a57d9c3b271e4af700f453d130408b30dba17f795252f42b0bfab8fc04c3033b

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-02_e52a026472c1aee67d4df0ae7b4930f4_amadey_elex_lynx_smoke-loader.exe
Size 1.3MB
Sample261102-yncjkawyds
SHA256 a57d9c3b271e4af700f453d130408b30dba17f795252f42b0bfab8fc04c3033b
MD5 e52a026472c1aee67d4df0ae7b4930f4
SHA1 d4343b4e345360bb9a7cb52145132329851ac7ba
SHA512 0288f01b50d86dccea7f13f46643620407c1635e41966392562e76557825bba084cae884adfe75c26b6138ba0d1d40ece732dc9ae12af5d5140586d0efa03cdb
SSDEEP 24576:k4ZZQufMz4MMMMMMf8XB6D+InjioCsqjnhMgeiCl7G0nehbGZpbD:kEZQUu4MMMMMMf8YDtnNGDmg27RnWGj
TLSH
T1B35517D195C38CDBD41A0A316474D9B7142A3F246B74A3CA2EB0F5B95ABFEC13F12816
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3584	elevation_service.exe
4488	elevation_service.exe
3560	maintenanceservice.exe
4344	OSE.EXE
5728	PerceptionSimulationService.exe
4716	perfhost.exe
2840	ReFsDedupSvc.exe
4352	SensorDataService.exe
6028	ssh-agent.exe
3516	AgentService.exe
5840	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-02_e52a026472c1aee67d4df0ae7b4930f4_amadey_elex_lynx_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c88984f7612dd39a.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-02_e52a026472c1aee67d4df0ae7b4930f4_amadey_elex_lynx_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-02_e52a026472c1aee67d4df0ae7b4930f4_amadey_elex_lynx_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-02_e52a026472c1aee67d4df0ae7b4930f4_amadey_elex_lynx_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_112109\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-11-02_e52a026472c1aee67d4df0ae7b4930f4_amadey_elex_lynx_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_112109\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-02_e52a026472c1aee67d4df0ae7b4930f4_amadey_elex_lynx_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4556	3808	WerFault.exe	87

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-02_e52a026472c1aee67d4df0ae7b4930f4_amadey_elex_lynx_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000def64928046bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004189536a046bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000079730928046bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ee4f1828046bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000032ac806a046bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000061534328046bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000960f9028046bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3584	elevation_service.exe
3584	elevation_service.exe
3584	elevation_service.exe
3584	elevation_service.exe
3584	elevation_service.exe
3584	elevation_service.exe
3584	elevation_service.exe
4488	elevation_service.exe
4488	elevation_service.exe
4488	elevation_service.exe
4488	elevation_service.exe
4488	elevation_service.exe
4488	elevation_service.exe
4488	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3808	2026-11-02_e52a026472c1aee67d4df0ae7b4930f4_amadey_elex_lynx_smoke-loader.exe
Token: SeTakeOwnershipPrivilege	3584	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	3516	AgentService.exe
Token: SeBackupPrivilege	2840	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2840	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2840	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2840	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2840	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2840	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2840	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2840	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2840	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2840	ReFsDedupSvc.exe
Token: 33	5840	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5840	SearchIndexer.exe
Token: SeDebugPrivilege	3584	elevation_service.exe
Token: SeDebugPrivilege	4488	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5840 wrote to memory of 3100	5840	SearchIndexer.exe	103
PID 5840 wrote to memory of 5372	5840	SearchIndexer.exe	104
PID 5840 wrote to memory of 5516	5840	SearchIndexer.exe	105
PID 5840 wrote to memory of 2444	5840	SearchIndexer.exe	106
PID 5840 wrote to memory of 5848	5840	SearchIndexer.exe	108
PID 5840 wrote to memory of 5940	5840	SearchIndexer.exe	109
PID 5840 wrote to memory of 1164	5840	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-11-02_e52a026472c1aee67d4df0ae7b4930f4_amadey_elex_lynx_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-02_e52a026472c1aee67d4df0ae7b4930f4_amadey_elex_lynx_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3808
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 532
  2⤵
  - Program crash
  PID:4556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3808 -ip 3808
1⤵
PID:5060

