d12bd3e8945f588dc1b20024b6274505420583a2edc989e9690ff3a8719a55db

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 06:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_dc0f69a0a094a830947fcd4d1cfdfa88_amadey_elex_luca-stealer_lynx_njrat.exe
Size 1.4MB
Sample261102-hbdyvsed28
SHA256 d12bd3e8945f588dc1b20024b6274505420583a2edc989e9690ff3a8719a55db
MD5 dc0f69a0a094a830947fcd4d1cfdfa88
SHA1 507c956adaf5068203b8db8c130a7b2a9f29e1df
SHA512 05aab2e9e5b9b4c450d3149be95b63a0cf0ac8afafcd471a16d2994c075767d5c289c166a8785b9263336f11844fce03cf9310ee14b135ec2793dde38e49c2a8
SSDEEP 24576:0LVSCxkmgXe4i7ojhsP5Lgrk1TWb4AN5:jCxkpe30jaNf1TWbdz
TLSH
T110650100B9D1C472D1A2117258B4CBBAD97EBC210B244AEF63D45B7E8F346D19B70A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4580	elevation_service.exe
2556	elevation_service.exe
2608	maintenanceservice.exe
5176	OSE.EXE
5416	PerceptionSimulationService.exe
6024	perfhost.exe
3940	ReFsDedupSvc.exe
4624	SensorDataService.exe
4808	ssh-agent.exe
5508	AgentService.exe
3032	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-01_dc0f69a0a094a830947fcd4d1cfdfa88_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-01_dc0f69a0a094a830947fcd4d1cfdfa88_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-01_dc0f69a0a094a830947fcd4d1cfdfa88_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-01_dc0f69a0a094a830947fcd4d1cfdfa88_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\87c0e49d67fac3b7.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107328\javaw.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-01_dc0f69a0a094a830947fcd4d1cfdfa88_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_dc0f69a0a094a830947fcd4d1cfdfa88_amadey_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c189201c946add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000e280d1c946add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a316ff1b946add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e9ab7c1c946add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4580	elevation_service.exe
4580	elevation_service.exe
4580	elevation_service.exe
4580	elevation_service.exe
4580	elevation_service.exe
4580	elevation_service.exe
4580	elevation_service.exe
2556	elevation_service.exe
2556	elevation_service.exe
2556	elevation_service.exe
2556	elevation_service.exe
2556	elevation_service.exe
2556	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2044	2026-11-01_dc0f69a0a094a830947fcd4d1cfdfa88_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeTakeOwnershipPrivilege	4580	elevation_service.exe
Token: SeBackupPrivilege	3940	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3940	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3940	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3940	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3940	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3940	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3940	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3940	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3940	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3940	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5508	AgentService.exe
Token: 33	3032	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3032	SearchIndexer.exe
Token: SeDebugPrivilege	4580	elevation_service.exe
Token: SeDebugPrivilege	2556	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2472	3032	SearchIndexer.exe	101
PID 3032 wrote to memory of 4828	3032	SearchIndexer.exe	102
PID 3032 wrote to memory of 4428	3032	SearchIndexer.exe	103
PID 3032 wrote to memory of 2008	3032	SearchIndexer.exe	104
PID 3032 wrote to memory of 1412	3032	SearchIndexer.exe	106
PID 3032 wrote to memory of 4272	3032	SearchIndexer.exe	107
PID 3032 wrote to memory of 1712	3032	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-11-01_dc0f69a0a094a830947fcd4d1cfdfa88_amadey_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_dc0f69a0a094a830947fcd4d1cfdfa88_amadey_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2044

