e8ed5ca6f4bc7be3a187ab6627362be8acfd0acf1db49d4687b67e95d171ddb8500c23958a811b8d2376c6abe1f3ed3d9ab0450469d10e31
SSDEEP 12288:QVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E14523BE965C41CAE52608B5C3E5E14DAC073E5BE9200493BA9B7CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 ace0eda13a112429e656fbd3cbf4dec32577e18889210c749c139e79536e60ad
MD5 0410af1fd43e4e3771708f3192a9eb5c
SHA1 1eb3e64a10fbae0c03743655e3481d4046fdd915
SHA512 a35ce4cb83a80090d61f28b2f97bc230c021ddfebf1bcba41b35d4ddef976dd270aa510c0dbc571db49affb75b8606a9e15f5d90d6fab1098a9ade80f304f2fe
SSDEEP 12288:1ZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1ZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1064523BF965C41CAE92604B5C3E5E14DAC073E5BE9200493BA5B7CBDFBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 31b6bfb509cdad1d4c7c10f0035b89df96348398b056668ca92c417cf9819c81
MD5 17f1a552ae8597d5c296d972b510812a
SHA1 e7257640fd81a3c3b61ad374732f22fc42951ba8
SHA512 384a5889bd686494f7570205250d127b617ca996f8babd689129c215a00880369756bba2667fb5195654d566aeac8a720a5afc347155e0a54ae33e79081a1173
SSDEEP 12288:ayPz5L8IXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HzyIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B155025B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 8844e2e54963625d71b5c8b514f5a7cf862ea8dd9fe045da7aa8b7aa5d633c5b
MD5 53af943b90d7d68704eaddacebb8ebe2
SHA1 74d79bcbf71fef7b5fe007dacb646bd7ba31391e
SHA512 544a4f3a5f705dc0fb2ee89c2bc6d769d85e936a126b6295882126ce4304b122f19d57c26b87c6e99673d1f5c3690e7320f3c2c32d6b291fe62d7c5eaaf46fd0
SSDEEP 12288:gVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C64523BF955C51CAE52608B5C3E5E14DAC073E5BE9200483BA9B7CBDFBB24584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 a09ff670f71c800215394cd5702e07f56b7b4b773e1eb5aca0068c4fa0d499df
MD5 3fd7f8f4f00639e7967fc84424ed8777
SHA1 75ba60ed80511dc365e550df38764a5cb143f85d
SHA512 1ef388a884f58a186117710ef55211f8fcd71e5f5b606fa6e7f6bfc5444d2cffbacafa4a8e8c8be09afaebbfb22fbae54af79e132844dfd7b449dbdb02566fcb
SSDEEP 12288:EVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:EVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11F4523BF955C41CAE52608B5C3E5E14DAC073E5BE9200493BA9B7CBDFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 84843860378207373cbea740af4adfad59cfa108c603c96a77b01315adea1afb
MD5 1b89e5fa553671dff2a5df07607e7188
SHA1 811da8d749fbbdcf6df11a5a53cd89b4a68a8ecc
SHA512 29c522e75aa2fc194e80885846ebc6e5d2e1b21213845533b6a28d111fc66df440ab7395f8f51d7520ac010ed511d0d8de8b8bea7637b020aa18713c707cf445
SSDEEP 12288:6yPz5L8IXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nzyIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11F55125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 ee353872e6412efdc81473e0d69068e4a5d6d584664020492aa78710680badb0
MD5 f92a9dbc5ce0f58769f09625b621654d
SHA1 ebfaf984a3c655d5f64286f8fa72a059656ccafd
SHA512 df6d89fa8412852cd75571a2ccc055e930e521f67e6ad650489a0e16d802d8962c5ab48ad810673ad7ffd2199415e68e325cb1f8ece36e2413e19a52aeb68448
SSDEEP 24576:oT8aLl3z0zDysqjnhMgeiCl7G0nehbGZpbD:oT7LljnDmg27RnWGj
TLSH
T1626501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 cc2ed27e3ed3ecd43ed05af511ea89c42d2190d4534be9c93b58a745f69750bc
MD5 72d38910ee777ecda12dcdcbf0f89d8b
SHA1 ab86645b7cdbc22cee5b7276b2c8d51363f2f8da
SHA512 f736434b0aa399ed65136944f0bda0a1d92dfbb252de106c22dc07826fca933aa0c6250848bb615dba374b383c6c86a24fbf7db943acf9b2f382daf0a2ba9a7c
SSDEEP 24576:k3rd9CHKy7GZesqjnhMgeiCl7G0nehbGZpbD:urd9CHKyaMDmg27RnWGj
TLSH
T10475CF90F3E810E8F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 5bc7ae9f91c79b2dd758cc1a8496bba6c57b3e1479cf89783a00d8c6a38f2eb5
