8d6a310318450ddfd19faefd40cac1c22898347d533e9197fde473102fafcb34

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 23:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-09_34423bb9411ccd0253b6f346467cdcc7_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer.exe
Size 748KB
Sample261110-2y3ehsxsaz
SHA256 8d6a310318450ddfd19faefd40cac1c22898347d533e9197fde473102fafcb34
MD5 34423bb9411ccd0253b6f346467cdcc7
SHA1 e4c2c6273f11c9d61b5093d1d58cee777421bb87
SHA512 7a813e3db6606b60d6cff513f0e4fd7ad19e36265770fa826955f2d52699e8d8ce8c18230475077ca931d59d0f7818a9ac7fc9acdb4d2fa20cd2f4729d22b45b
SSDEEP 12288:H3oVBakbhc7+4Vx/XpyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/T:81UV1pysqjnhMgeiCl7G0nehbGZpbD
TLSH
T17EF4022979C2C073D876143405E4E679682E7D711F2458FBA7C96BBEAE306D08B38937
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5844	elevation_service.exe
2172	elevation_service.exe
1356	maintenanceservice.exe
2308	OSE.EXE
5180	PerceptionSimulationService.exe
3520	perfhost.exe
456	ReFsDedupSvc.exe
2656	SensorDataService.exe
3764	ssh-agent.exe
3000	AgentService.exe
696	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-09_34423bb9411ccd0253b6f346467cdcc7_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-09_34423bb9411ccd0253b6f346467cdcc7_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-09_34423bb9411ccd0253b6f346467cdcc7_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-09_34423bb9411ccd0253b6f346467cdcc7_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-09_34423bb9411ccd0253b6f346467cdcc7_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\bfc1e597465cd71.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-09_34423bb9411ccd0253b6f346467cdcc7_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-09_34423bb9411ccd0253b6f346467cdcc7_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-09_34423bb9411ccd0253b6f346467cdcc7_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-09_34423bb9411ccd0253b6f346467cdcc7_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-09_34423bb9411ccd0253b6f346467cdcc7_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-09_34423bb9411ccd0253b6f346467cdcc7_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-09_34423bb9411ccd0253b6f346467cdcc7_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-09_34423bb9411ccd0253b6f346467cdcc7_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-09_34423bb9411ccd0253b6f346467cdcc7_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-09_34423bb9411ccd0253b6f346467cdcc7_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-09_34423bb9411ccd0253b6f346467cdcc7_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-09_34423bb9411ccd0253b6f346467cdcc7_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-09_34423bb9411ccd0253b6f346467cdcc7_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-09_34423bb9411ccd0253b6f346467cdcc7_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-09_34423bb9411ccd0253b6f346467cdcc7_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-09_34423bb9411ccd0253b6f346467cdcc7_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-11-09_34423bb9411ccd0253b6f346467cdcc7_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-11-09_34423bb9411ccd0253b6f346467cdcc7_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-11-09_34423bb9411ccd0253b6f346467cdcc7_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-11-09_34423bb9411ccd0253b6f346467cdcc7_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-11-09_34423bb9411ccd0253b6f346467cdcc7_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-11-09_34423bb9411ccd0253b6f346467cdcc7_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-11-09_34423bb9411ccd0253b6f346467cdcc7_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-11-09_34423bb9411ccd0253b6f346467cdcc7_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-11-09_34423bb9411ccd0253b6f346467cdcc7_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-11-09_34423bb9411ccd0253b6f346467cdcc7_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-11-09_34423bb9411ccd0253b6f346467cdcc7_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-11-09_34423bb9411ccd0253b6f346467cdcc7_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-11-09_34423bb9411ccd0253b6f346467cdcc7_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-11-09_34423bb9411ccd0253b6f346467cdcc7_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-11-09_34423bb9411ccd0253b6f346467cdcc7_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-11-09_34423bb9411ccd0253b6f346467cdcc7_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-11-09_34423bb9411ccd0253b6f346467cdcc7_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-11-09_34423bb9411ccd0253b6f346467cdcc7_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-09_34423bb9411ccd0253b6f346467cdcc7_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-09_34423bb9411ccd0253b6f346467cdcc7_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001dcc738e6771dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cbba368e6771dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000862a0f8e6771dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008cc9f94d6771dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c45a1d4e6771dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006258db506771dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007801314e6771dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5844	elevation_service.exe
5844	elevation_service.exe
5844	elevation_service.exe
5844	elevation_service.exe
5844	elevation_service.exe
5844	elevation_service.exe
5844	elevation_service.exe
2172	elevation_service.exe
2172	elevation_service.exe
2172	elevation_service.exe
2172	elevation_service.exe
2172	elevation_service.exe
2172	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1676	2026-11-09_34423bb9411ccd0253b6f346467cdcc7_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer.exe
Token: SeAssignPrimaryTokenPrivilege	3000	AgentService.exe
Token: SeBackupPrivilege	456	ReFsDedupSvc.exe
Token: SeRestorePrivilege	456	ReFsDedupSvc.exe
Token: SeBackupPrivilege	456	ReFsDedupSvc.exe
Token: SeRestorePrivilege	456	ReFsDedupSvc.exe
Token: SeBackupPrivilege	456	ReFsDedupSvc.exe
Token: SeRestorePrivilege	456	ReFsDedupSvc.exe
Token: SeBackupPrivilege	456	ReFsDedupSvc.exe
Token: SeRestorePrivilege	456	ReFsDedupSvc.exe
Token: SeBackupPrivilege	456	ReFsDedupSvc.exe
Token: SeRestorePrivilege	456	ReFsDedupSvc.exe
Token: 33	696	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	696	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	696	SearchIndexer.exe
Token: SeDebugPrivilege	5844	elevation_service.exe
Token: SeDebugPrivilege	2172	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 696 wrote to memory of 6020	696	SearchIndexer.exe	101
PID 696 wrote to memory of 3552	696	SearchIndexer.exe	102
PID 696 wrote to memory of 4596	696	SearchIndexer.exe	103
PID 696 wrote to memory of 4148	696	SearchIndexer.exe	104
PID 696 wrote to memory of 4344	696	SearchIndexer.exe	106
PID 696 wrote to memory of 2888	696	SearchIndexer.exe	107
PID 696 wrote to memory of 4544	696	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-11-09_34423bb9411ccd0253b6f346467cdcc7_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-09_34423bb9411ccd0253b6f346467cdcc7_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat_redline-stealer.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1676