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4580

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2556

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2608

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5176

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5416

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6024

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3940

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4624

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4808

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5508

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2472
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4828
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4428
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2600 2596 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2008
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1412
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4272
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2600 2596 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0dcc3dfa39b24629af9f413cac060edeb5ea8aeba7def7fc7acefa5b58272278
MD5 3d82786f7e4edcf5258f06b74a640529
SHA1 7b8a24fba5583ed6984ada97d01acaaee5fa46cf
SHA512 a4638b879802b01797608840f632b45775b420d62d98071fe6d44f8ff52734733d3cee10fb174e176a19c00b9d3c97e51eab9ce8bf0221311b7b96c79cb4be3e
SSDEEP 49152:Ub+632BuPkFKRrdE6ohmstBhuXjfS4LWxnce30jaNf1TWbdz:O3q6HjB5U023W
TLSH
T19BD58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 1f759c5bfc08604e13a97e41cfaf1e8839c6bc16cf00aa8c57d56456218b76b4
MD5 36c4b00ec63dfbec1e761b6e99b225d8
SHA1 19b994ac53496de971d0cda81f32a9af5b496327
SHA512 02d77b6b7a68a59fe7630d2cbcac67b3ba6182ba9c7fe3765f10f31bee0e838432b7da00d12bfef169334d05812079124fbfcfe97cf6a6ad3eee46dd191fa969
SSDEEP 24576:vXYfDtczACgXe4i7ojhsP5Lgrk1TWb4AN5:atcOe30jaNf1TWbdz
TLSH
T14665F12877D409F9ED67827CC8E28611EA737C814360EB9B03E499661F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 aac30f7e430860df2a9d554be32b72f89ebe0cd0365ac45fe2f8b1194b95a8d0
MD5 539dc17d7c72f4e4c5c8e08ef3b58eda
SHA1 a7dac5463d0c126e5c3df4d73a56737f30e028de
SHA512 f9d371586a8d5665b3fe0e842304f2de5e6a7ee3581e06b6484a11598915fdbab7d6229b29fe7e910c9b8180dae6fbf1cb9cc55f71ede30b285698661330e3ab
SSDEEP 24576:90Le5ji0hmxirMpgXe4i7ojhsP5Lgrk1TWb4AN5:9Pji0Ac7e30jaNf1TWbdz
TLSH
T1F685AE26F6748775D073C0B9C5D2A78AED71308257308ACB4286D77C3E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 679e8a60365dbea9bb77aa82c23e992f3c915be8a556b22e8b6ffadaa7174698
MD5 607d0e085bb07ccea463a3e62d32235f
SHA1 e0f5baa6f1c5d096d5c9b903c11c7affc57632f2
SHA512 4e7b2d9fdbdedffc0fdf73cbcc77e2ba53a733d37cf2dfe54bc2f97bac00ba6fb5e7d378dad4c34e161141b16c76985b636a12d5cbd80988bd4a62d0efaf3c75
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWE6q8wyuXgXe4i7ojhsP5Lgrk1TWb4AN5:+/ezSC6vUzPvxHjyXe30jaNf1TWbdz
TLSH
T13A756C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b730d3e13d9e06d60041472064555e13f179f56b509f00780fcf1036274aa640
MD5 e501b372768066c368d323dbf50a5437
SHA1 5e96c7ff0504e38ce702dcb74e89c15a272678b4
SHA512 c21e2ea631aa0358a6131e0ce3f8caab3fbc76c38b87337cf248406f9a0b585f9459fb137019b47b0a935def20b59d6b2176dac90956d33f0ea943f3a39d5d2e
SSDEEP 24576:/VbqPb88hv/l+6GgXe4i7ojhsP5Lgrk1TWb4AN5:/VO88hXl+ge30jaNf1TWbdz
TLSH
T135559E66F5748331D073C0BAC4D39A9AEE3234425B318ACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 94a036e52a9789c73e0fc1fc052a64c94f00a9d23f80fa888088ac5015fec292
MD5 ecfe3f282ac7728b531f8adf631b1cf0
SHA1 914e5c8633a4a3f4842c7957184ceda4045e7411
SHA512 2a6b08db9c44deaa6e21931c53e94c07aa3207f6d307670afc15726fcc622c7c4c9e4781b5991dae58086fb30bc17c27f769ee63c627ee080ca1157ddc7b21fb
SSDEEP 12288:mRs0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:mRNgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1054523929F5449C6F38BC3F4A0F7CB91E5A11EC071444E6B47E0BE9318BC899DAD8469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 72b16e3fa0364c061fd06adc1f775c8129f54d0e7c91daf3729ae848e6c3aec5
MD5 547141ceffa153b57bca6fa61adde12f
SHA1 a9b1a4617023f50a1ac3e9ffc79066e7e8e1d66e
SHA512 325483b49810d4b13bcf5afa129559969f15c774481734aaff26b8a63e9f9a9643a61588d0a50a4a9304ca2699e28858ca563a96b7e4efd270f204ca107f3eca
SSDEEP 12288:QeBNUbTVO86UB0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:QJIUugXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1CB65CF3BEE28FCD2C27E8DB85691C740E7B278704B5293CBD164820E9E235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 bd304bf4a4a036ba1994af15ffb1a886cdba4f104a2437a084ebc12db8ca007a
MD5 f3bbd8449fe9305c7f9471f8f3c62a19
SHA1 acf8e1989cee500b8153ad84797c3584aaabb0dd
SHA512 919a30ee0ce29d276332c8f2971c1527fcd358ae03cd22fe19fdc576c7d3b5c5a0e71154aa3e4edd0b187ebf6d5a666b50502aa328109f94f9357315de232232
SSDEEP 49152:jQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THD:jQvGAdlCEL8c/yRNw5CuU023W