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3584

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4488

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3560

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4344

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5728

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4716

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2840

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4352

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6028

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3516

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5840
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3100
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1704430598-3087477806-3297458608-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1704430598-3087477806-3297458608-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5372
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5516
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2796 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2444
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5848
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5940
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2796 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 dafacc32ed830318536ec07dfd13c34424e398b3eb8485597470b17133638c2d
MD5 3ead0f4fdd057d81384fd3ab4e3ecde0
SHA1 e17105b4540ea93e0d9ecced5e4a104eef567ad5
SHA512 4514f89bb1c1d6d61ac4df9fd461760026428714de4827a7f7f8eaae41c8975ef3e9b0f9c9c3124ef9bb8826929b43965db169069561d62e19a23622cecae348
SSDEEP 49152:vb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnWDmg27RnWGj:t3q6mjB9D527BWG
TLSH
T1DAD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 3a8280fc02288ecb004645111c2a59e19228c1df6b34a5ac116be96d22489037
MD5 44f3348cf7eaf8f696cc3f85e16e9323
SHA1 1ca879f94f0b9107812f479a06502d3f587ec980
SHA512 21f8224f0c1fb45bb28ee5b08c781ad079e3ee4d312daf39332aff07ffc5df78b25fb9d2c03a76ef5857a7628ebebba94475d2e6f6192e9bf78423913d0ed768
SSDEEP 24576:6XYfDtczANsqjnhMgeiCl7G0nehbGZpbD:htcYDmg27RnWGj
TLSH
T1BE650129A3E408F9ED67817CC9A2C506EA337C554760E6CB03E499795F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 e422646540ff0d50b32ef029e5f0ae5ea9ac0dfc4e16174001dfaecf40224357
MD5 f23036ff6752365ffaf32cda70911a93
SHA1 0ccb4250512bf110ee5eedec269fc731253173cd
SHA512 fd8337e85ce09f5b1777370d5f206ffe3c701eb7ec32110586f20a661bb7450effca3d9a69d5ff3db86975420abc843efdb0bb7bbea92d7a0b04a5a8d4e8406f
SSDEEP 24576:A0Le5ji0hmxhrM/sqjnhMgeiCl7G0nehbGZpbD:APji0AzeDmg27RnWGj
TLSH
T1CC859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ba5255fe52da425f37163d1ead301e9f577af05de1b0344184bffa5051fc1343
MD5 ae24bdab8644855d2ded5262f4e7e48e
SHA1 4fb31365acd6ed38947624b5a917f5e897523f77
SHA512 03697bc3c5139b55d7d1e6e5532327f30f8e238fb169dc3d5f7efa6cf5ce006ae3b016998fdae12440de65ef67f81c233ab19d0bc0dc402358cbf5426430d6ec
SSDEEP 24576:Za7/ezSC6vUyD/aqgrvWj6q8wyuBsqjnhMgeiCl7G0nehbGZpbD:I/ezSC6vUzPv+HjyKDmg27RnWGj
TLSH
T19D755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 becaea2f3d0621b2e0e7e7be327fa2fbc462b611c17221dd80400f56623ded96
MD5 5f6affeff287a5f663e62034a8455865
SHA1 0e2d3006f02c928892126bad7a09aec164df6e84
SHA512 89db81ed1b41e9414cd425f645517570f834848234ceb6e1bd9776b2d62504d636bafe9ddf4e8f732105d9c7084e9271514364e2a7d92ad44027f2a9b3afb830
SSDEEP 24576:HVbqPb88hv/l+BAsqjnhMgeiCl7G0nehbGZpbD:HVO88hXl++Dmg27RnWGj
TLSH
T140559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 8d96df39f3b5edb25f3f0277d566424757de53cd2d56182c0ba29d9e969143b3
MD5 386513002614b665ac9f3236bf039b98
SHA1 dc2c19e75203d759c9bc64d0335b8bae3be8658e
SHA512 02ca137be71bbaffd6afecbf591d097c8f8cd4abae06c949f85eb4c16f33e0eda673bb3faf36cb7d6a592694c427cd5e72aebe0ac42f4b92d3ff90a8652bb0f6
SSDEEP 12288:QGzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QGzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DB4523BB874C50CAEA7708B5C3E9F51EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 72da8ad7644bb7a74bb17b9a84db1002dc1a373c893f1b7a3e1dcf77c4d2c7bf
MD5 788a481017a212ce807ee4f0c6e250b2
SHA1 c05916208178177e41a736733663c935d7dec1d8
SHA512 cd1b81300ace86a03bd398fb51fd23c2c55de81aabe7c4a7027ab9fdbbea4d3a5b8d00534ccdbe8b8ad05c2a81e4247c083db0dad29dedc348738f77d3f92062
SSDEEP 12288:6eBNUbTVO86UIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:6JIUIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12565CF7BEE28FCD2C27A8DB85791C600E76278314B6193CBE165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a3ab88ce7a3b8e95a327ba4d51b2ef30a8b9dcad649678be033e121615842326
MD5 452a0749b6d87f5abbb1dc468b94f6aa
SHA1 a391c4c3312aafcc72b40224b12e62ae69ae51ca
SHA512 7b5f2ed30a2f04a66b895eb9193a512a4c656c630cc78ec9c592e63d57294e667747298ca6e4fb56ec206d940537a04fcb97c33adcfc5d93410bc611acb4c3a0
SSDEEP 49152:GQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THn:GQvGAdlCEL8c/WRNw5ClD527BWG