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5844

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2172

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1356

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2308

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5180

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3520

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:456

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2656

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3764

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3000

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:696
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6020
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3552
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4596
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2884 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4148
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4344
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2888
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2884 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 728395c96bd3593d061f03e27daf977ceddd20bf957c8f21db438a7b1e0afcde
MD5 798c44f3ca4e7616b6947fcf34c7c94c
SHA1 7bbeac5fbac9ac598c5d4bdb5713d7f70cd5a8b6
SHA512 b708319fb9da126e9c6c89952990e83fa5aed3b0fb78838dd2f753eeab6096e278f0761f932380909d169b0a12a123121df327a395ceddebe32591b34d70073c
SSDEEP 49152:2b+632BuPkFKRrdE6ohQstBhuXjfS4LWxn0Dmg27RnWGj:o3q6tjB3D527BWG
TLSH
T166D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 61fc0d103338b54909bdc57c01ba531e6b14319700e0de26d05a7dbc263c7b72
MD5 41c469ebbc7ce05281bed9b55bed81d7
SHA1 1be5fff644ecbecf411fd4a813da069cc87ae21d
SHA512 a6b529ae07a97333d758a7cc17ffc211dc485a162ba54304682886bd6a6a5b2dbdb4294c56eb432eebfcac60ee2165e77cab113de62d7bd060ccc5a34d171dae
SSDEEP 24576:NXYfDtczAHsqjnhMgeiCl7G0nehbGZpbD:YtcSDmg27RnWGj
TLSH
T12E05F129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 19bdce551aaee207828024fcdb3f7433eb1dfd038e7b627a97ed699fa3108659
MD5 65bf226158985e8c6961dc3616582c51
SHA1 c15b912e4a358f904457f254e79414fdaff2becf
SHA512 e758dbe3a69a75ce33de34303bbd0bbaa43c9f00d40f809940afa3e1db8a7fbe34943577581ec346f19f9fdf7fa557069f61c78ead2e96e3a9145e244fe7e76f
SSDEEP 24576:J0Le5ji0hmxnrMQsqjnhMgeiCl7G0nehbGZpbD:JPji0AxNDmg27RnWGj
TLSH
T1A2359E26F6748335D073C0B9C5D2A68EED723086573089CB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0fce21ddcf3211d5f2122e0f08507c9d4393338a39b57fda775392bc49709346
MD5 43910bd26497c0c3a121a745d6e68f6a
SHA1 767e6a520ddc21eba8d78ea47ce9fa7ca00aae32
SHA512 758033ca3780607260ca47e02e63667adb4dc70dec8400f9c6670b7b43c28dc1b2e1268c9e8686d0475130fe2a894854a1b3c5a407a09e0b21c10ce75ee6678b
SSDEEP 24576:La7/ezSC6vUyDZaqgrvWx6q8wyuusqjnhMgeiCl7G0nehbGZpbD:m/ezSC6vURPvMHjyBDmg27RnWGj
TLSH
T1E4755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 36b606e4d1e28df685ad83bbf9b589c269f7b43fb07a8bde21895f134ea3b414
MD5 d67d8eb66f20bddf71e161b526a318b5
SHA1 7f42bad4292c7ba33860e8f02ee64034845168b1
SHA512 f219552784540ce2226716c796775d5fa92e42021ae665ed73074cf9bb5e6c2bd69d10bb6a6923ece6ac6b39b1db11b9c2d6309ad27a5829ff54ecc70d69cd63
SSDEEP 24576:YVbqPb88hv/lV7jsqjnhMgeiCl7G0nehbGZpbD:YVO88hXlVDDmg27RnWGj
TLSH
T103559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 fe64bccf4c8a904481bad571c596b05ad6026b8201b979158e49c577c82f10f2
MD5 f37ba9a4fad948e8392daa18057d3547
SHA1 5bbaccc69ee02bc18d9b2ad0d5b4856293b4b48c
SHA512 f8bf87f0cf7290172ba480ba06a95208723c4969d79f1dd48d2a828ff3fe052e527fbdd248a6f9aa014cc74e6a7b42929972049af94fe36dfa30c70ac40d2e27
SSDEEP 12288:2GMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2GMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17EC423BF864C50CAEB7608B5C3E9F51EAC177E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 56ec05d444c30e583d6bc0881a4542caad8992fbbd16681a47c2e7cae51fa9aa
MD5 4a756e59de848bd1aec8aa21b4028fdc
SHA1 91342e6c06752b9ed533dfc19fb66e5fa7b85767
SHA512 1569934e1a9ffaf2d927debf3f47d666c324b38eae40b3f121b1d964975fe9fcd04e6569b2fd341786d0b5d136bc2b9d3e4ece98cf7104e0ff5b70c60871ddfa
SSDEEP 12288:DeBNUbTVO86UrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:DJIUrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CA05CF7BEE28FCD2C27A8DB85791C600E77278314B6193CBE165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 705bf94f64b92ca2841d9b8f22b89d30d87ee87a383190e3e7931b6eaa222b5e
MD5 bd6c75072dcd7dc8002ba2d037a5e6c1
SHA1 e60e860605ac232cba47dd9e48b6a9eccfbf8b8b
SHA512 6971b3419814d2cd43c281ba597449054ae4d8c44bd96655d95760216dd74a37bc9b3da6a50b720b5c50b0164757b7f99b1337094b5af69112465a1974498b13
SSDEEP 49152:JQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THG:JQvGAdlCEL8c/pRNw5CyD527BWG
TLSH