TLSH
T12D267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 e2b6d3f723a2a048ac81bb09a8a28d8a7136c0733dce6b8ab4910433b16754e3
MD5 8aa1a8e2c99577b305ad4ffc1a06288a
SHA1 1e0dc914cedb97761f47266c7eba6a33fe172f1f
SHA512 a0746b573ce4fa58060b83644ff76bd39a4c5048e990b4a0838cf75a0878564d258fef00504368fb99c24a502527c760a21cb461a669712afae2663a60aca205
SSDEEP 24576:UdewsAjkgXe4i7ojhsP5Lgrk1TWb4AN5:MljLe30jaNf1TWbdz
TLSH
T1F475E031FE74E032C3BB0DB21B76C706587C6A604B511AC3E3E89E9E59342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ce8727619f00f102127daa5722d355488c8e1b9ec0ecc2da7593932f2afc494e
MD5 eac6ee4203afbddce443d6ed4530fb7c
SHA1 b1d99e0eb4a60d7efefa24bef9a9df7b009e57f3
SHA512 1df1260f3c7a4cf5eba8cce93cd4906398371a8843108ea7f41b917ed025bc31730a44eee9010d49049b6295ced7cbea598c85994507f90dfc50cc4325ceb150
SSDEEP 196608:JUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHzp4W:JUEtQevvqc2W1cpV2EI32V4W
TLSH
T181474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 aa6f6d552e22eb5e4d5ccc89825b4954fed20a7ab44085b6e26f3f3a46a4494b
MD5 a04f533f2e9ef55684bd4a084e832c08
SHA1 e4b42624300e4aead54328ccafa7dd93b9153532
SHA512 7470bb7ffe8e506657d8fcdaca81e8a9a170152e75cab4e96fe592aa2c3030515da4f896e5bc39a84d0ecd9b429023481257ff1ac329a3aa88dabdfd838014cb
SSDEEP 49152:ICbRquA/m2yL5zQfFiV+XenmE3/zre30jaNf1TWbdz:hoqtVjnmaU023W
TLSH
T15DD58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 09c3ccd55832ace4a3bb0306c1792b2dcbc0a7303ec8b507d0a9a99b6c52ad74
MD5 78e798a1edd9dc83d0b60f36da07ff61
SHA1 26803e9fdfbef51c333e21da798f1e55f686e0bb
SHA512 2b220c096a9bd1b604f32cb9d1c8bcf61a7f4d303334ead4cae621263020e82b496110951077e10f3d561117116db0cd9fc5fa1c1098e376f31aec47a3a71e9d
SSDEEP 24576:pAhGLJIFoiwtA5l7S53DgXe4i7ojhsP5Lgrk1TWb4AN5:pAMyFoiq5qe30jaNf1TWbdz
TLSH
T181359D81EBF955D4F5B3AAB899B68571EA76BCA65E30C20F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 d1b9ad2170c672b47594be0377213715af8621c28a5f62d721285ded684af3c8
MD5 e2cefe07d7c77d9ae4db7f4c33f61948
SHA1 46b442f9cf36979e9a9773eaafc1371e2451d9a8
SHA512 8dbc8d7f3df3a2664ed11e93bcc978f73ad7b63ddd90bf823eafaaf654db19503cd75a9c8a175c82ac0156a14ba95b2b8561ab4f7063e30d4b1318bd0687fc9b
SSDEEP 12288:Qmw5HEjsChNVBFgl0WDm+C+0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:NwuoOWQgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T12165F14676A40CF9E5A782788597C632F7F2BC412A25CB1F07A0C65B5F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 0dfc361b4f4eeffc173042943ec4ff5225b51a99beb88718564da24cc422e851
MD5 f04f1357c44bdac6318202d3481c0f72
SHA1 aa5c3c6e125e3c0938ffb8c1aa665a7c83caf239
SHA512 6dcef9dafd293ae284010c244c1e0d16a2ef5b440d7d733ffc88aed0e72f1600c6d8459dd8d2493c76155fbdcbf99b18f55284a9860152c687d156120520f0d7
SSDEEP 12288:iBZ1IyH0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:MZuRgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1A055129637E421F9E2978278D4F68741E7B23C82233147CF02A096A61F76DD65E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 65933b0473d416eae90af5114ccff45c8743dbf5df77416cd54e2fc48f5b18b0
MD5 7bb5b0da22bf2bd24905cdc7448910b4
SHA1 6ca54a76704a4570389b4ba50a3cb35414e901b6
SHA512 4e5e2e00a1b681a01978382850a9767b14dbcd76ffd4b158b3dbfabe287efd75e9196e50d4a69de88f8539d452fb8d4d7733342bdce3bbd1cb18d56a9674fbca
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Un:cQRQyi36YOcPQLvw2gAf+PN3tU023W
TLSH
T1F4667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 cc1576afc3c3b6e457a9873d3f4bb622679407853e82a64ab132439b313cd1e7
MD5 2c8db7e1c1c688f73f289bb01f1cac3b
SHA1 f87c87d632cf0b6ee124641748c6f918d9035eb4
SHA512 35d94643d20ddc1402545fabc412f3067b7331ed2516297e7546fbfceda48734980da64faefcb86069a9d35ec53f63b1ab87075d81ce7a48df5d9ddfd254eeee
SSDEEP 49152:oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Un:PQRQyi36YOcPQLvw2gAf+PN3tU023W
TLSH
T103667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3aa330b96b43a623337bf193b2bea65fa67c48fb148b6b99be8c62eec19d8453
MD5 7ba1d103bb35e437e6bbdf90ce5b500c
SHA1 5406857336d35dde40c99c79a8e294c2ac638b1d
SHA512 159de44b006c4f7c4828dbda88e914f33bf71e792560e10fac63137696bea7f99974f1e4ffe38d9c3751e11fe3c3a309b562ad3c27ea31aec9771ae0d2a9b362
SSDEEP 49152:w68Qg55nhheWu7PNU3/7e30jaNf1TWbdz:qthWRc/7U023W
TLSH
T1E8B54933B2F60099C04DE1769F4A872196E27C758FE0E7DB855172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 7ecf1016f99162a2b1632fdce344abc96063ad4c0125770adc6c1dd16efb8397
MD5 ac5eb29e74fa5249f1ae8335ae9e5cd9
SHA1 39de91d5fd5bf20510c63b8d2237bda740ce2bd6
SHA512 7abe00549a71735cd3edc9e6d15eebfc822b0df5589636fa11b9dabc2996151b2402270b323f2240427f37f9b6d39eb67b24221b965c549f54bedec8684e6649
SSDEEP 49152:n3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99t:Ky5112gYy5azzVvL69nLKnhZIU023W
TLSH
T1E0168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 df96e8727952dea5cb859baf80c484e9627d956ed7ca55ba46507ccfefee9deb
MD5 5e5798b6652551ce147c64ae014ecd24