TLSH
T1B2266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 4dc4ef0d5f3b6dfb16fdb373288b3724f1eb73afaf4e0e259b306da78bd7bf7b
MD5 3f376c05395f08a80a69c61ecab4fcd1
SHA1 35e11cdff04e58e7ce9f4d78bf2148d67b4ad22a
SHA512 623f9ccba1dc4828ba071f98e4d1fbdda2f3b8577c49091b34b6df67e4facbc53fd2038b4b1afcd57172086b2817d56e13394d48a45f2b28bf2f38c4b03518b5
SSDEEP 12288:+AwSfxL/2Dc3mDLLmt0LDQewsAjaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:jfewsAjasqjnhMgeiCl7G0nehbGZpbD
TLSH
T10D75E031FA74E036C77B0DB20B36D71A582D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e22278a4d7ec1c2ccfc5681acffbd5e657323f904dd146352a44ef589bd4ce76
MD5 da2e1e9875a2cef4a3f0e99a6989ccf2
SHA1 9dce6eb39a19e17403643893fc5a793afc74d3bd
SHA512 ed08fe3dc9582ac7bfcd282feb0b466cd6cd6ccdd30fd7217fa5dcd201c6166547ca0394fbec74576f12d82d8db99b620025d3fdf1bfbce23cef9d68046842b3
SSDEEP 196608:pUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHWVQBWG:pUEtQevvqc2W1cpV20I32pB
TLSH
T141474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8b10aebbc066f6c060346cd6db298f3b97bd384d8326490c1d6f65e48fdf9266
MD5 cc8d15829a2f9ed12bd579e61ab350d2
SHA1 3ebd56580c4bdbff304382c605551ca6b84ea350
SHA512 dda22ee088a47632070e984710f7139759d75bd33cccac9101da2cd557dd8a55f68b91ec471282e5731509698ce4b8d1f532c5da475a63bbc41641fdd4c81692
SSDEEP 49152:iCbRquA/m2yL5zLfFiV+XenmE3/zODmg27RnWGj:noq2VjnmxD527BWG
TLSH
T1B1D58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 35e66940b27d83b909c8bbe5158cb040eafd2197265057adc06baeba693838ca
MD5 dd5b3d497962feba096fa1f961a3918a
SHA1 a848e2b24030f0c4c3cb6a06ea987193d26a9e3b
SHA512 161316b8182d4b235a5f774a1499ca30c07025f0abdf3513e6fbcfac34057911daf9c1d4e1852b9fcb2c000273d7ae15ed0c817ed949851fce0701e0b49090d5
SSDEEP 24576:zAhGL6IFoiwtA5l7S53tsqjnhMgeiCl7G0nehbGZpbD:zAM5Foiq5BDmg27RnWGj
TLSH
T1A2359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 b38de8efce69d7a8a36b08708d66ecb81ab48d5bd1e31c2dc0bbe476d6a98edb
MD5 3d0ff5dbc2aac0a246f562fcd45abc1b
SHA1 d98c5f167a08285a36c11749cc891c853cbdd03c
SHA512 5899b4a916e310e9ff243863a4e907ca7f92e0a2f0e164a91e711aef317f6eba16a3c557ac8fc9770c8a67946745c6fac3dc75d51cf801a6b4c4fde23a907cd2
SSDEEP 12288:Amw5HEjsChNEBFgl0WDm+ChXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:dwuROWmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DB65F15A76A80CF9E9674539C697D136F7B3BC122A20C71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 399eb917a07839670d92b7bc5fe6c77bec88e51a57751f1a254cc227ffeeba1b
MD5 32c9ca143604602967b3e7b6ff55d137
SHA1 e356045ad48ab31361a3bb70d98388c6e6fe5945
SHA512 ab0ff23955285198879f983cc47d4952c7408fdc9804131476e59d646ce4a2106ec66ccbd60ff132f7bfe7cf4c7abe3ec4e4577cfdf36cb73916aab83e095985
SSDEEP 12288:tyZ1IyqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0ZunsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15D5512AA239820FAE563417CC5E5D609EB337C62673003CF166255AA6F73AD44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c72ac3c5df25432d21d90c3c4deca7e14f1ecbdb9245e8a73098198d730894ac
MD5 6ef68781848802bc2e85160a646c0dbb
SHA1 f151a5425b095184bb8161a8359b454f8820e03b
SHA512 63da3ff12ba1c3853463aaf89ca7d91fd570b9e94dfee9aaf7797b35ef212acf019ed696630489e954c0a9ac9d41c4d7f04fd7685d32d07b049039c9794fbc74
SSDEEP 98304:qQRQyi36YOcPDLvw2gAf+PN3wD527BWG:BQyiKanX+PNgVQBWG
TLSH
T1AB667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 482d1bf495abfcd796aa82f76ef0f7ad3be813dc720512206a76899d7156e117
MD5 692af1524d9241da149a38aec0125dac
SHA1 1cfc9ad867a7fc7ebc3df0a94768c4aaa99d3560
SHA512 15650155163da1a96b4970937d37f81372c60abd2ca191b750a3ff3e9c213aa90015f064415444794fcc1bd1d88b1f1dbb9c79b515599f48d605c983066c598c
SSDEEP 98304:EQRQyi36YOcPDLvw2gAf+PN3wD527BWG:LQyiKanX+PNgVQBWG
TLSH
T1E4667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ff921bd3a8d2b9f8130a1c08eac90bbeb23b13df831d50b40d980d43e1029265
MD5 88a9af046a38c89109c78b63767c0985
SHA1 bc33b4277ef5958ead6fa92a696a0c1c2170bc49
SHA512 672b8417310f950813596899b1c80a30cab64b4bd142675d4d9c34f2d857c622cc83f5d6a5b35ba8da0099a7c4c6a873e12b991d32a4f0a3d072b483eda47904
SSDEEP 24576:ZwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0XsqjnhMgeiCl7Ge:F68Qg55nhkeWu7PNU3/eDmg27RnWGj
TLSH
T101B55933B2F60099C44DE1769F4A872196D27C758FE0E3DB8511721A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 fb24e50d0308cbb7373f425c4962930a30edc322daeb7a1d715af9adaae4235c
MD5 5a954ddd7fec768abaa3dd3dafb09308
SHA1 a4b362946224a88e5352983010763952d9d72ae5
SHA512 1ef7b5bc403e055fc8afcdea42008c5e3e63a20d4f2f103fa39112fcabfa5244147edb097a098765389cda60e09548ecc90c4547967d55ed562a7cbe05c5c6f1
SSDEEP 98304:ty5112gYy5azzVvU69nLKnhZ3D527BWG:QLIHRWh5VQBWG
TLSH
T141167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b362b0e79b354f20f7bdf0e34e1bab01f813c5ec66bb700235c90296ad6c75ed
MD5 0657eefe9d951bb2a305c52c1b5ee94c
SHA1 be1cbb0774a30bc46b186a81e78190d16124f7a9
SHA512 d5bc82b92061703671d02cc5cd515d4176e49a49f6860d39111e081222825f9a0a53941e73da18a732e63e4bea04fc1914d83b1383c6018b2ef24a6a0cefd187