MD5 87523db7785f6eed8f674806ec0abcf8
SHA1 1b215d24197e9ded07c5f036dea15d6c0d7f25e9
SHA512 0bf88b5e991e8b5e69b599df5d9964c181d5ce5b2ae5cefadb4a8cd27760c99b00ed985240e017cd799848f4e0c547de82ad89521ab3b836508706aaeae2f9a7
SSDEEP 12288:zCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12D4523BE955C41CAE52648B5C3E9F14DAC073E57E92004937A9B7CB9FBF24584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 9e39c6389a752ce6fd5a9315f27ed9858af33e835e3fc9fc3982fba7705353a4
MD5 e8ac0305e5034d9a5f1edd4e0ee2af12
SHA1 20e2a0554e6875e9d69cf3728d8c0aa7a12209de
SHA512 a4b058d82dbc7f2238742b9b016d4f003e2fd18d635221d02998cc04eb4747e38e25f5caff3230490726b1fc4d721e002c8acc95af0b512fb820b159717dccc9
SSDEEP 12288:NoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NosqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B14523BE965C41DBE52644F5C3E9E10DAC073E57E92004937A977CB9EBF28584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 de0a39e963c675711acc392c0ce1e5ac1da4b6eaa1cb2dad76b05465edfc8e2c
MD5 02e0cd060d8fe9fceab7af557201abc1
SHA1 bb4b37223dcaed26b5c35253b5442bafe8d734a3
SHA512 257ec3ec22f025d8b2cf0f8b33ece0c631dbb895ea1557f02bc13f9a9c3bc7aac7f599848f0bb321c60c3a6e639c21248f7c846a8f4e17855a720e7a839919e6
SSDEEP 12288:wbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D54523BE955C41CAE52648B5C3E5E14DAC073E5BE9200483BA9B7CBDFBF24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 13a33976ff3572d1c8f43c84e2eb094d2ff94b6b8f3cde0393626cdc741f2fed
MD5 d9e847eee48737409b7db7c52c8b8e05
SHA1 501710768f45f03780e1f272a8eed758662b0a05
SHA512 6d7732bfee419abdbfe17aec0a1990e733efe41559a9aa7a4cd4ad9b3b55a2a73aaafed2adf28d1f0bfe1f2e2c99334f3fb7493b7d3d61dbb8a993b41bd3ee2e
SSDEEP 12288:sVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1754523BF955C41CAE52608B5C3E5E14DAC073E5BE9200493BA9B7CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 cbc3556760edc3660d3b460979fecbc96947e017b239129a35789d112c9b1c37
MD5 b3c8192f1f53e094285099696eeda425
SHA1 f7ba77e043a7ac769e020e8807285a494978a449
SHA512 04e6faa056b17235924bc07885e57a61e95c408d3dd17280117dbb879ba92db87ccbb9316196a2d7423bc88cae3f8ebd98390b497fea49856b43ada4ac4a53a0
SSDEEP 12288:OCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1374523BE955C41CAE52608B5C3E5E14DAC073E5BE92004937A9B7CBDFBF24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 febc2616d0e02b46554bba9b2aec4476b7f882f74359c78ed17e33dec9da507f
MD5 716369c6f064d6e6c4368acf606709e6
SHA1 030dadfc3f51e80b746a0e9ec77be812442333e2
SHA512 acd1382d32136ceb7c8613f1da583aec664090654afb8cc2f5338c818cc1b930a55587975e316dda7b9d04fcadcf9e86c9d97a2300e411511eee0c01e5944c43
SSDEEP 12288:itXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:itsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1064523BE965C41CAE52648F5C3E5E10DAC073E5BE9200493BA9B7CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 5ae5f084f1baff9ad1077d70cda1240f29995a5ce65db2c3da4fdf0342990ac6
MD5 5c5553d711fff3ecd251f5f758f7756e
SHA1 3f777908555cbe07fb831724ad9155add34d1484
SHA512 1f19e90228e9d07429479647d6b61fee475c3371969426fa842055993f3dde4bd3b083f49c7d47ce0d634fc3261cdede41a27ca937b7572f902df6d05c6baf58
SSDEEP 12288:8PXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8PsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E04523BE955C41CAE52648B5C3E5F14DAC073E5BE92004937A9B7CBDFBF24684B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 e1ebfa814128bc84a3bc2bfe9964c1a77c45d5c69b1f1f82432dd45fbf3e43e3
MD5 9882fd0b2e504bb676f6f3bece3dc3b5
SHA1 9c49ec5f635c4f91b9feb7b9611052e9ddca2973