SHA1 bb61a1b16b8bf3e7e4327ce231bbf38893b59949
SHA512 a87b4e528f2ed8fcd420e8037ef141e6e32bbc9c2b7412ab3fbfd5fc47e3bca3980d0056178f8e6b3de4d467c0f4de3da10c21ce99bb808c5de20698970bd5f0
SSDEEP 49152:bB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glde30jaNf1TWbdz:Nu6JmVxd2ddU023W
TLSH
T1C4D59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 39964101a23ba46a51f64798a66c44918d60a1d9adf32d76dc6a6752e3193df4
MD5 59eee336d7c98c1e8f20641335569224
SHA1 714cc3799f708a0eefb9e8834fc6e7ee54588d0a
SHA512 1764fb5edf2306c54995862871a6b1db61095f798df2320f41aa3bb5240b93218e0482d504dbd70b1e9bd9194eab74ff84bc2512ceee4b41ef88bee2e98f9e9a
SSDEEP 49152:R1hpsNoJpF1A6UU44CwH7R4xBe30jaNf1TWbdz:RmifPbRaU023W
TLSH
T1F4B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 bdfee8453623458bc0e907411a64153f0d73bb5d4142c36e34983b65eed349ec
MD5 cfd03309d66cb4b98739f6a138b39b12
SHA1 b294f39f8d920f104424cb5f82ee4530af337447
SHA512 f3891a47bd1149e7d1660d043b44a8d013e19b682a0fdeb3babe4db19c3f8d7e3f91cefe7f16904d745b06892fca3b14a897868705fccf83e14d18ddc53acd19
SSDEEP 49152:cSuZQIY0Be2KRRVtOnks6NMHqse30jaNf1TWbdz:e5dKTi61sU023W
TLSH
T18BC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 116d93ede92a92040c9606a8541955c8fbd0e2e979e2b388925c15d53f6fb7a4
MD5 9ed0f4d9b0895a5692ea4844ca98c951
SHA1 3b622637aac42ef87428a73d8fc7676208d4136e
SHA512 35d3903b26fd4c2cfea9cc3a63b507ac6af8b6c09901c3169c43d1a9e400325961e027ddc4166f641a9457b7df315dde4d1f434506cce59937d40f6ecc20d424
SSDEEP 49152:EhtSn8EApI0figngiDn0AP5wVe30jaNf1TWbdz:FX2iyph2U023W
TLSH
T1F795BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 3c3ce36bab850c1432fe397ff1438e8eb3965c6b4f530273de1495d7900d3ce9
MD5 2fc0f4ee98f66b950f75d6fa1fcd1241
SHA1 30e531589b0a9128b72b1959e8e708dc3a0de8b0
SHA512 4d3b4936e5cbebb7653b790ca8a3d53a83951aeefcba33257af657755f225c8e761997011d8317711ae553001ca52077e69bf55be991c4a77401a6d1b356eb2a
SSDEEP 12288:hU0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:h1gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1B8452392AE554AC6E34BC3F0D0F787C1E5E11FC272444E6B53E0B95319BCC9A6AC84AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 a138afc6dca3be012b0cdd0752e97c582eeab6548227c5077f0c6f84a32769e8
MD5 7d3bd03d5613bd468e4b74078d7db68f
SHA1 a1a0db649ed039ec17d5ccf78e4284fd18935af4
SHA512 f951a45a40c40e7f0ad90c5548ad024a2d1e1fd1139d6409f27a6e204507761d59e3312e779d449917da283109a32c0ad6b0fee88fc2ab6b0fb269b769eafb61
SSDEEP 12288:kr0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:kIgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T17B4523A2AE5549C6E34BC3F0D0F7C7C1E5A11FC272444E6B57E0F95319BCC9A6A8846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 439cbf976a4a94e14e1c1d9cd253e74fe486fc5feba3be7666f9af4aee9f49e4
MD5 2e869684cf46a649606d4f620a797eeb
SHA1 b91012e87e223c26058a3e990e150f43c873b939
SHA512 48a5cccf57cd9f84c5e735d06d0f37aa0dae6a13069dfbd0126b4a7ae07d4014ac63f541ed644b13ce57e36733257e6f0099818892bdd46ec89e3eaf3e2e4f89
SSDEEP 12288:5J0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:5WgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1AE452392AE5549C6E34BC3F0D0F7C7C1E9E11FC272444E6B57E0B9531DBCC9A6A884A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 8ae25cfe5f914f4f53dd9473f0093a92d9961dc5584b9348aa390d5e4887266d
MD5 103bcb714e6e1b4d2a1fc7e59114197b
SHA1 2f84589469bee64a8eb8f03d4d00defea7a5f16c
SHA512 fab213340b311198d02b66b7da0caf0928f7c1441648c91a6596767d8d9da5db41ed81ba72325d3c8da0a0bcca7657423814f04c9bebb488923995e698934731
SSDEEP 12288:AVq0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:egXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1AB4523926F5505C6E28BC3F4C0F38791E6F13DC173114BAF47D069530EB4AD9AEA8A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 c4122ba234e1758c8c4d15b776e57925f28448f1a4fe22d00120adaef0c0fcbd
MD5 1c91769902ba3661fa7ed4b7b8797230
SHA1 f08458936b68196e48c8f6232981df64818c7d56
SHA512 42926fca1a6be4ad24e02fa63db18d704dc96b7e59d06a6054662c969589286ab7ab2a33b5318c0b3893f60f7d8af5753a793d2424d6f0330486cf17d0e6d134
SSDEEP 12288:zC0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:zbgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1C5452392AE5549C6E34BC3F0D0F787C1E9E11FC272444E6B57E0B9531DBCC9A6AC84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 695ab5f8b19d1e901b4d37411866f56227c4b867155d94f7d52c2b6961e2179a
MD5 0f1516f510050ba4f726a5cd29037a22
SHA1 f1fae5ae34f3fd3dc43a2cbaea856caf9514e635
SHA512 a209e8a0282f9883a3643bffd9b1401d1e30298cf988b29ca75a1c0adabbaabb310cd620e392f41443793ee34b4e969eeb5d98a629bf8f0a6f7cc619de1f7d0c
SSDEEP 12288:vf0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:vMgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T103452392AE5549C6E34BC3F0D0F7C7C1E5A11FC272444E6B57E0F95319BCCAA6A884AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 9669845fdcd7d0886fc3360813574873ee083527fdb48a967887089e884cf77a
MD5 71e8eecef33b1fd990e1f74e97e9893b