T147266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 cf795e5c2a0f2f35914c1a565d4a541bf239a05c7af8b6dbe3407e43b93ea746
MD5 c90119ed43689e83593b96e81e5a6868
SHA1 d8afde8f4624edaeca61faba0244be13ed7dd8a2
SHA512 42453364866e6552270ce204a3180a59316f1b2608e1901207ba18b28afe5bad4094148005a9f6e8e652b49908a8d164f6b89e893688b5378e2099a69e29cb4f
SSDEEP 12288:8AwSfxL/2Dc3xDLLmt0LDQewsAj5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:hwewsAj5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D615E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 69f104e88ab6d21f4d8c45d0884dfed04d7c4f8db758a20304fba0f35a9a3f75
MD5 d83956280974d2bd0af7a3b631f6d87c
SHA1 10a9e6a68e9c5762e22980291683aa2bb1eaec09
SHA512 2e2947c8f377387cb7579ba5d909262aa8761bc0f3c92fd6678e186b6a878556c80d1f44d5e4b5294c0c455ca063067f35f205750928e09046d0349c39a8f572
SSDEEP 196608:wUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHFVQBWG:wUEtQevvqc2W1cpV29I32QB
TLSH
T15C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9bbe15edd1a48e274083815b699407814bc1079ab9f36b65cff0709673f96f21
MD5 f0d0dd7bca122929937676b42ca900d7
SHA1 96ea123b46cf2176d9e8f233256954ea955af679
SHA512 80ce98f97f57d95a948b6d296facabb2b132f2b74446221bf387a03169ac5ba282ffbe2eb3e325036af2ce6f8bc69be95bda075885fd8004e6be47221be3a1a2
SSDEEP 49152:gCbRquA/m2yL5zLfFiV+XenmE3/zdDmg27RnWGj:poq2VjnmWD527BWG
TLSH
T12BD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 fb91f8e55228e491ad778e67600f4ae5b9e5e2155b0d1c1176dcaabc231c4a99
MD5 a43df61f36ed6d7e7e599dab53164402
SHA1 7e0f72e74d10cf5133208d3531d0a3dc02fcfd71
SHA512 a920681a645b3b68568f5f6b60c118d37df3974a30b392518f6f49e9749ab3b825a05829d103ee865bfa3d357fc3afbcbcc4a4079d77b6b92aa322a30337624c
SSDEEP 24576:SAhGLmIFoiwtA5l7S53ysqjnhMgeiCl7G0nehbGZpbD:SAM1Foiq5GDmg27RnWGj
TLSH
T183359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 f1e4ff9519c6d6a568dd4ebdda73bcb30ce2377379dfad01a4271fb70284a24b
MD5 12f4399733b50ca692b2f42a17b62563
SHA1 e03b82fb1b1fa12debd9c8364acd44ee42ca40b0
SHA512 3fb442e7851d37a65906d2352c32a96e5ceef3513b33373e558a834a20a4d8ba2204de17ec5e6c3ff5e397fc450cbbce86ec1b311d6ff4805c18aa9b6025acd3
SSDEEP 12288:cmw5HEjsChNOBFgl0WDm+COXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:ZwuXOW9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T12B05F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 8efad266b79e58e6b47cef3260dbfc14925c97381dc2d347a75ca15a732a889a
MD5 8623f3d11f60e614ffe621875094043a
SHA1 b09b10cb084c6e9a750f8f306b61ed8d8a649139
SHA512 3166ff213204791cfbed1f6844652d9c67fdbcafae107b9c128aef146f561fc424d4d44fabd79e2e82f705dedcabb99fd3c4291cde536f972bef34fd7c619027
SSDEEP 12288:QbZ1IypXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YZu4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T10EE412AA239820FAE163417CC5E5D609E7337C62673043CF166659AA6F73AC44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 dedb542b35728a13f08c87418b888a8669e673e0b05e854c91c2a85d2af6cb20
MD5 d90711a027098b27c07db3c9b499ba08
SHA1 affdc2b55949abc1ad065c77bc83aa71ca43deb1
SHA512 e98aad07d3f91894914268d095db8e01f9a1ad7cf49a4eebee49359f6ef447d032cf60d9ce3bda98f44cc11977337a4b421cdc8eeade68f47e390dd951ae6550
SSDEEP 98304:AQRQyi36YOcPuLvw2gAf+PN3TD527BWG:XQyiKakX+PNjVQBWG
TLSH
T16B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 fb2f030c454e69f7ef5b9d29cb7f82716d5eab8a7ed129ce1fe4fe13de566283
MD5 4db60ded9dbd18effda0fe13f41378b8
SHA1 774171a83195596a5635e610be92fe20f2b9ca3d
SHA512 203b5af4328190e7f8edb96040f43d23ec803d018097d6fde41923ac5c1bdf8b28e0080bb2008a00a11c6cb19d32b899973f2438fe992cfff5df3ae29e4d4b97
SSDEEP 98304:TQRQyi36YOcPuLvw2gAf+PN3TD527BWG:CQyiKakX+PNjVQBWG
TLSH
T115667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e7d8eebb80c80e46cd1d706134d3edbdc920f764b69f0b34a031292912142688
MD5 9e9f29b4bbbf3a4726eb5eceef79102b
SHA1 1218ddcf5fb329b7213d0ef65636a495777c2e0c
SHA512 098ca403a90adf21c3d88e1e14cb1c326a892ff9310982ee0cbb36485459cf24011791bffb2877fa271d3f9ad666433cc560de3e57f2bd5a247e9e7ce07e657d
SSDEEP 24576:iwvLof6SRQ+rn/fDboqxN1nnh6C7DaHGTNHu7PNU3/5W/ohL0IsqjnhMgeiCl7Ge:c68Qg55nhxeWu7PNU3/NDmg27RnWGj
TLSH
T188B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8c9760fb78801f0aa4e76ce12df8065dc7303e8fa957c1deeb30551fb97aa978
MD5 db8872bfc1862a7658061aa3c5e8b78d
SHA1 1c70bd11a5cfdbd436ce2f3bf240ced899d43e73
SHA512 90460e574febb76b287e9f027d2303a236487557c761e56d221708d2f398115d73cab3a4fd397abdf34d600e65a6597b24a69d824e9d920608de6794149bbabe
SSDEEP 98304:+y5112gYy5azzVvD69nLKnhZ4D527BWG:vLIH+Wh+VQBWG
TLSH
T187167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 47ed31f637bd27bc3c2023d5f5af9a01756654a7ca45a9accfbc69177adc3d6c
MD5 fd888171945ea13425bdd2b43529ac4f
SHA1 abb328b94e8a630b2c4978ed8e6b55672a651a96
SHA512 c3da09588cac2d3b2fd8e4fd743d0cd2ca83c6a616679dae2abbec12fa2aa3a0628554b80e9ecb459166c467a5fb5695bc1455345409016fec9228562dfb5a0a