SHA512 ccb3b1341715a56fbc13b19b69943ddc42053c692c91b602b1652400d627c4be55ff4b308be0483451e70bcaf4f036c9357753ae5cdda3d6c11250058709053f
SSDEEP 24576:vfwvzk9RX6wkyAIJsqjnhMgeiCl7G0nehbGZpbD:qMnYINDmg27RnWGj
TLSH
T14C85D029EBDC44E5E177913C89B7860AF6B178691B31C2CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 866f175831de1542243dcc5f06aef4f176bca6692dc776a7c0e31dbdb7755974
MD5 8b290bae3090939c6c9cb41e11cd9f1f
SHA1 8b624785af8a97acb619afc16d7bbc4d41c64b53
SHA512 fe62f52dc3f9a152ced235757acee2e128e143b779e2eb94c0785929db64fc926605e0bbb9e2dbc3756dd76f59e07a4d397524dbbc7caa7d3aeafb3582fc5ce4
SSDEEP 49152:XYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK06Dmg27RnWGj:6ySzPyD527BWG
TLSH
T1FC066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 ba9d135c764ce3b426ab9eb2ab1e8d2c1632b1e08bc0a493fcccf668298cc1f5
MD5 0d199a1c4f9cb81c377e0ee81e11faa0
SHA1 bd85ae3a596d9579f42a20319fab107bc4914724
SHA512 4bd239d3c369aeaf594dfcb5434b0a9cd2fbb6cb17f9b968f25ce040602d2704036433d7973ef2a5e2ba5dd6f736260f3d4ad7b6b331a328ff81aee2942cf3cd
SSDEEP 24576:y47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYEsqjnhMgeiCl7G0nehbGZpbD:y47JUQjqirIhCnDHUPfF/qDmg27RnWGj
TLSH
T12465AE1EA3EC01E5E1BA927885558A1AEA71782E1F31CACF1270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 58fb3ba4169afb0d99745b07eac9c5ffd49a236e7e0d1a3f334c7b645dc1aeca
MD5 de4beaf0748dad02d90741510fe687af
SHA1 267d32617a12e962d722efc286d3994206579005
SHA512 7ee39cb2180b10dd7b4271fab7a5bdb8327d335d8476394401b248152e0e0655b041c76b69c4f90ac7eb94841c3ab0139f2daf022e0999275687bdf8c25d11ea
SSDEEP 12288:VpsflXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2lsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A155015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 534fd3d8672fd1892f326c49a9b84c1f903fc63055cd58ce682abf49d4b5aab2
MD5 ebbec552355800cacedf3183bfe50452
SHA1 a60dd9cb98ec3423c1c524e41b8738ec77e2b380
SHA512 e298a9846d3f36969e9387ebd777890d3114c1b074db26e907b3199d04ff70b3bf5dc42360f5daac447dcf4f6f2827681bca9baa614570c475e7757db5f6f51b
SSDEEP 12288:RMpSU3fugnZda3NaFu92rXrUZ1CyOsCMzsNcfTDBWp+JnlX:RMoUPDZdi/8rc1COzzMcNq+JlX
TLSH
T1F33518117626CB5FC6A940321E33D2CCAB707D05EE05AF1373C9873F9576658BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 ffaf3cbb7bc18aa4844048884feb74723f0b9e37ab9304dd403a136bcfa5b3a5
MD5 ccbfaed535d7e1a5672bc2e029876481
SHA1 643ffd682419a04951ef7223a21ee9f42586dc28
SHA512 7b61b6a3ed52df944ffd986aca215d47b4ec73daa2eaa9e57d4df0f55c8962a0ccbd9948fcd4ee02535cfd400b65d7e8a08940f008c5400b1689a141fe8e27ae
SSDEEP 6144:Q1536USzOHj9k0rIEqsQIXEK+vEtMxHvEtMxh+O85eCLZ31/kbdS:s79k0rIEqsQLOZ31/aS
TLSH
T195650881A537A68FD0BB2032072A5B4CAB64EC07B7095F22B3D5453ED86B715B1F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 79570135b25297bb3a06fb7a48474ffb9d71e14806a75490822a06bb8f6c0f0b
MD5 cf5028fed090e0a63563ddf98760a4db
SHA1 cd7bf0e48741fd5fd366b6139f655c65050c9dab
SHA512 af4164a8fa86fba230b3b38cec0e404b23f29fea228a2dfa21e91f5264f36b9e1d94c41a26bc10ff0b8b7417894436371c0877428c784f62b2d5a8b7c0c9a78a
SSDEEP 12288:EF79Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Y9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FA45237B934C518AF93605B482EAE12DA80B7E669F1044C3BA4778FDF6B18D48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 3f6d33b953a226333b7330c86a77ccc458333c52e662260a914350098bae253a
MD5 374f15696643487665e5efebd10a5303
SHA1 ae2a6b1e9489f86602f0bd7f15fe466b68e60814
SHA512 3d6548d2acc30817eedff4d2ee0f2ab70170eab5b71b34cf656ecf7cb0c473ae39df6072d55f172c056527e3f00a5424a9ff2683af2de4cca633e1338e44c2ef
SSDEEP 24576:vgb6bmBIi49WNNFpg1rSvFv7bYjsqjnhMgeiCl7G0nehbGZpbD:vgb4mBIBhGFgDmg27RnWGj
TLSH
