51137ed9218bf959e6befbd3d64adfadc390f0057fe4321ac4343b29f3985e1e

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 16:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-09_7311c87f359930f38741e8f8e0e21894_amadey_elex_luca-stealer_mespinoza_njrat.exe
Size 1.6MB
Sample261110-tkjfgsa18p
SHA256 51137ed9218bf959e6befbd3d64adfadc390f0057fe4321ac4343b29f3985e1e
MD5 7311c87f359930f38741e8f8e0e21894
SHA1 41d84171ad7b89480b79c24c9a7b25626e8ff15c
SHA512 4950e3d394a6dd5d17cb3ebe48a470bc3fc73288b5b1f75962a16875668b9b4e8c77e4e54f3b2820c85389cd355a9025e691119eb11df36be00e306682d71cce
SSDEEP 49152:Beu2KZvttUciFCvdQR+ft983Dl3gEe8xA+:BeuxbtUci4qR+l9EDl3VxA+
TLSH
T1C475E4327593E8E1CA4D5470CF299BF412A46D7DC7F687AB61C9BEE4BB3009134A610E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2708	elevation_service.exe
1900	elevation_service.exe
2652	maintenanceservice.exe
1988	OSE.EXE
1204	PerceptionSimulationService.exe
2312	perfhost.exe
4772	ReFsDedupSvc.exe
3452	SensorDataService.exe
4144	ssh-agent.exe
3484	AgentService.exe
936	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-11-09_7311c87f359930f38741e8f8e0e21894_amadey_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-09_7311c87f359930f38741e8f8e0e21894_amadey_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\bbce11b53ebf6fe8.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-09_7311c87f359930f38741e8f8e0e21894_amadey_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-09_7311c87f359930f38741e8f8e0e21894_amadey_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\PublishJoin.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-09_7311c87f359930f38741e8f8e0e21894_amadey_elex_luca-stealer_mespinoza_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4296	3924	WerFault.exe	88

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-09_7311c87f359930f38741e8f8e0e21894_amadey_elex_luca-stealer_mespinoza_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e506b48c2d71dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000da4c858c2d71dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a2f1e58c2d71dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001f8e8dcf2d71dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000910d818c2d71dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c547598b2d71dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2708	elevation_service.exe
2708	elevation_service.exe
2708	elevation_service.exe
2708	elevation_service.exe
2708	elevation_service.exe
2708	elevation_service.exe
2708	elevation_service.exe
1900	elevation_service.exe
1900	elevation_service.exe
1900	elevation_service.exe
1900	elevation_service.exe
1900	elevation_service.exe
1900	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3924	2026-11-09_7311c87f359930f38741e8f8e0e21894_amadey_elex_luca-stealer_mespinoza_njrat.exe
Token: SeTakeOwnershipPrivilege	2708	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	3484	AgentService.exe
Token: 33	936	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	936	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	936	SearchIndexer.exe
Token: SeBackupPrivilege	4772	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4772	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4772	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4772	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4772	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4772	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4772	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4772	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4772	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4772	ReFsDedupSvc.exe
Token: SeDebugPrivilege	2708	elevation_service.exe
Token: SeDebugPrivilege	1900	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 936 wrote to memory of 5596	936	SearchIndexer.exe	103
PID 936 wrote to memory of 2472	936	SearchIndexer.exe	104
PID 936 wrote to memory of 4732	936	SearchIndexer.exe	105
PID 936 wrote to memory of 4360	936	SearchIndexer.exe	106
PID 936 wrote to memory of 5364	936	SearchIndexer.exe	108
PID 936 wrote to memory of 2608	936	SearchIndexer.exe	109
PID 936 wrote to memory of 1304	936	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-11-09_7311c87f359930f38741e8f8e0e21894_amadey_elex_luca-stealer_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-09_7311c87f359930f38741e8f8e0e21894_amadey_elex_luca-stealer_mespinoza_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 756
  2⤵
  - Program crash
  PID:4296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3924 -ip 3924
1⤵
PID:5888