SSDEEP 49152:TB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glrDmg27RnWGj:lu6JmQxd2drD527BWG
TLSH
T1DDD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b33478ce613c18829cd39c6919036c9a448becb2d7f1a8640f50ba244e037c66
MD5 d27cc24c26ea47b42aef516dac6631fa
SHA1 e28f458c9092c8c4f5f90756685a5ec8a80f8d78
SHA512 805c88c58fce59e67edb54e1fef637a4f6299bb6c8ed40fc275d7d3f44bfe413db52548332f2e804a5f72090d72de00d8de2e089bcdd099d3d2efd61c16c1ffe
SSDEEP 49152:Q1hpsNoJpF1A6yU44CwH7R4x/Dmg27RnWGj:QmifPVRWD527BWG
TLSH
T156B5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 1eef40779948a00c7c02179fe85cce18f30f6f539a61b431ee40d4b11cf55389
MD5 1e702ee8df4839aae371324e60d337e1
SHA1 37f3e52074c380c6f421b8cc1394686993cef0dc
SHA512 f87b97b7972df28e096f6d777064d62fb52b5fce6bd3d245abdbedce3e86716d8d47311438bb588162baa55c72eddff515ecdff7eecb763a066b2e63311ef9ab
SSDEEP 49152:ySuZQIY0Be2KIRVtOnks6NMHqkDmg27RnWGj:s5dKOi61kD527BWG
TLSH
T108C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4b2e89bd4e7bcd24af36620526296749e360a9511d5251ce797eeac2fd9d346b
MD5 891e77a577680b64dd2169af239daa98
SHA1 0f11f3f864692012c4f8eccecfafcd2fd07c7560
SHA512 8e4bda6feaeab1df19936378c423df3d87d93386062e8aa91b13803860a83bebedc519421382e641179789b3f7fc67ae84ea6c54da916ab9ecb8a34bb06f3d0f
SSDEEP 49152:6htSn8EApI0figGgiDn0AP5wbDmg27RnWGj:7X2i/ph6D527BWG
TLSH
T17495BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 c8ff39b2c6c147f746eb18988bc68f1ad6f8c9496c37ece984eeb7a18fbd22ac
MD5 7a48d37075890e90efa0399533b55470
SHA1 a9bc0645d5afc5749a8b1e43b517f6be24a6b130
SHA512 9bd94476c70e490b5f2f3d581d20267c29df86c2cfe06bafcc8609a6e65c831b0d9e79d6021a139c51ceb35945301f2a787652b0a2c01552d57ba0b7b2139d7c
SSDEEP 12288:QUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T110C423BE955C41CAE52648B5C3E5F14DA8073E6BE92004837A5B7CBEFBF24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 25d949e0787357a8dc625f0379fcb73eb84a58bbdba806cf04a5307455427a6b
MD5 bf901a95b867edd4bc84531efc3e375c
SHA1 6cbf49dd0a4420eabfbf83f7814478c2f6f739af
SHA512 de754c25af697b96129e104a504f4a93bb39708c70025a66dcbee523866140e3428665e0eb17c5992a7ba17c78b3f727b976027b467c3b5a2edba7817136c2e0
SSDEEP 12288:UVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F0C423BE955C41CAE52648B5C3E5F14DA8073E6BE92004837A9B7CBAFBF14584B3C427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 559c10270926489c28947f0c327f118428433573c4a90e29600d31a77a9346e1
MD5 89695716a24cee4c11f070690c6b4fd8
SHA1 b30df0f92eb988751cf42108f86f5477b3a91794
SHA512 49108c236ceb869454b549424f5aae8fd6d22824e2f49f491e7cfc3ca8ec6b13c51d06cc3e75d7c95cf2919a1e4ab994ccbf8d99f0c593331040c91e27cebc01
SSDEEP 12288:vzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T186C423BE965C41CAE52508B5C3E5E14DAC173E6BE9200483BA9B7CBDFBF14584B38463
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 08ba360f351b57bb7cb01cb4d631b98b767234976db87ed28ffc26ca0311eabb
MD5 7d69535c68784efcd10bb0ff1271c1d0
SHA1 3e7fe23b1234a5f2ed719ab8c0be2c8246a3b064
SHA512 bf58ff13c3c6461b1c3e557e6b5259d952b8ea685d577f75dea04d15a56c5135f281c47a82e3a4b87eae22a7f52b4b60e5535709f72a40571b67ff95840b87f5
SSDEEP 12288:3VSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B6D4236F675C01CAE83285B4C2F5E11DE8237D96E730059B6B532CAE5FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 fd76ad71344799344aeef1811d04201215de0f82898633091e2e5c316f671cbc
MD5 06ae5eafe67c2b963a5d2f7a05726161
SHA1 d07e71d6d94b68fd7c7ddfc5cc6ae18ac3ec58f0
SHA512 d27cacaaaba8671df01f32138099567ac100c256c7bb771fa535c4bae44b67d584dff3587842c04ffea30ffee0e84ff45c31f4168eccb77c727e9df288b96676
SSDEEP 12288:AKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1ADC423BE955C41CAE52608B5C3E5E14DAC173E6BE9200483BA9B7CBDFBF14584B3C462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 c7a9f5dcc392427b551f433fac60b117faf73e31ac01f9f0f77112eaaed285b6
MD5 9160a51d51ff99f909e4d7b49ce962b4
SHA1 d93b66c39a64311ddce9f0c9a2d591dcf3637883
SHA512 c74976d852ebcdb83031d33a3347979ce63ea4022d7ff48bc234bf4378acc137b217f8d9d33c672d4625ce8ca358a7dfdb8ec01e8ac6b67562e870dcd08e90f0
SSDEEP 12288:MhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T179C423BE965C41CAE52644B5C3E5F14DA8073E6BE92004837A9B7CBAFBF14584B3C427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 58da84abd83e3aed2ee91bb70ba1f1b11243d097e3930640545bdb89359209f5
MD5 ab9fe5b0aef160377470b00cbaa81ac6
SHA1 b404eececf59e193f1c3ebd6081accb4f0d97896
SHA512 c3f29ed373e3cb22703b9888a4148b2e523cab33a64ccfcc47f07ee406ebfd434e0d98afa924b8e1fb8f0534985c66f21da6e908fb38b3b7f3f5f7af66eaa5f2
SSDEEP 12288:kNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T194C423BF964C41CAE52604B5C3E5F15DA8173E6BE9200483BA6B7CBAF7F14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 ebe2ef05d885e18df6d7ca977cabf7e911486f711e75ffb8d10026ea03336e65