SSDEEP 49152:QB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glBDmg27RnWGj:Ku6JmIxd2dBD527BWG
TLSH
T19FD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 93ace81f6648c8edeb6655de21b60c1e5e75baa126afe70a53062edf8681cf58
MD5 2ac933cbfabcbd930a8271f5adbf7af5
SHA1 d6c6cc76a1fa7eed2016712bb77fbc6ed71f2d43
SHA512 d53d821e916ac80f54b91ba2b283508032d9700015571cd66134aa9813ca600296252689706e30acc7506f153db9cc4a9afec497fe9a2d823ec8350414b8145d
SSDEEP 49152:W1hpsNoJpF1A67U44CwH7R4xUDmg27RnWGj:WmifPqRxD527BWG
TLSH
T103B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c2fcd4246964f0220cf6bc7ee0ad2492e1b4e739929050a7647a1303ea72b63c
MD5 62b357e90dad433f0c176562864bbf09
SHA1 858f167b1549b24c64b32841ddd20a092f4d0cb0
SHA512 b4ebb4e26fce2d9d6575d040d25cdb9e6484d415e7c1532f7b511f9ec06897b8facf6e365555df30000080d5b4bdab75b1c30d4e8a5c096c8473b34a8d20edc4
SSDEEP 49152:vSuZQIY0Be2KkRVtOnks6NMHq7Dmg27RnWGj:V5dKqi617D527BWG
TLSH
T146C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e279a41b73c3f53b2211dc486adbd20db096354a06b40b2342b09bc5a01f9cf1
MD5 e9fe41f64b0e34702e86d44ea01d4b47
SHA1 9c0dd981130f21dd75d6df8cf5df2109c12579a9
SHA512 257548c5eb3a85b2d5b83288f85825eed5e535dcbb3d1b1e29172fdc12cc8c1f8b896ca31c8c25f853d442dc5726900cb26b9c4ea60f743347ce6f3190b8454e
SSDEEP 49152:HhtSn8EApI0figjgiDn0AP5wYDmg27RnWGj:WX2iWphtD527BWG
TLSH
T1BB95BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 a986f34b2f2d4f6308ec40271dccacaa5d120eb20cd7ffb4a0fac5abab3b8c01
MD5 ca110f46dfe406ff11d9511e14b616dd
SHA1 4aa97fa588d3e186594f3c778bc096f07bf0a1b0
SHA512 368cf80041ee7cad150099155af1949e51abd280072eded20ca2d20870b5c3b6e94c898d8c67f5516a71e7bc71f0c4985899d461e2e76f9f09ec4595af7ed9e6
SSDEEP 12288:kbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1214523BE965C41CAE92248B5C3E5F14EAC073E5BE92004837A577CBDEBF24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 a8d477006d35c0a7261660700b16a9eac1c91329ad6699a621ba32df997f4447
MD5 a82ed6010e02259122697892a14d7dbf
SHA1 a2e30dfa338769328ecc3b8edc74907522b33696
SHA512 b3df9fa8434a3cd65e9127df204418e62834e9444675a241d9bb1c24d8d988353559e05310a7d8e7e9eba3fcd56451b4dc1fb3c26d4fd497d7ae94c614aba58b
SSDEEP 12288:meXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1434523BE965C41CAE92648B5C3E9F14DAC073E57E92004837A977CB9FBF24584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 a4565acde318cc7f646f021c04fb5d36870b159c6ab114ae634f861ec912e2a5
MD5 bf438ac9f2eef79f0d4e80016491e6fc
SHA1 b3094efe2f1ab032cb167b23841330cc7ae20c11
SHA512 bb7f6bf3cdbaf64e9185f46842fdbdb7124ac9514d6e3cc2fec9c2fcbee4a49a4f526cbbd258a4982df18e357dc2fe8b6ea100cdc9e085f2f27338973e7c0c6b
SSDEEP 12288:gwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14C4523BE965C41CAE92648B5C3E5F14DAC073E57E9200493BA977CBDFBB24584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 2811c2ad65f9c98132653cb0a768925f1b17523f85843ee0caa7a2f6f0f0bb6b
MD5 5acf1e72db87fa81d8cd12d3ff103843
SHA1 795a5d7076d31ca22302ed3ad63fbbc5e9a3b84a
SHA512 bcc551f858502b9e9f7d1b3cb95ae16d076eac36b93b02b8ac2bfee127d7f0c43d6bb0e4badcbb1d28aeea85aba290943e691600579eb18ac277a73894524435
SSDEEP 12288:tVNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18445237B675C00CAD83685B4C2F5E11DE8237D96EB3005DB6B532CAD9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 f00880d0d5c56b0507b7b07ceea3eb884f4da8bbe781e5c19a0a70343a157279
MD5 30e87b01d84adf5965ca5077436f6e76
SHA1 5f512bd574c021a819fa0996b7f1c6d82aeb207c
SHA512 4f565a847f835ce3a39aa1410aa184c18ee70b2f2ceff674e8da989ae1704fc2c1f50c87fee9f5a07c5a226876a82b432c39c83e7eb919aa30cdfa7b04df6a10
SSDEEP 12288:wlXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wlsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18A4523BE965C41CAE92608B5C3E5F14DAC073E57E9200493BA977CBDFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 1f83328c45041d335c137ae7a7fd2e00df511b869f5501e2e6d93e68c7909c8a
MD5 aeea1d60f0205a89a4d3636d24e33d88
SHA1 ba7b217971bf59017dd1cef1ed003af067a0c9dd
SHA512 18a2e47e54384b3732df5e1bc895f8ef12e88f457581d77389d340223341fc3c55e88474db5538af2dd77d9f765bbe1b8a62e08e3bb72aa95886005e4e7192e3
SSDEEP 12288:NiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NisqjnhMgeiCl7G0nehbGZpbD
TLSH
T1594523BE965C41CAE92648B5C3E5F14DAC073E5BE92004837A577CBDFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 09928c397c72651205a96c1337b34e8f4f53ffc5d868d3c7c95f68b138de8308
MD5 54988ba0f99de1d442b950c8b4e42338
SHA1 d674813200394a3e40f5bba7f3558e7529d08f0c
SHA512 8a907290d7df1f17667327d5d4ed723a0b7da4ea0d599b6d5cd57a97b120c24074f783b6c76da4bbdfe4ab797e9aac91d98e65327c1e6d0e1202206b635f0699
SSDEEP 12288:DWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17B4523BE965C41CAE92644B5C3E5F14DAC073E6BE9200493BA577CB9F7F24684B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 7e9999c267eb206d88be69c91701f0046a32349741f369b6239387b9352fef35
MD5 c42c42533d3c4e7b2c1a6b3386781639