SHA1 1792d2130f18a7617bfa2a2e7b4546f9d82ccae1
SHA512 39f44357427bb8087767b520dfb5f9d7aaa9a2e62898412e7f483ed52c8011d93ea4fe17206643e038e5fb80da3183649921803177d646ca39c8f010e5243dd2
SSDEEP 12288:1D0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:1ggXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1274523A2AE5549C6E34BC3F0D0E7C7D0E5E11FC272444E6B57E0F95319FCCAA6A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 42bb47255969dfb72c3e794efd450b96146cafb120b5fe07c157c51b609ef50c
MD5 f3f7eeb6c4e9fb71a8fa4634e03d8d88
SHA1 bd0522539a8914deab6e67422772e4be3727f9d2
SHA512 42e17c9f1b70db00dec65e7cc30baa6ba4d963b0910b8802ab1b966f19a36d2f5728c55d98dd137deec70312398d316682ee2cbdd2bed423840c39e4e8e38416
SSDEEP 24576:qZMSzFVSOogXe4i7ojhsP5Lgrk1TWb4AN5:qZMSzfTe30jaNf1TWbdz
TLSH
T14C650195B3900CF8ED67827DC8A68A06D6B27C561760CA1F03F436671F733A11D2DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 4f7bb15517b9db5439db6f8cd9750e3942797fdf8f3b8c5dc26fd65d50915c63
MD5 69794588ad348cd93d28753969d2a63b
SHA1 0373c8bc938f74c9ff7d583a423a4f85400f804c
SHA512 0ac48eb32bb545732ed07125829f66a5b69c5765ec5ab5addaea6c7932dffe2dca88457d05a200a890850f9f0c25f68456d2b4010616aa235511b9113822c483
SSDEEP 12288:YA0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:YBgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T139452392AE5549C6E34BC3F4D0E7C7C1E9E11FC672404E6B47E0B9531DBCC9E6A884A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 8f5b3070203a0378858299ce649d2b56851395e76b9d302a8203789dc9c75fab
MD5 cf5b1ca76ea03a37809f478c69a4d913
SHA1 6462cc54f2f5fd032ec7c5b3ea899049a4ff0953
SHA512 bccaed1f5792493eb95b555afe0e06ffd42dd03ef3ece4801621ab4f15c60093811cbca9768cc0bcaef16ef3e03e75b7017486d30ec329ca3d7d64e8fb3e3de3
SSDEEP 12288:R80DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:R9gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13A4523A2AE5549C6E34BC3F0D0E7C7C1E9A11FC272414E6B57E0F95319BCC9A6AC846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 6ffbc893c4e9575b89159c03fdf4111dfe5748cf79743d6f2fed2ed0e662aac3
MD5 d19334e8c6468f92612766062290ec02
SHA1 e0b4be19100772b6654b4af90c7bb8b16d6f0870
SHA512 f332e5210ca70f8bcc0677ddcc72abf8435f0fa7b402e8d340916b677ee59d17baf29217f6cef050a16651940753fcc18b91a59fa73e1a000396c90cbafd5445
SSDEEP 12288:YyPz5L8H0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:5zyUgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E855025777A120E9D1678278C4E24B41F7B27C7217208EAF03A057732E776E19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 2fd5cc57959efe17d6b56f56fe17236f05ab3098c1469468d458fbe3ad0c6e81
MD5 0425288ee8b6f3648333c2673c5578a5
SHA1 7981737f75c377ef59fef2de7c0c9043a10ecca0
SHA512 257acd801c65695fe1673fc7c8646dac7b7278e7e0677c8edc29db34c904525baa4bfb46d4733a2a8002335004c04a98d670f1143c3092f446e7492b4c2d052a
SSDEEP 12288:CA0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:CBgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1BB452392AE5549C6E34BC3F4D0E7C7C1E9E11FC272404E6B47E0B9531DBCC9A6A884AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 b4a2631c2c583f8e00769fead50cfc911b0f48aad962239a935f401302fb18d2
MD5 f037929f6f1835a5b7f2447f65e2c476
SHA1 e05ee1ad9692dabbbaaf36c2e2fc201f43116c59
SHA512 ecf974ce4cc7e9a09d0aa1a96f0edf3a3a8f6f4edb69d5f89e61ae7bda3b51cc44dd570d2c9c2952bdaef323cac541b5d632e8766c1989c6426c3604ebd2df9e
SSDEEP 12288:UA0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:UBgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1674523A2AE5509C6E34BC3F4D0E7C7C1E9E11FC672404E6B57E0B9531DBCC9A5A884AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 94d87ef466f8724dc50155384310147eac9cb45f3ad4c243973ed8cf9317d8ee
MD5 7942e02e033371bb4ef0aa0dabfe1be6
SHA1 c2cecf7a906b59ff8ae8dab00bd3da1cd26f23a1
SHA512 b9561cd3bd1b065ec02f80dd7bcf1f5966ef00992916bb73aa33123fe07a8c5ca727f8101456a49023662075371712dc3e38774720aad6086f2731fd0f5265d8
SSDEEP 12288:LyPz5L8H0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:mzyUgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1A855025777A120E9D1678278C4E24B41F7B27C7217208EAF03A057732E776E19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 fe8853b9b124d744b030de659bf33e65201d714f4c0e8667b019142d70265c65
MD5 d43e1c5d16a47b1ae791ee5fd793f6ec
SHA1 69b371d733e60763e597c3a555c297c0482ab811
SHA512 173bbf9c469f8026aadb9ca2fe867b9549f710402e29176812240172ca6c12ee7d901a972d388bd6cc14e1b68c8ee1441322c7ea1923c5cdcf6ee78b4436ed67
SSDEEP 24576:QTHaLl3z0zDmgXe4i7ojhsP5Lgrk1TWb4AN5:QT6Lljee30jaNf1TWbdz
TLSH
T10D6502A5B3500CF8ED67827EC8A68A06D6B27C560760CA1F03F436675F733A11D2DB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 dc045681b0497503a11e92e959b78f5dd844d62e0704909cf227c861fd6c8ee6
MD5 1fd8f9f1b3058aa63ab43480f125b086
SHA1 ed05ae796977d810981b956b70b597e8cb7ed56e
SHA512 0ae421912e102445c76394cece8a000ac919e280fc0a957f949dec9d4d9b17f2a9121fec9cf5bd5fb00fff9e9a5e292ac6e5eee162f26316c7387e8be7df5482