MD5 581b1bd08ad3424c118a4310576588d0
SHA1 07fb6bc8d90b66d899749ed90c653ec6a61c03e9
SHA512 6f25c36b4cc031c1652895aebd30d3984251d1cdeb6bb80d81fcc020491bc325eb9db7efd269b47082ff796cea7e624f73c31f511fad670ffc6e0b5a95fa4995
SSDEEP 24576:EZMJzFVSO1sqjnhMgeiCl7G0nehbGZpbD:EZMJzflDmg27RnWGj
TLSH
T1C80501A9B35018F8EC63813EC965D90AD5B37C5A0B70C61F13A5366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 f5bafa49e5369a3db444a69c39f28cd9148f8d9e0b6a3c3102d2033a4f060f4f
MD5 617da6c0895e3155ba4db226315f0bf5
SHA1 2ad03f200d3087dc5b7460d1a2dcb95de7639a6d
SHA512 a249c0930b009095be8b2331f1ab0ec30a2eed2fac4fd955aa49f92234dc851b8b0389fbaac9c23920d08f0d7c3948bea11d942332129fa1dc6bb2ec5729a01b
SSDEEP 12288:4oXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4osqjnhMgeiCl7G0nehbGZpbD
TLSH
T107C423BE955C41CAE92608B5C3E5E14DAC173E6BE9200483BA5B7CBDFBB14584B3C463
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 9bdd3da52fcc6900cabe5a3e4ed3465c5a3434a7e2a68075c83ca367a8b3aa0d
MD5 affa75ed7cac9d3c770bce25a19a6dca
SHA1 47f6309c97af4b889a0d933ed1d0c79e18c0da3a
SHA512 b447da70aa7923641ffd41d4655b60408666855fae62d63a0b994c05b056c11dffde7bcfbdff0b353cc83c89d1c5e8754e429c55f21ad8482cac921d329dc84b
SSDEEP 12288:y8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:y8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T10BC423BFA55C41CAE92604B5C3E5E15DA8173E6BE9200483BA5B7CB9FBB14584B3C423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 087463dd28073b2dfee6ba1432faa3c84c5e967b031f2e312d83752bb5a0fac9
MD5 9c0b25e7e13bd17c0864bdb54bc70b91
SHA1 7550d683796f882e324f58b231d9c9f208f52cae
SHA512 bcabe54c78dfe6779dbf0fe5d45ab03adea8e3e4ae1814fb661c3fbe7ea4c80799965dce4f4b3e3d5a473da24331e1cfe8e63ea422b48e2166bd73219135213f
SSDEEP 12288:FyPz5L8pXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MzypsqjnhMgeiCl7G0nehbGZpbD
TLSH
T106F4125B73A430F9D1368138C5A29A06F7737C3647204A9F17A516BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 017fa94f6d09b791c4921168635ed6ba79dd623a2426cefa6b2daf9df7df2c85
MD5 69b1a1637692e4f004fe96534254c85d
SHA1 27a1b3a32a94856018b3919f950baedc79174f9f
SHA512 4723ed2f4ff5a19c17a490e66b323ed79c47e8acd987c5c30e4db469d8f704bae81cdeabcd6c7a9cd91d3c77e4cc533e77de9ceb4d5e431a1f5c5e8913e77ead
SSDEEP 12288:1oXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1osqjnhMgeiCl7G0nehbGZpbD
TLSH
T109C423BF915C41CAE92604B5C3E5E15DAC173E6BE9200483BA9B7CBDFBB14584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 a16c60525763d4afefb9cd05297d0b42aa2e741096f55acc5f6ff5bb8170f97e
MD5 4226b99543d51474a769b10192dad4cb
SHA1 ef4a7a4cdc9e596f51a366a78c4ef528113b0738
SHA512 54458232693bf295c65efac6860da28a3cff79fc90ed9a9821b6fddcc92130e6dc6f702406431422cecc447520b9a30d7a8fe93a6b8dd43c6be2a6744859d248
SSDEEP 12288:ToXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TosqjnhMgeiCl7G0nehbGZpbD
TLSH
T112C423BFA55C41CAE52504B5C3E5E14DAC073E6BE9200483BA5B7CBDFBB14584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 5a275e6be7962c9d092bc3915a2e2e0d95570d14726ef3b253e2fbc76e5d9541
MD5 e6c0a8ab1e89106e6259ba47e33ec7ea
SHA1 76d1f0e55276b98377d1cceb2e638a9668678439
SHA512 20c8833a3355842ef8929d5ed61cb851508d8cc7477cf76638ecf13f65cf249eb95a481a5430f05408445ab9d1755dd9ec6fb2ccd6686acdea5bf3bdfde96a93
SSDEEP 12288:dyPz5L8pXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UzypsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B4F4125B73A530F9D1368138C5A29A06F7337C3647204A9F17A516BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 28d5acf304866634a589f1352935cde9206837143f3fc8409a47e563b8c1c5e1
MD5 19d126a329e580f4b4d0733d80a973fe
SHA1 65072ab32ac97d031671c4f2961d21020509e4e6
SHA512 e308f69e56dedefb9426aee67336e6f7d810572cde44ad0093fef3f64ef2168e31653e4d116633bebceca22b2e508366d7be5175e38b564f4aeb5d3cc30bdb29
SSDEEP 24576:3TuaLl3z0zDDsqjnhMgeiCl7G0nehbGZpbD:3TdLljCDmg27RnWGj
TLSH
T17C0501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 5aa0c38c678ba6d4e38bf7f869fbec1ee59edd6397816026947ac0aabd58b199
MD5 f637f175440fb0d6f1b79afbf5bb9711
SHA1 968c73d531fcc0e05dea95bd7a0b5831510525b5
SHA512 89f14dae37b78aec3a4765262c2fbb66743baa1d44435fb25ac2cca111397eaf61d17faa18f77df4dfab6c778d2b24c6f8e26f877acbe9677725db2b71124ade
SSDEEP 24576:g3xd9CHKy7GZPsqjnhMgeiCl7G0nehbGZpbD:qxd9CHKyalDmg27RnWGj
TLSH
T1A025CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 f3ac107be1a28b2188bfab20b66a1d9c69d0ed273bedc52017b424c3ce630adb
MD5 61db6ab5da1be31799396562b50fb726
SHA1 4599a9d5f9b2b8b5265f5cf5daf29bf7e372752c
SHA512 1d7459caac3d2ed684a8f4476738bd599fd5940f5a0301611e316f90453eb110d72499664d408ed63e1add1efb45b0c67dfb6320cd1196f5a4e99ea3a2bdb8d7
SSDEEP 12288:OTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T176C423BE955C41CAE52608B5C3E5F14DAC173E6BE9200483BA9B7CBDFBF14584B38462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 321e7a93689d9bdbfdb82cf12232efefbe96ce0e85f0a17099d40d9b21889420