SHA1 fc90d554343f8945717d8e54032d1880b436d2cf
SHA512 85f5ff34fe438e2310ec44348a85a211b2a08dc0e3d2745fe50bd4a1e11e49450ab8b75c97e6d2863bf43428ca6890fd62816f94ec418415b8d34aac40c0cfbd
SSDEEP 24576:gZM3zFVSO+sqjnhMgeiCl7G0nehbGZpbD:gZM3zf2Dmg27RnWGj
TLSH
T1726501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A4366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 2aa9b500ef496a4bf20cf417600fa9199d37b09716d64fa1a943764412bede46
MD5 12edd20f2b6ee011d71967241a16deab
SHA1 e29c9dfd540f679bc3a9def0d91fec7226b08acc
SHA512 81de3035226b4962dfd72224e81c29ab3cd03d1ac4317f3656fcf92e776079aeb34ba8ff74d0381af72260cef2dbcda8d19b8598e32d99c228f91b1687f0e0bb
SSDEEP 12288:43Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:43sqjnhMgeiCl7G0nehbGZpbD
TLSH
T17D4523BF955C41CAE92608B5C3E5F14DAC073E5BA9200483BA577CBDFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 61f8f1b8cabf6262393c138279875f5639c5a7662510a704861a4de6b2475884
MD5 0a12b91bc9a51386e34e6f1508b55663
SHA1 2af5bf767a699a572865ad24bada5690e0540f8d
SHA512 3ada0798f3e378317d8d824d337d3e7145cc097dd26f406ae31a4aaee50a60f895a7c3d529a1cb12fa1ecb39c7fc652d621f525377e3eeec2e7b724f7f93b9c2
SSDEEP 12288:aDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:aDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1484523BF965C41CAE92604B5C3E5E14DAC073E5BE9200483BA5B7CBDFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 54b8d9884ff536e66a75cd837be164c026f8e816beaa88cb498a7f793ba6f453
MD5 ca303268bd7e9474e4b6f33f4834052b
SHA1 86d23f2fa0b0c419e0e9339aa3cde295011cc774
SHA512 083e2795a37bf7578e63b9dee44a8f3ddc4dab18926ba4527d32d9228538b2f16f7cd6917d3ad81d08cf27f82e11079d9198f5a0c52c7da6978840ef9e5f84b4
SSDEEP 12288:dyPz5L8qXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UzyqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FE55025B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 9833dd3ecb3428edefe0f2a10e0d7ba56f20dfafc6d307b7e310cd58f9f8857e
MD5 68a58d667adda4fe0df8912a8a7ba37f
SHA1 0d28e1ce31e2d9a1eddbc46599160051f284e233
SHA512 29f2a4be9250490f048b03217789cd0631085972cefe5dcc3d37534b1cd2be10e2e1e1a6bf8e9696c592f4b34688df4c9e3c0ab5d2e0f9d021c5edd2e2b3e526
SSDEEP 12288:f3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:f3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E24523BF965C41CAE92608B5C3E5E14DAC073E5BE9200483BA577CBDFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 7882fdfeb8ed1c814f470126e2f9b2e8bf716f8d6af97cae6118e408e0f15e33
MD5 51494a5ea587315fe0440f1b84173d90
SHA1 50bf4906bd613f3e28b26e20a1a22efbc1dec145
SHA512 8f6219f1e7fc09754c0707e9a7d391c5ea67a72816adaeb278bb41f693a124586c28bcdfa056b2aebac12f53d77387d96adf8babc3158249b7255c3e523ad0e2
SSDEEP 12288:v3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:v3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1604523BF965C51CAE92608B5C3E5E14DAC073E5BE9200483BA577CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 699002b049464642b70e5e55966f971f84cea117c5e47f9962621fe7406fcc7e
MD5 7f67f6d9cb3d094884731353dafcefdf
SHA1 829aee19354a7176885c776b06a531f46e2e0ec5
SHA512 187adf30d18094fd7c81c30bf875ed428eafa036027511dd03528b7d8edf1f4b7786d40355edc9424562c39aeaf08042cd48c0e0607937a64845e4cc1953f7d4
SSDEEP 12288:0yPz5L8qXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tzyqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A655025B73A530F9D1378178C5A29A06F7327C3647204AAF17A416BA6F736904E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 29ccd1c604d4d87f0f8e494fba3d1795437a878d093c07c75e47e7fb6d14b114
MD5 5bb337c227ec9130d55bf5ace5d0378f
SHA1 6ead464cd6de7ae77ff620d549c9c2f438e78cd8
SHA512 b9fcd61c72deb3e9f09f401100ab6bd519f5afcc1c393dbaf1d8fac1345e285e830e44c34fafc3bc8137b342257efa1218072cbd13d72414094b550f30c1572c
SSDEEP 24576:3T8aLl3z0zDgsqjnhMgeiCl7G0nehbGZpbD:3T7LljVDmg27RnWGj
TLSH
T1676501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 7b5431f66845a61ee635c2bd17bd1241a06a0941fd65c7b26275ba4abcff7a35
MD5 380f359013b387142a3a07e1cdf66a94
SHA1 dae4170e67daa7ece310cac18811a261b6052b5e
SHA512 06a941b925f3e61fedfa85c7c6e4c811afce8186661fe79b82b78ad3636815fbd43e553b22ecae7189e7a6d96d2f42faadc33fcdc9149f90c3d5882d59e4f106
SSDEEP 24576:s3rd9CHKy7GZ0sqjnhMgeiCl7G0nehbGZpbD:Wrd9CHKya2Dmg27RnWGj
TLSH
T1BF75CF90F3E810E8F0B79A35C9769511D9767C5A5B30CE8F13A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 c21abbc8b5d1668852a3b88c57f9fbccada9c14cd990ff1885d5eabc0e868b84
MD5 a157dfbd3a31708b7c7f297b1d219c24
SHA1 5efa7e2767f1ffd713723c8a079a0c698bff736d
SHA512 bb946913bef8fec54b168446ae493146782b04820f2c4e2b91f3b6a5e55847acc320c9b6818daa4bfc153c957d4e1e97e05ed0892df591c58903b7a0dd715f8d
SSDEEP 12288:bQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1494523BE965C41CAE92608B5C3E5F14DAC073E57E9200493BA977CBDFBB24584B38463
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 f93e0a262e5e57146b0cd9a34cc62d577aca14e35c9a141655d136833aa174ad
MD5 44212632a222740e41f9297080602b66