SSDEEP 24576:k37d9CHKy7GZqgXe4i7ojhsP5Lgrk1TWb4AN5:u7d9CHKyaTe30jaNf1TWbdz
TLSH
T14275CF90F3E414E8F1B7CA75C9764611DAB67C991B21CE8F03A4665A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 762911cabadb52edb1f994d1770530cc7bb02ebc5b675799639ea969c3c509c4
MD5 b238c406c591c24adbdaa2e91d3517bf
SHA1 f4fcb3003f742bc25652694de81396b08d77d3b1
SHA512 18ba24bc4eda2f3b3389755769d3cfdf56c367849c0d6fb99ad4a0b82c7bcaf0862272725d811a25445a36a9daca9f8c6d5a2da3cf0b988104fe51b07f92035a
SSDEEP 12288:3p0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:32gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T14D4523A2AE5549C6E34BC3F0D0F7C7C1E9E11FC272444D6B57E0B95319BCC9A6A884AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 077c9fd715d66b1e1ebe4cd3d403d017215456b634956c1c5e1b868ec3d8fde1
MD5 71d86ba135f4107d5d9e3d6bce32533e
SHA1 f5781e90223350b39b780741d344689bf11e8a74
SHA512 bb358ab4786eba8b3a2d30d760cb5251bd9855567b8260fedf19ee57d6107a875c56cb2e5753c5c9d4647daa31c657d95adf9736fa642b075359e4609d15307a
SSDEEP 12288:7n0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:70gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1124523A1AE5549C6E34BC3F0E0F7C7C1E9E11FC272444E6B57E0B95319FCC9A6A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 4926d381da6072c4359f7a99d304e928816ed215094178e57735be7957af5f69
MD5 14ba3548b40253174238d2a42e3676b5
SHA1 efbce9a8a67793b371e530990701c79b9eed2ea8
SHA512 d65858ccb1ecf19a081de9f2fb68abf1fe87c170b40b1a27ab395809f5fedfd7fbfc55336b7086647f32d2d67f3063e290d726266619c51b35f8e2b0444251ea
SSDEEP 12288:5W0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:5PgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T168452392AE5549C6E34BC3F4D0E787C1E9E11FC272404E6B57E0B9531DBCC9A6A884AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 064eb8c393ad9be6c02304eb6a6668bb8ce3782b63336d1c5d35eea94dd04e53
MD5 88d9dd427aa9c6c9a24d5ca15c0d0b6e
SHA1 205233cd6ff60b99a424e6a41cbfb6ee07f0a230
SHA512 91f13d7993d6614b858505bab50b6d8bc1c37505c67b0bd82173f17485a658204ecb55acad1526614c6e7645704e8461b2507e6668423062de216ec6697adad2
SSDEEP 12288:jA0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:jBgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T10C4523A2AE5509C6E34BC3F4D0E787C1E9E11FC672404E6B57E0B9531DBCC9A5A884AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 83fae89d93302db9d41c1ef2e99962d1bd1bbaa8f6a233c3c7454df03c93bbb8
MD5 ec73952a44904b892cbeef942f10c6f7
SHA1 64ea403788c66e172e081a5742a412e1aa3901d7
SHA512 6e3b6cdf2cb2d28638ed24656c8321b8c6e9ae1fd4615ea31e3f9d1b02ea6b95bf49cd2aec8419f37646b08bd5321ea49a20649a9ad9273394ebb452cca133c0
SSDEEP 12288:up0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:u2gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T113452392AE5549C6E34BC3F0D0F787C1E5E11EC272444D6F57E0B9531DBCCAA6A884AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 95065c24b2214676bb81be526153eb62b0cbe96e0453bc85a6a08e60236eb78e
MD5 629b522b221b9af6e82f96f56980ca70
SHA1 8f9935ad1e7f16a57651c998dbba1de83e01470e
SHA512 7d8db497947e546ad7f04c5c06b5fe24d925d5754cd3a642291f00e15f2b3893d094531996aaef0d9895dc6580e7cafc12eb82b2126e859c1883de5c21563525
SSDEEP 12288:K40DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:K5gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T19D4523A2AE5509C6E34BC3F0D0E7C7D1E9E11FC272454E6B47E0BA531DBCC9A5A8846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 774cfdeaf9fc97e49d512e7006a131e10319e1c6e03b961ca1c01d49eb7af359
MD5 d3f67a39d01e0a5f94a413fd69456865
SHA1 99251ba58f36526e30bf27ff46f9d87fdd3dae69
SHA512 4a075f24b370fb994bfc6411aeb879a6ccd1805f00cfd2c123d4d294a5f0273bc416e01104ff073ba6df05e1b405c570c1037657565ca2f949ad646f743b0b4b
SSDEEP 12288:TC0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:TbgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T15E452392AE5549C6E34BC3F0D0E787C1E9E11FC272444E6B47E0B9531DBCC9A6AC84AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 daf52dc0e9400efae5b00a28099919295b8faea1d67d117f3f27846dd8e64318
MD5 8505f8141ae43fee6aeeada552ea4b44
SHA1 c12aa3d450da38845d753400d11d8bff070bc7ff
SHA512 9a4bf40a29fa5ff16cc2f18847429a3f94941ea2033ac4ae933eeeab994b0c4c1e91a6d83062aa9f662c5a88d9af919a61c8074e5e12d788152cdb3f493d01b0
SSDEEP 24576:/fwvok9RX6wkyAItgXe4i7ojhsP5Lgrk1TWb4AN5:ZMnYIoe30jaNf1TWbdz
TLSH
T14185D029EBD804E5E1B7923C99F3460AF6B178591B31C6CF029953AE0E37ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 f5417cb88ba57797443811296bfd130dd8debbd14743743b9e7d430ecaa7229f
MD5 381ba8b46c329960bf1ac43fc50d61fa
SHA1 d6504628c020d00cf5275134a361aff9acf7a4ca
SHA512 1918fcaa0db579b7270526b11f4f83ae14d12672b552bfe626e7e378744495c6e8500beec9dfbd9ef7a6582c1b0b5be09e1ca1e1c234e9f9a767abb3266f5420
SSDEEP 49152:UYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK01e30jaNf1TWbp:aySzPNU023W
TLSH
T1DC067C96A16801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 b24d5061a572b25d5a62c495fa380b9b8e6052eeb057ab0d4b4c92d39ba77696