MD5 9735630861b0cf4c1bff7471de321038
SHA1 634ae596269dfe377e6cb7c17becaffa7dc5d40b
SHA512 b20d1372de0b46a07ff270610017f98bf44506296b41ef201141eb1ce5cf8e8022023b90889822bbdd98a371bcb4c07591b87a8d1d6d12610cbb700b0e827157
SSDEEP 12288:cJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T139C423BE965C41DAE52644F5C3E9E10DAC073E6BE92004837A977CBEEBF14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 7f199d41ef9980f767a5f7445a6a0bd02495dde7aa0664b1bb340a72baba1c27
MD5 2cc832f1e9214ec98c2164b7f4cef2ab
SHA1 2ae8b8156608129e3732e4c430aafb96081ca6f3
SHA512 a86870550a5b593f70b15e597577240404c111341eeb9e05f8a2bfc96ff783cff380605d2be98df9830a78fc56ebb18c59e84c8512647b1f06fd13e7bb14f762
SSDEEP 12288:XmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10CC423BEA15C41CAE92508B5C3E5E15DAC173E5BE9200483BA9B7CBDFBB14584B3C427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 759e80b25becc791aab14391eebbf08a2b07691c89be9d1ac77520d2f82f1a9f
MD5 ccf4a55cbf4f29c5dde8ec7da28d9ce0
SHA1 e367e853094c7ed21da2cc058e0ec7d3d5f7a822
SHA512 d10510a83f7ed47b7af083794495c625e85c6deb5272658b89072964b4385f954a6c5466115643407150bc5a1a4b60be4ffe8130cdc51c4c253f809288f2d343
SSDEEP 12288:soXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sosqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EDC423BE955C41CAE52508B5C3E5E14DAC173E6BE9200483BA9B7CBDFBB14584B3C427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 c3af3febb100fe5cef49ae1707ca71d907970c33484b512b6f3d31503f31841a
MD5 022b489363a818045f04a2f48b2733fa
SHA1 7d5895d719adb9614340c0a6174b40be372204a4
SHA512 52f3f935dc239536b63ac5f9503e2547bf293442596d95a0cab0cf7e001d9a5b5b3c1fe8671adf57c8abdccf0f99f72401dd491091c1c5b19805433f3d4b6dbb
SSDEEP 12288:LTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10BC423BE915C41CAE92508B5C3E5F14DAC173E6BE9200483BA9B7CBDFBF14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 04be554a493923aa400390468f2a677cbf9cb1121e30ea98f267ffbab4d66870
MD5 76b27e430a4cf8ebd44c975d44d53d1a
SHA1 d77c70152bc61945748e3d509ad38ead71d73c6c
SHA512 ceb1c76fdd921d12900a9df6438dbb4f0e1e2cb75f2d30eccf4d09aef09263ba3b025bc92ea1e60812322b9fb2326455caad0902ea657500fc43e087f1cefe7d
SSDEEP 12288:7gXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7gsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A8C423BE955C41CAE92644B5C3E5E11DAC073E6BE9200483BA5B7CBEFBF14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 39a621b0b1b1a2acad0b0bc7296393584eb84e8138631d39f342dfedfa01f114
MD5 1cb1541cb4af58bc535488da6d4656f2
SHA1 79441ee0177ab74527cd61d0618b3254c748eef2
SHA512 2385e684b520b315f2d6ad809c618510de335e285973ab41ca72522f1247003f56a1edfbce64e7e70ad696f99bf11981bcb9d3b5e55c5ce3e50648c47650b815
SSDEEP 12288:AKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DDC423BE955C41CAE52508B5C3E5E14DAC173E6BE92004837A9B7CBDFBF14584B3C462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 d8caf76ad41b334277922fd29bd4be093aa1fc3f2247b308f3d2652e5e99620c
MD5 9ad562eaafcbc86f3e9246d9bb941361
SHA1 e5ef64d7491cca371eff9fd8fecdfd742415acc2
SHA512 902425f933a0ff644d73ae900960e6ecd2902eda158c59885b86a9fdb7426fde453a9d8755c041a6af773a68eee7160e64df24082c9f49edc66dea4bd16b8d09
SSDEEP 12288:mbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EBC423BE955C41CAE52648F5C3E5E11DAC073E6BE9200483BA577CBEFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 581KB
SHA256 7956926bd8de6da25e5fbd776414e94e8377b5d36031d08bc39d1b1e0e2a5183
MD5 ced28af1fd310f84fcc5e761ff2bfed5
SHA1 51b6506d547dcdbd73ccf0b3ff109edea3a33caa
SHA512 548c921e88fd18483d9d981c6d7510f94648f43c94b8f4c8dbc4d05438b77b5453e553a202350fb70235262bb8f30724ec67c5960ca25cf56d5cb33fd91a8179
SSDEEP 12288:FKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12AC423BEA54C41CAE52508B5C3E5E14DAC073E6BE9200483BA9B7CBDFBF14584B3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 41fb825cea29021e2bf34bfeaf96ea894a17e5994e75cbe5b3107655159b4528
MD5 b6b58ce66c97557eed6dd9d983172775
SHA1 747add0656045a1704079b613e8bcaaad65d351c
SHA512 22b5e0c8bca21d2cfef0b319d7153ba26b6f4300c2a164a1c6f792f946f04287a7ce8c01ec15279602decfb7051bcc02ca8d4fb92c26ecea7659b488a5fe0f12
SSDEEP 24576:bfwvOk9RX6wkyAIssqjnhMgeiCl7G0nehbGZpbD:jMnYIYDmg27RnWGj
TLSH
T14135D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 d4af7d4943293eebe989e9e8c305730ade0eab1eba89cde4f281d9e76a8abf7d
MD5 0fafd63d1f27858de689184549da699f
SHA1 c4418c111807e5ef78ca32efaf05677e811a64b9
SHA512 e6dabc13c0a131e32d14be2e8ceaf5381b0f31565146861b82513a28158e4baefebca26c06cd2daa387e93f6be22f3041980867c29e2c60285a0efc225fdaf18
SSDEEP 49152:ZYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK07Dmg27RnWGj:XySzPzD527BWG
TLSH
T1F7066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 5b3a6b07b3adbbc52c1391db67d2c83cdee006dbe88f35f546c53c27e4082496