SHA1 349e7aed501b5919112b3d5cb25e26d8f2edba5f
SHA512 e91314e9847f84997b734b5b8e165f33ec49db9f6e824fbea3ae9d50447870aced6372aed712b472014e128304ea31dea6c3fe780ea92870bc30482223355632
SSDEEP 12288:2KXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2KsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DE4523BE965C41DAE92644F5C3E9E10DAC073E57E9200493BA977CBDEBF24584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 33c644ad0ae67d406706412c81ffceacde198e9f343f3221e857a499921a128b
MD5 39ba241abde02622f8804be6be8ecbcf
SHA1 b1fe52e161bd0ed6d16b131dd4c43456f791ba14
SHA512 bf0b560c332e9592bfa167f7760dc87a15c86fb26e4efc992172fb5da286f54a25a14d5356dd45928a4fc233ee181b41c42744f6350006ac765955080750b435
SSDEEP 12288:L5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:L5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FD4523BE955C41CAE92648B5C3E5E14DAC073E5BE9200483BA577CBDFBB28584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 24b65539a0eb74027ec7fa33fc492be0505bd5d308408ff1ab81b22a764ae25e
MD5 b418e89b917b0a6e6f70cc875d74c4ef
SHA1 30ecf2542330373363ff571b395937063a30c157
SHA512 2a5219f5ff0332460fe75e3fa6dbd3d8e1c797ed7983675aa9e6756bebc833c77fe9d7e2933e605ca2b7b2e60fa020756d2775c77bf52d22aeba16dcd06606ec
SSDEEP 12288:M3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:M3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D64523BF955C51CAE92608B5C3E5E14DAC073E5BE9200483BA577CBDFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 43fdc1ef2bd6c73b4989c7b3a38b662b6845736fc1ef4a29cf3076c796e2e9b4
MD5 864dd40658d5dea441f0c53af736c78c
SHA1 ed72f84ab3918fdfb5200b6f70bb377e81fc69d9
SHA512 61d1f18a4c33b0c5d7b310d424db51f88c696a5de7034aeb8430e5c5492cf8d116b0c43fed0267c8d95a35eaa1d035ff2c0b543567e790ea7f349a54f197b396
SSDEEP 12288:dQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1424523BE965C41CAE92608B5C3E5F14DAC073E57E9200483BA977CBDFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 2ac5a37dbbacbb6a00103c912c18fa707ae84a0f55ca859c47f5a1e409e0e221
MD5 65fab62e148eed087c96b5a3ae07d96c
SHA1 572bbf6f6a080ce5700c7b52196ed2511934e7d1
SHA512 7f074846fc05950ae1ef6954dbf6a6ac215f2cdaa9906d7b0831f95bcea25346555f13a0515508eb393192d00378f229ab4a46dd3bd15ed2ef9e878915b9cbfe
SSDEEP 12288:3vXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3vsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16E4523BE965C41CAE92648F5C3E5E10DAC073E5BE9200493BA577CBDFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 8ee028cdd602129e7fb08e234029b12dd3261fdde5623d0df5b0eb8d41beee8d
MD5 1b9833645590d961dd79f622d961737f
SHA1 3c85982e02e1d8613203d6454e0b523219fa10bf
SHA512 01bab72905c283bddad6a6b866b74dbb73015dee13b76cbc397875356bbf254dfc3b3f67105cd20ae32aa7bdb16443945afe93fb82e4e8a43252c69ee89d811f
SSDEEP 12288:HlXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HlsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F44523BE955C41CAE92608B5C3E5F14DAC073E5BE9200483BA977CBDFBB24584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 c03360770a8fce79b5c9aac3b4b6511dbfa7003caeb2e92c477ff80d5bfae291
MD5 f14fcfaf6cf51043deb55484e4bc72b6
SHA1 b62a0f8da9475f1a59b10f27d7507e393c52e7a7
SHA512 4d5c687b22e66e98442e5708da428f0661f52b840d49b098abf849159d29b2f43536ad66d54181fecfcbc64ec0a5ca2ea06705e3d0d2718a4dcca5365b30f899
SSDEEP 24576:Mfwvzk9RX6wkyAITsqjnhMgeiCl7G0nehbGZpbD:XMnYIXDmg27RnWGj
TLSH
T1FC85D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1a237045366383d5b7d3af1cabdba42bf58316aad0562f8c710263888a94121b
MD5 0086a007e59f5d3bb69173220a92370b
SHA1 04a105bcab831da508c8f81de543fa640dc1ab78
SHA512 37460c38f852c32562886e5e386f86316dca8afd7e007cf9b07bcd3d262cc5e4742176671a849a7f7e14471d4fab3e3236d9f9bc66e31143e5cfa52d48a4c475
SSDEEP 49152:vYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK04Dmg27RnWGj:SySzPQD527BWG
TLSH
T15E066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 471778ec968ddfee4e8b123f94845c484ca2efb23ddb367c36a56d3b68d1be94
MD5 6d67c367242b722242f40a80c84d5fee
SHA1 5c25dc6d199ebd5c375bab917d968bee2eeee6ad
SHA512 6834529fb90f1a2360dc83ba346d76a84b12e209cbfa5113346b5479bd6c190a360454e900869702f479e0dbedc071851e9e738f10fff1752a1e598fc36bf199
SSDEEP 24576:I47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYOsqjnhMgeiCl7G0nehbGZpbD:I47JUQjqirIhCnDHUPfF/IDmg27RnWGj
TLSH
T12965AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 6abc9ed212b8ef855f19d03ab879b3c2314bbc4e6db5edf986125cb499a5cfd7
MD5 fb6bd166139b8600e2ba5cfeaf78136c
SHA1 0d73350d7c64eea41929875098877ec6c003cb27
SHA512 8b8c70cfcfc05ae87351dbaa448ed56ef63084df3d67bd0c6d11097d7a6e1cc015ae3f6048fde2592c890cb851ca391e5892a142f01f95fcb1783208b56f69bb
SSDEEP 12288:MpsfnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10F55015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1016KB
SHA256 b3dce6dab23aa9f95891c966a5749582d361181143ffdacdbbdafdbef24c9331
MD5 93583ddd43e5ad69a4e18032ac165b51
SHA1 d7c80bbf74cd8fceac6e58a244b1137f5c9a24d4