MD5 a832c05e96000640f15191e8f7bc4f21
SHA1 7543974efc7490528bf1ed73100db7598c97b9e6
SHA512 dc5cd64b9c34a9a22097728886cf63906ec553dea2d7ee4dc2ed1128b8ff8234e560b1007ce630dae688442faa4d293bf4debbe9e68741170413186924d6576a
SSDEEP 24576:k47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYYgXe4i7ojhsP5Lgrk1TWb4AN5:k47JUQj1irIhCnDHUPfF/Fe30jaNf1Te
TLSH
T1E665AE1EA3EC01D5E1BAC27885554A5AEA71782E1B31CACF12B0837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 3fbd4b6f259ece098af8a6a3b76bfde72fc614a763226b3f208f1e573b87e179
MD5 331f7accdbb0511284949fd31052e6d3
SHA1 3713003ecc040ec0c2d4bdf0715d5b7b8f0644cc
SHA512 7b87cc1167fb8b2283de845b4624c4067c3dce643e38b8321884329d01b159fefb05e4b49c358d747d1a7167992bd8b72637d942acb6a42be0007b7e3a9078af
SSDEEP 12288:7Nsfw0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:4RgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1DB55F15AD29802D8C05E92B4C3968A41F3733C9193E1C7CB53D0F93E1F79A949EE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 83d6b992088afa7b75e184969572ac2b7d87792c208a07aec09a05334df9b5b6
MD5 0aa2129bdc5be44fd76e8c023992b378
SHA1 7bee2ba14b99a0e2aff051bd4d98b464bdba1852
SHA512 00230120bc0e0bd297e9eec9f42d3d0f51c53a059eb886e5b7e60cf83b745e03ef067e607822ebd0b3038c9337c7a94d8c33b6f2c8ebd85477352d567016b168
SSDEEP 12288:fKgpTU3fgRpfIck/kBIACPEr6VFx7mQPEVQizqn:fKgBUPsk/kBIACPEuRSQsWiy
TLSH
T1203529117626CB4FC6AD40325E33D2CCAB707D06EE45AA0372C9873FD576658BAF1292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 777c3bdd2e36479ffef77a2bc55958a8bb8b488e747c5daa8d1481ab4bf5e9d0
MD5 ffabfc64898d6d0d048540e61ea38a95
SHA1 e9a6c974096111c6abae6e8a9ca93bcd45a74519
SHA512 a7e60e39fb7dfb84ebadb527e920496400f798a6f3cc0336dcc1335ad54ab56adb99509c25a1b970d98567a029f8ae6072bfe638b912b0f0357e55421860cbaf
SSDEEP 24576:5D1sC6M8wP/kBIACM8Lm6WtaoTYGw0Mpm4rFlGrGqzVNAWPSQ2z3UQ:5D1sVMzP/kBIACM8Lm6WtaoTYGw0MpmU
TLSH
T12945EA405537E78FD1BB6032072A5B8CABA4DC07B7096F22B399453AD827B15B0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 870f16e40dad1bd3cb09e855243f74136978fa4a485f74f9b08027d17ffe6b59
MD5 0f505ec6d918b4a22e644a98a3c605d8
SHA1 ce0187f41eeff0cf810199ebfb782fd53e9d980d
SHA512 dc50fbfa0091555e20eb3874c8713045a244c10c9dbc8fa2bdc7d9d7d71d8fb1e34b8b05e85dcfc059ececc2e1e58007f6abcbbf7c1c0124bcb175a296c713dc
SSDEEP 12288:XM7o0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:sJgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T11A4523629F584DC6F29BC3F090EBC760F5653EC1270089EB92D0BA9319B8CD99EB451D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 2eff3a3e665a71cf16ee746043cef76eb2b63825e14921d33a771485bcdffd27
MD5 a28896bc07b70a1052c19e135e368a2e
SHA1 4fa186cb42baac9dde59faabc8bd857ca31bf975
SHA512 160dcb1f49dcfb9df21b8e8b20a75e922f7fedfe8163509daeeaa64e07f7fcffb8af14dee699b37efcaf4756bda8e9458dde3d28e7e9732990830db63f25dede
SSDEEP 24576:1gb6bmBIi49WNNFpg1rSvFv7bYXgXe4i7ojhsP5Lgrk1TWb4AN5:1gb4mBIBhGFve30jaNf1TWbdz
TLSH
T10065AE1E22EC02F5E0FAD2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 b3cb6939aa6c34b940c69a13abf7ee5859dca33e35b9b444daf7163d69267271
MD5 76e48394a7ca2458a419c8761f472871
SHA1 8679fa4e9969b28118366bfe87303bfa860b91d1
SHA512 1296e68af01248ad08dd9a7b5802ea425dfcd115c296610d01ebcb973782bc92fc918be58efd0dc4840ec0bf0eff81d29ed0c587f64d1bce07ca656d5fdc866f
SSDEEP 24576:xG88u8FpJqH1bzria7/mogXe4i7ojhsP5Lgrk1TWb4AN5:U7ZFPqVea7/me30jaNf1TWbdz
TLSH
T1C185F16577E101F1D07BD138898246A3F6B2B8151364EFDF07A88B521F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 bbc7a339b129f73317fef9abe7e2125006a48246e18f43da3d02b086dec01614
MD5 ff90b2d4a9d456a58f12393258d28175
SHA1 a2cf31ba07a0ae1a9e3f40c2a5f3f7d65af9f78c
SHA512 4f25cb50434c944422537ec7add28b249ded6cbf52b4a84093af7b483fe13735c5693fe2915453a08e2cc657cc848eaf5c063149136b389056b82ea4bb21f142
SSDEEP 24576:WPUr+NQ8gXe4i7ojhsP5Lgrk1TWb4AN5:WJQTe30jaNf1TWbdz
TLSH
T1AE65E12F66A818E5E27AE17C85828709F7717852131196DF02E0817E4F77EE8BD3DB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 f26dd9e51276f1fd72a68314fc34f76ea24cc5ea7bd804fab8789043e38b6933
MD5 568164d76d5037a7a41e99e4a5c58c8c
SHA1 ac7a97a2d28b1c9be63a2da14b6f4ec0da791409
SHA512 01836cabac6ea14c571088b762286918bf0309fb90403976322fcf9a8304cdd2e2293cdfc68744b166401299e77b61b1e25848a02332d7a33564f8233f298969
SSDEEP 49152:1BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjDe30jaNf1TWbdz:+G05lO43bwU023W
TLSH
T109D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e6941ad7c3ce78cade56afdafd9c64412ccd47e3ed7e9b48f75eeee143e268a1
MD5 f4d60f227fbc0822f7c0ab27d83552cd
SHA1 c543215b4165841c98a4b19a29b44dd435c8d9b2
SHA512 cac66823bc961e1b3ecf208fafb8c5ac1e74ee1e482ddd6b113fe91995c8dfcb59e77b79d806e012cce5cec92ca0e95fc9e899bc7154597edb508e81dc949930
SSDEEP 24576:1fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnigXe4i7ojhsP5Lgrk1TWb4AN5:Va5POZ3+Jt2pasx2+m7e30jaNf1TWbdz