MD5 1293fe5ea2a11057f2c1443ada1304ac
SHA1 bcb87758fc909611ee284378ce15c75790b8b6e7
SHA512 8a6c6745c95b1cdc505e0beeaea38e07889b7accfc3a7e63288f967cd336f65274ba3ad0675a6d4b23749040f83922754d9d9759be4134b491531b3e86d20466
SSDEEP 24576:K47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYlsqjnhMgeiCl7G0nehbGZpbD:K47JUQjairIhCnDHUPfF/rDmg27RnWGj
TLSH
T1E065AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 0c5d65d43f87b84bb38c78a9127bee382ddf96f356df3525632229d058b1db07
MD5 cbcf27858a84e2fcead23eb38cacb897
SHA1 28607e7a823103be4f2e3a2ac14602c9d9e4bd7a
SHA512 f1b57d6d30b5a39e2c1e7b065cefcfb72650edb28b4d4f546f421d24140387e9210e68dc4e11a26cf279ac627b2473665bc3e4558cd76d7cdafaedff977ab29d
SSDEEP 12288:rksf4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:X4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BCE4011AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 8660aa4ccdd5185d912ee53e06566f0f938972080374efcac0696b75df06fc04
MD5 44d3b0e3b4e3c693dc9a8bfb1c394a37
SHA1 4de1c37f3751a88c44fde614e7adb6364073cffb
SHA512 2cd75e4668e9da8d8c16375881e98845b70d7e348f869c605ffc50fd0ff9bb622c71fdc55995fc950ca6de6591024209a0201bca427951cdcc1e61efe6249878
SSDEEP 12288:pelF+XwU3frvqI0LSBYVAMt/pTEi4zw1fTQ:pelgAUPrG0MhpTNQw10
TLSH
T1F83538417626DB5FC6A940326E33C5CCAB707D01EE04AB0772C9873FD576658BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 f51e3b4e4a3fbfd7912ca68c0353ec62abe6f0f6e6578c5ef1ffd596a9b0d59e
MD5 b0bb21c30733770140b390a2e2fba102
SHA1 5785b0d8a42d4adea56a988a4a4e6bf053d293b1
SHA512 fb986bf01c256fe8d7f10191c9a7fbd94ed589f0c7c2c3f9dfa24e9f3453d1f90377d0bb1f7ddc9ba77c5e3cc276edf3554047a141b4e1020e9e3e6172383c8c
SSDEEP 12288:325GFuWfyXR0thvjC0Xlnl1K3/Y3mCOGB:325UuBAm0VKQ2y
TLSH
T1A27519816136E78FC1BA6132072A5B8DAB74EC17B7085F13B3C9457AD86B741B0B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 8545b1b57ec58e13f6e0dc7d418162726bd913aa2eadfff9eb46719c301c09e5
MD5 9a18e23304063cebbd68634c72571170
SHA1 add533fbbd5db6fd42f5ab38bc87130d3c3dd345
SHA512 431a9aef100d71f2177ffe982271b0722f742c82901d65eb0ae8ecb241aadde92f190c498689939f6e721a9bd71cfd1bf0ac443643ab63b97891a1964c277533
SSDEEP 12288:nF7wXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9wsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B6D4237B934C518AF93615B482E9E12DA80B7E669F1044C3BA4778FEF6B18C48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c6ebd7c3186de47143112f9bbc5bf5620bff69381601ab94deb1f491482e0f84
MD5 dacbb374d3b4e9372a1fb6fc3cb2205d
SHA1 f4c694c525771555ebbe24bf5dd9010122d0acea
SHA512 0b386dfbbcb40e34b12f70368b3c058a4ab84574262052a0bb0d98e9412478de49cb070b66747c0b846aa1e99522843c3a1847abc363a5f76dbf1d87fe7ee5b0
SSDEEP 24576:igb6bmBIi49WNNFpg1rSvFv7bYusqjnhMgeiCl7G0nehbGZpbD:igb4mBIBhGFZDmg27RnWGj
TLSH
T1D3659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 bf995dfccdd62d5e89e9eac140dfae2f5f3cf7916068f9924b23b340731c6db5
MD5 191a9e2c35bb0479a4736c5e29226dd7
SHA1 624b36e231e18fd4784da0b8f543bb28dbddf076
SHA512 e54d84312f312a722e54ac7cd7ca5a85e317fbe6031d336ae4a180f6143dbf6aa242ed48627da96770264fa8524c1c1e82085f988aa155f61b2afa92829a12a7
SSDEEP 24576:RG88u8FpJqH1nzria7/m1sqjnhMgeiCl7G0nehbGZpbD:07ZFPqV6a7/KDmg27RnWGj
TLSH
T18E35016577E401F1D477D138CA868667F6B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 6649c6d789c11550a1d70b750748dceac08f4805a922cdb180066536e212c21c
MD5 03c62e2b9f74a4d402e1295368ff83e4
SHA1 e6b5f59bedaeba79aefb0c94b395c42b280740c0
SHA512 07a94122813299376cf4c2db47047fe6f30735203194238f112f5c44ce7d819c62172ebbee9c9df0b4f4a97f4c5f6dacbffd2c233f5821351188863858433a1b
SSDEEP 49152:DBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj1Dmg27RnWGj:sG05lO43bgD527BWG
TLSH
T1F9D5B06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3412abedb9290ddd3fe304321e62a2da2d52492e5e6de1ee543dbd2acc8be222
MD5 e63609001c5f2884d8a105db20931b6e
SHA1 8af1b862d6095583941b68d4b2fa57883248f413
SHA512 12d524f4170ab0cdb41d01144ecf6079f3542d84a19ba3f21f12e64282c35f9eabcd3eea72d32b56a7444e4100f5ccef9f5d8963b70476b82cf6d47ea360bbc5
SSDEEP 24576:1fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnnsqjnhMgeiCl7G0nehbGZpbD:Va5POZ3hJt2pasx2+mNDmg27RnWGj
TLSH
T1D065BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 7951f099dad027f2d07e80cf7591459d1a0d1c8ee2258cd43dda33e46c6f93fb
MD5 eb9b209468cfe83d70b8d657e4e9fc7b
SHA1 e253e8c4ffff8cfcba6f18a75f4fcdca6689ff98
SHA512 2e0feb24ddf51f5b4286695747cb2d70da13f3a13666d3447460c2390e8f32f02fd7cfa0a9a7e5b5a28bf0e5e7d9d25949ff8df9aa72502d702385993077100f
SSDEEP 24576:jNcwHdjbyQ4nLC18lb/EOjowL7FkdsqjnhMgeiCl7G0nehbGZpbD:jNc/zEOVHFqDmg27RnWGj
TLSH
T1B5857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 896e0a2e8f8d302a75667091d1b490c883054a8bd3011ec3442493955073b565
MD5 11d6258d8321adabd5773fa0b1cadf9c