SHA512 0bdae712ad041958ca54d9e46ad9a17cdb9e855a6c51b260a30eefbdde1cfd064a69bb06e1271dbbb0c1431dcb43ccd9d75b0425e2ce3bd15dc4c52903f2b589
SSDEEP 12288:cWw5SU3fgbzRIbtRuY32RSuIlaRrOnW3:cxkUPiIbtRx3eSuIlaRr4W
TLSH
T1E3252801766ACB4FC66940321E73D2CDAB707D02EE459B0772C9873FD576658BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 c2513b065b0404c446e006fcb586c56a278937ac7f90c20f57fc700324ffcf04
MD5 a6f0909e326b90888890e50c7f6eef15
SHA1 1b07c8f56f6a6bf498b9826f3254ba0aaa17c35b
SHA512 538b20a967bd957c11c7e0ffc090082b6655ec4dd8bee331490613179facb0ee3d9e3653981a39952dab921e7cdca464a79f885ddc125bc759ccb2c94a13e1e1
SSDEEP 6144:Jjn8rEY6FgR7ueI1uKF1TnWtMxlnWtMx3ufIOvFCZlWRZJcu3iLL+mPp:9mEF1mPR4LSmPp
TLSH
T14365E8419537E68FC1B72032072A5B4DBBA4EC07B7496F2773C9453ED86AB11A1B93C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 179de356a2e9da6cffb63adc5927476f474194633cf29303d2d2e0e083a7bdb7
MD5 225a43ac40246fe5ffab94ca8bb650f1
SHA1 25d2e2261cc7a30b8325a7e8301be079b4b111a6
SHA512 55fa064b93da1892a44933220740b91a6bedd3a7541e136742ca236bf6427f366d6d14a3580ab04f92b5c912be6d8829cedd85f8a80d2f9a26445b01491539ce
SSDEEP 12288:5F7fXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FA45237B934C518AF93609B482E9E12DA80B7E669F1044C3BA4778FDF6B18D48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 cea5fc9fe52984121cd0ad0bf2d17acf01db1296a0dce2ea034f9552a22c6ef0
MD5 be125860cc988b2ab37872433b16085f
SHA1 6db9ede1b793d0d50ef0d603549cf4b58aa62dea
SHA512 285797dc8fb150f8fea06e8e3f4bda3c0f5c7734b5683e145e7e137ae20af3aa110a7ac1bcfb222637c9739098d285269735f9083011d1a6b5b144ec4695bddc
SSDEEP 24576:Egb6bmBIi49WNNFpg1rSvFv7bYBsqjnhMgeiCl7G0nehbGZpbD:Egb4mBIBhGFiDmg27RnWGj
TLSH
T192659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 ee7eb42d8040765a37f17f21dd4e852b12190d7f94fb2dfc980c79b7203739e8
MD5 18e84ac8946572adac8ec97a799dd803
SHA1 f3c6990d653a01a8b728e7146b11b9971906dbe0
SHA512 fcbb8d4afa6b4a2b3e3b69eb844430e838505e01ac48002e4f9991dc75ca057289bbbc20b0ebd0b5e1300ca02992f415771b59f24c36a54f97c4573a6da14314
SSDEEP 24576:hG88u8FpJqH1vzria7/m+sqjnhMgeiCl7G0nehbGZpbD:k7ZFPqVya7/dDmg27RnWGj
TLSH
T1A485016577E401F1D477D138CA868667F6B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 db2172dfe8ae9b8cc9d9719169d9c99c6a6bd33f9d53afe773f4fb4e27d938e1
MD5 034d664863a48b7dccb21f89d482f471
SHA1 a8413ed6e6e6e0ca4f353625832708cffec78f00
SHA512 161d81c46aa4bfde68085a2ada2f402c58c1e24febfec9512477bf1357965c497fcce0b6e15c7f2535aa089eb13bb7cdb7cb6f23fb6b3718ac99c9633473078d
SSDEEP 12288:fHvUrBFrEjwaQyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:fPUr+NQysqjnhMgeiCl7G0nehbGZpbD
TLSH
T18365F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 4165015ebcf1c10f5265665df24b26c23e08aaf08557341337788a9a8374ad5c
MD5 f483924462c19259301b8f8f7a76f064
SHA1 812a613ccfc83be9b7e93b10e8b8efa98aacf3ab
SHA512 59bdb271e4c34c2cb5de651ad54098244b31801eb698bf69d177c7f7702ee2b16149ce6e5190268418400b2c754ca0a3e3331aef63f4255c227da8b38df7abba
SSDEEP 49152:qBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjmDmg27RnWGj:VG05lO43bfD527BWG
TLSH
T162D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 73c2c1c11b70d81e91737aa5cb2357902421b600199f4e537f4379d7f03a677d
MD5 5374aae627e8034cfcabbde4913bef43
SHA1 164c936f93090253dc5e7233235d4222892af17e
SHA512 cef73c7c903b9010150acfce094d46cf9ca7c0e75eb359bf119e56b5f5a62dd7e90c53ac38ad1b5c2c95a338a4170c67773c8074ea270e5edd2672a6dc371ffb
SSDEEP 24576:sfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnMsqjnhMgeiCl7G0nehbGZpbD:0a5POZ3lJt2pasx2+meDmg27RnWGj
TLSH
T13D65BF5EA7FC00D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 293ed1aaaa30531a59fa25c1f386c09eeee37d933b912e873288694d807431c5
MD5 659ca16a9c06792faf64e63dc52910c4
SHA1 f95a696a8524ccb92346d4b5a50ae98b375695c0
SHA512 775b837ee098dee484adb8b49c6542cf40527f1da71359395cf27d8c5c642f4ee8f4b1bc43961dfc17879f4f783b6deaf214fad2dabd35c580039a086032f524
SSDEEP 24576:WNcwHdjbyQ4nLC18lb/EOjowL7FkGsqjnhMgeiCl7G0nehbGZpbD:WNc/zEOVHF9Dmg27RnWGj
TLSH
T18C857B2623E901E4E5BBE1BE89779546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a8bbeead2b173bd4de47b3e626ce0ade1bebd0da61bfcc796073768e3048aeaa
MD5 e83f18a481f5e3f121412645956bc461
SHA1 cba98ab0fbafe0b826c67e0d6dbf75af37413621
SHA512 1afeae7e569b01b6e127d7cef8b951b4844d3d1d01ba690904b2892be67669c576f84cdb4757e52baa18bb6a8e3cee41e198be92116b3f7e23b56996e1a47423
SSDEEP 24576:PzkNvNnaFeYhJNtmZBmxsqjnhMgeiCl7G0nehbGZpbD:PzMwBtOmFDmg27RnWGj
TLSH
T1C955AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 c10ab4483186dc5a78ba7f562e4ef2b6148dfc643a3c9a2eacb5ac32ed7921cd
MD5 0edf44e3cb423ae1cb8f201890d44d39
SHA1 946a671c224d077daba46628035c0de5ef18eb94
SHA512 047947c27e21edfa2f122b5b100262f5076f33ed693ec05cbfd953340316c1861870361fff98f117879d44208c341cd36a6992a5b7ffdfe012a77c8d65a536b8
SSDEEP 24576:UD3FHshBIYQgA7sqjnhMgeiCl7G0nehbGZpbD:UDVHeBIAAvDmg27RnWGj
TLSH
T17A75E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2444-328-0x0000021A9D770000-0x0000021A9D861000-memory.dmp