TLSH
T1A365AF5EA6FC01D5D1B9D17DC583861AF5B1346253319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1c744718020c07d956bedea8741836f6742712157450555b1976d05ceb2d0259
MD5 9150424037fe1468bf895f44bda8be89
SHA1 e7ae59e2a87e6bd65fcf9eb7791dd592985d7ca2
SHA512 b3a872f88afafb287805d52954a66119dc875a7ced153a2ab5f0c286832a24f061e6d867883655a736b0106574930622f4b5b2ed86768fde605dc23f52a9ef4c
SSDEEP 24576:1NcwHdjbyQ4nLC18lb/EOjowL7FkwgXe4i7ojhsP5Lgrk1TWb4AN5:1Nc/zEOVHFGe30jaNf1TWbdz
TLSH
T1AF858C5623E901E4F1BBE1BE89779646FAB1786513308ACF0291851B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 eaee5329166b758a7c074fdfd1fc0f061630d6cab5650d93106ff2d47193f276
MD5 7c5ab6ed83058ea459f23f2a116ca753
SHA1 fa4d5f903d5fb23b7bd09c8221fe6aca98529b2f
SHA512 edda57b05c9ed7462c57ee9f5fe5cdbef9a519bf2ebfbfc715bb4ca05bc45035b60b615826bb75dd22662a03dfe746849f61264d3877451b7902d7d061a1bd47
SSDEEP 24576:L8kNvNnaFeYhJNtmZBm2gXe4i7ojhsP5Lgrk1TWb4AN5:L8MwBtOmZe30jaNf1TWbdz
TLSH
T14C55AF6EBAB806E4D1FEC6B4CD238512E6727851173293CB5290C13F0E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 905761125da12427ac1089daefb3b54f917e50428d42b5615eefefef2fc25014
MD5 914de7030923194b60f9efd07c2f6c76
SHA1 eb14cf41384c46d017bf7ea800dbb33f5d90d95f
SHA512 3dd676df7f5814f0617b3ef84d4b30cc3508c9074737583986554691e134e60ace77a212d1247e8c625d984f2109329bb277e372d635bd3c3885dbe65af650e1
SSDEEP 24576:sD3FHshBIYQgAVgXe4i7ojhsP5Lgrk1TWb4AN5:sDVHeBIAAAe30jaNf1TWbdz
TLSH
T11975E17EEA5C04E4E57BC1BCD6A38A06E77138A9032156DB02D0D1B61F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2044-2-0x0000000000CD0000-0x0000000000D37000-memory.dmp

Download

memory/2044-8-0x0000000000CD0000-0x0000000000D37000-memory.dmp

Download

memory/2044-0-0x0000000000400000-0x0000000000610000-memory.dmp

Download

memory/2044-27-0x0000000000400000-0x0000000000610000-memory.dmp

Download

memory/2556-128-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2556-31-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2556-30-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2556-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2608-51-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/2608-53-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/2608-42-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2608-43-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/2608-55-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3032-145-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3032-146-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3032-152-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3032-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3940-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3940-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3940-330-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3940-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3940-99-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3940-93-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4580-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4580-22-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4580-13-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4580-91-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4624-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4624-315-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4624-114-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4624-110-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4624-104-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4808-314-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4808-116-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4808-118-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4808-124-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5176-296-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5176-58-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5176-59-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5176-65-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5416-70-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/5416-311-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5416-76-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/5416-78-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5508-138-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5508-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5508-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5508-136-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5508-130-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/6024-82-0x00000000009F0000-0x0000000000A57000-memory.dmp

Download

memory/6024-81-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/6024-87-0x00000000009F0000-0x0000000000A57000-memory.dmp

Download

memory/6024-312-0x0000000000400000-0x00000000005D6000-memory.dmp

Download