T123659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 0ac3d44045751c8bb4baf793a39631cb794207f3e30a304a471204bc3f1ab3f6
MD5 499836209408f87184ca14f03b8989a1
SHA1 24275eedd4a106cbfee1df7d185fa07a10aadce5
SHA512 ee20f863540820bb5c68920dbfb76053ace7f5ef5d309cf23a414340b46701a6c4a944e4a9ec6ae24af3595361b383850eccf92eca61f155185e1a0116315ca6
SSDEEP 24576:AG88u8FpJqH1vzria7/mUsqjnhMgeiCl7G0nehbGZpbD:T7ZFPqVya7/vDmg27RnWGj
TLSH
T10585016577E401F1D477D138CA868667F6B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 f1c6e6fcfebfb77868d097689a02cd453461b4fced88fbfce46de8b47476de3d
MD5 231fc45015c4f3b9281d038be9619ca2
SHA1 e7318f477b681c376edfdca3e105e56a04160282
SHA512 41a621575d06d0955d7e5fe9010e0173c6d57207992beb20774421f92ec086abbb26513b6bfba6c72e06300f6e3f2475b867b63b006624401cbafb9b8a094d2b
SSDEEP 12288:LHvUrBFrEjwaQQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:LPUr+NQQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CA65F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 6f40d8ed40c7fb7efb53b5d44883ed15bc421d57dc89672dbb764dba96b75bea
MD5 78b239c673f149c3fa2c2152a1c01782
SHA1 f8d94b560ed34d858279cf34ebfaec220cae2b5a
SHA512 fdb18e469ba93b3f1b7caccf554a5dc60a852a0b4dcbf25acba7bf94f2dc6589bc28a05efb771e4275bd4cc3d6d0d3fcbcf0c6796159c8213cac00bfcaedc091
SSDEEP 49152:wBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjcDmg27RnWGj:rG05lO43bVD527BWG
TLSH
T1D9D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 fb8481647b073cb65b4a570c4caccd11c1e9e48cfcfef62e7eb7ce9ff0bd1a68
MD5 2bd3a2b532467fda6c5886ef0fafe4d0
SHA1 b7d085fb15d8491794de725fc5e0e4dcbaafdadd
SHA512 796fb4434cba55b4b28874848547856b7ad977a9558a07987f677313a181f31def7e7c5feab1009be9a2426eea791f5816319fd3fb0b2faf695349a216bbfbc0
SSDEEP 24576:/fa5POZ3dpyWVM50JicR2hG0lasx2+47eidn2sqjnhMgeiCl7G0nehbGZpbD:Ha5POZ3lJt2pasx2+mUDmg27RnWGj
TLSH
T17165BF5EA7FC01D5D579D17DC583861AF5B2342253319ACB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ddac893a78ca2b94c5fff4c27042729edcfdc4d5a7de3f75f245fad5d58ef0ab
MD5 4a5d15113204ee598c1fcf57e46a4630
SHA1 c9c26ebebe1ca24e6444b125e09ce2876344f632
SHA512 7f107e1bac5149d36cdc5046f9415d827a44ae7c7fd79a179b5896bf16f46a9ce41e4aa7795548a1e699fac3a55ae6e7d12fe4512c6969716d4da352f5146e0a
SSDEEP 24576:/NcwHdjbyQ4nLC18lb/EOjowL7Fk8sqjnhMgeiCl7G0nehbGZpbD:/Nc/zEOVHFPDmg27RnWGj
TLSH
T15B857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 aab13c2cc05d1cc8d6016ae332c5f88386936567ed17ee0f5a0cc47eda44ae52
MD5 93d17960360b109df8e91be70b0395e1
SHA1 aff09b713b2e70c3fdffe8bf2833c7604514366a
SHA512 c52120da1de58b431dd8832638ca525b35ff48864e504173858999f6f3fc98735bd6aa0dba095094f7382f7b31a3bb98132b1f7211dc9ebd0e6eb1694a93bb19
SSDEEP 24576:gzkNvNnaFeYhJNtmZBm4sqjnhMgeiCl7G0nehbGZpbD:gzMwBtOmkDmg27RnWGj
TLSH
T16555AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 a18292ec4d94bbafbb75b484a8261f11bfe5e177217e300c5fcc0b9ee72f9240
MD5 eac607861f5d7106751e079d8efbbdd4
SHA1 dc7214f4cc3dbf5e76ddfcdad4e388aad9bcddbf
SHA512 4bc9097902839eddd69644a99a0322e99c894d8b59492a6b633cc544c501daf46de363cda550dc0510baa4005ea8a371cd1141d9758ac944a36ba114c6750941
SSDEEP 24576:1D3FHshBIYQgAxsqjnhMgeiCl7G0nehbGZpbD:1DVHeBIAAFDmg27RnWGj
TLSH
T19E75E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/204-331-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/204-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/204-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/204-94-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/204-101-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/204-100-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/572-0-0x0000000000400000-0x0000000000550000-memory.dmp