Download

memory/2840-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2840-97-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2840-91-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2840-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2840-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2840-330-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3516-134-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3516-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3516-137-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3516-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3516-128-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3560-54-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3560-48-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/3560-42-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/3560-52-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/3560-41-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3584-89-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3584-19-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3584-13-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3584-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3808-0-0x0000000000400000-0x0000000000550000-memory.dmp

Download

memory/3808-8-0x0000000002260000-0x00000000022C7000-memory.dmp

Download

memory/3808-39-0x0000000000400000-0x0000000000550000-memory.dmp

Download

memory/3808-1-0x0000000002260000-0x00000000022C7000-memory.dmp

Download

memory/4344-279-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4344-57-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4344-56-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4344-63-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4352-103-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4352-109-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4352-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4352-314-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4352-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4352-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4488-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4488-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4488-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4488-114-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4488-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4716-79-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4716-85-0x00000000009F0000-0x0000000000A57000-memory.dmp

Download

memory/4716-310-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4716-80-0x00000000009F0000-0x0000000000A57000-memory.dmp

Download

memory/5728-295-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5728-75-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5728-67-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5728-69-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5840-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5840-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5840-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5840-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6028-123-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/6028-117-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/6028-115-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/6028-313-0x0000000140000000-0x000000014027D000-memory.dmp

Download