SHA1 021ebd492da344cf0b8b592239dc9c4bc5262eb0
SHA512 4bb60c66c78af397a9ee16717f0f40681fe56a0556f7440686f7e165f11c02f79ef5a98f80135fad41a5c87fc2c97e3787fa56d3a1c3ba6ee41da5f7106f9afc
SSDEEP 24576:z3kNvNnaFeYhJNtmZBmbsqjnhMgeiCl7G0nehbGZpbD:z3MwBtOmPDmg27RnWGj
TLSH
T1C955AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 a2fe19968b1f3ee0b2324db3dd14848ff59757c94bb93d9cce298b25feeb6f8d
MD5 6f31dda35348accf5cea3c6e9a898312
SHA1 dd73cc2e9d5618158c1a1d1383d878446a61c7de
SHA512 2296b88a32ebfbd337f9b16199dbaa45ecbfbcf7673abc792ee1af6ec7bb1f7046375cb5ed5aa7727408f21df829ae19d535b89dae4afe23d5d6d8c8c573965c
SSDEEP 12288:uHvUrBFrEjwaQRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:uPUr+NQRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BF05F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 4fa561fd90fe1942b216a4fd4d5cf98f166d561d626619f9a73eb5c00c0a605b
MD5 f6d332a7f85d4a93f6521df6e9e49a52
SHA1 a3661766c732a0b543dd9ff4d85efbc74cb40d81
SHA512 56cfeb6f9856a4f43e0cbb3bd23b36df48ffa9ebf12185aa283ea032475cb36a951cd2150d48e90503856e41542a9fe12baf111ab013d7692ac5123c9eb76076
SSDEEP 24576:pD3FHshBIYQgA0sqjnhMgeiCl7G0nehbGZpbD:pDVHeBIAAQDmg27RnWGj
TLSH
T18325E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/456-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/456-384-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/456-89-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/456-95-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/456-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/456-382-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/696-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/696-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/696-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/696-370-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1356-52-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1356-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1356-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1356-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1356-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1356-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1676-314-0x0000000000400000-0x00000000004C0000-memory.dmp

Download

memory/1676-77-0x0000000000400000-0x00000000004C0000-memory.dmp

Download

memory/1676-6-0x00000000006B0000-0x0000000000717000-memory.dmp

Download

memory/1676-0-0x0000000000400000-0x00000000004C0000-memory.dmp

Download

memory/1676-1-0x00000000006B0000-0x0000000000717000-memory.dmp

Download

memory/1676-7-0x00000000006B0000-0x0000000000717000-memory.dmp

Download

memory/2172-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2172-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2172-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2172-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2308-54-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2308-55-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2308-61-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2308-270-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2656-368-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2656-108-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2656-366-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2656-365-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2656-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3000-128-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3000-137-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3000-134-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3000-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3000-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3520-79-0x00000000008C0000-0x0000000000927000-memory.dmp

Download

memory/3520-84-0x00000000008C0000-0x0000000000927000-memory.dmp

Download

memory/3520-309-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3520-78-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3764-113-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3764-122-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3764-115-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3764-369-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4148-381-0x0000027C27F20000-0x0000027C280EA000-memory.dmp

Download

memory/5180-65-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5180-67-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5180-294-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5180-73-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5844-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5844-14-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5844-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5844-22-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download