Download

memory/572-6-0x0000000002280000-0x00000000022E7000-memory.dmp

Download

memory/572-56-0x0000000000400000-0x0000000000550000-memory.dmp

Download

memory/572-7-0x0000000002280000-0x00000000022E7000-memory.dmp

Download

memory/572-1-0x0000000002280000-0x00000000022E7000-memory.dmp

Download

memory/728-312-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/728-89-0x0000000000A50000-0x0000000000AB7000-memory.dmp

Download

memory/728-84-0x0000000000A50000-0x0000000000AB7000-memory.dmp

Download

memory/728-83-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/864-319-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/864-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/864-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/864-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1140-126-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1140-118-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1140-120-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1140-315-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1564-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1564-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1564-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1564-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1564-51-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1564-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1892-229-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1892-61-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/1892-67-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/1892-60-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3680-99-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3680-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3680-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3680-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3680-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4252-137-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4252-131-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4252-139-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4252-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4252-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4936-80-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4936-20-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4936-13-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4936-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4936-21-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5104-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5104-107-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5104-113-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5104-106-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5104-316-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5104-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5652-284-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5652-70-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5652-72-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/5652-78-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/5916-322-0x000002457AE20000-0x000002457B442000-memory.dmp

Download

memory/5916-399-0x000002457AE20000-0x000002457B442000-memory.dmp

Download