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2708

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1900

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2652

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1988

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1204

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2312

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4772

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3452

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4144

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3484

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:936
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5596
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2304238888-3968896904-642854331-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2304238888-3968896904-642854331-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2472
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4732
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4360
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5364
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2608
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 29f1796567b00b5d6c517554a8666933e11d42d7df9622133e88700669deb8c5
MD5 121ad63f8674797c62651f890369ad37
SHA1 4ca22e675d603ff62a323c3f67f6a751e5d5748c
SHA512 0a4f4c8cae523e223023a027b3456e6258c4c030cd3018244d1460a4baac6bb41debbab9ea3f14a578ecd5f70cf961c3bdf4ba978df5f7631e13452df82aed6b
SSDEEP 49152:Kb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnBR+ft983Dl3gEe8xA+:83q6mjBCR+l9EDl3VxA+
TLSH
T102D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 6a4f7f0345ee01e45672a6cb7f401b3ab4a62651cebc14d5651a3a7c6a178313
MD5 5039eeb5fae0d6ccf659301d624cf447
SHA1 fef06e69085e6f63e9b8f67304873c8ab4f1ab90
SHA512 90a836701edd15ad55c246b722a9e52e6406fbcf2e97b5dc011dc9c7ceca46db2a08d5d9620a3676123308a017746973aa38bc5d7ee8d1cff06cc95755929685
SSDEEP 24576:yXYfDtczAGRPWxNs298r3OCDIjG3gE9ow+8xA+sRPWxNs298r3OCDIjG3gE9ow+8:Ztc3R+ft983Dl3gEe8xA+sR+ft983Dl1
TLSH
T1EB6512287B8809E1DD6B81BDCD92D011E633BC4947B4E6E743A089625F373DC5E39B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.1MB
SHA256 2468da74f13659ce7f52460fe85be7c0200ce19db1bda18943fdd4661634a260
MD5 d6677bc46c0478dfbb95ad27c39ff178
SHA1 57296fef94d55fe718be4f68495d28824c495d0b
SHA512 18d7d9f24a01d4702d4f63aba3e351e76e02626e2ffb392a8e5476084fd7d8e682445543e8f0fa58240ac01ed3066145380258667f382aae85177530cf3455c1
SSDEEP 24576:q0Le5ji0hmxhrMcRPWxNs298r3OCDIjG3gE9ow+8xA+:qPji0AzBR+ft983Dl3gEe8xA+
TLSH
T126A5AE16F5788371D073C0B9C5D2A69AE97230861B308ACB4286D77C7F67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9c5bdd4b39adf1826839a5f843910906ce11c0e4e2f59f0801c1c633b98ddf25
MD5 149930296a7bea5229e604f224cdd72f
SHA1 e463fe01eda9d955c6e6fd22a78477b6e81f508d
SHA512 b9752c64a28713036b313c947bcb1159ef0c4db4f0c4e254fcbde88f30214bebaf47966438c98af2d9dcdf41aad1ee58da3a6ee5626080ed6088355a27addba8
SSDEEP 24576:4a7/ezSC6vUyD/aqgrvWj6q8wyuCRPWxNs298r3OCDIjG3gE9ow+8xA+://ezSC6vUzPv+HjylR+ft983Dl3gEe8H
TLSH
T153755C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 33b383df06d08e7da2acb7e9784aeaa56c420c43ebce94e7f0f7c8ee0c28cb3d
MD5 4afa3980e451d0229159d01e8030ac01
SHA1 ef020ea7cee0def35bd5f3dab5a3338f29285dfa
SHA512 a4a99e999183d2a547ad4c14606d13fada0505165dedb008f562c2e579938040b197511f50654497647661bafa9cc3a72e221032e6b15bf414f8f00fce3807d0
SSDEEP 24576:7VbqPb88hv/l+BbRPWxNs298r3OCDIjG3gE9ow+8xA+:7VO88hXl+hR+ft983Dl3gEe8xA+
TLSH
T16855AE66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.6MB
SHA256 aaf8867d050019c0a526796849d97d71127e338046ab7085e243dc8fdf8faf9c
MD5 28ccefe621a7be9b7e1305df1cdee4bf
SHA1 794f298489297925cf0ddafa055d707533ab959a
SHA512 1ca63765af67425ac2b267c52719a7856adb34daa436f8e8959f3e8350c7dc71eb6a6a3b7758a4f40f9112adfbd05d8277126559712d8aaa4f12548e03789791
SSDEEP 12288:WGoRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:WGoRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T16A7523012C4C75C2DB2F81F9998AB0E2A1339D4D38F829F3D461EEA1AD7D25ED980177
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 fe032dd9324489b74acac24d276ca21d6a77c765672cad68a5d8c6e4a78e36e7
MD5 4474de908f80c442d7b53963903ef83d
SHA1 de3dd07907b8217c90ba24f85201a0223e9bb208
SHA512 7389be13e284a46c63f44d467253f377fbc79a467b7e85ba63bcba6a15e6eaaf64f68d4892c2d70a597520c291511ed2e66a0d246be85efdeaae2afd37ef4077
SSDEEP 24576:wJIUjRPWxNs298r3OCDIjG3gE9ow+8xA+:wJIUjR+ft983Dl3gEe8xA+
TLSH
T11195CF3BAE28FCD2C27E8DB95A91C240E77278304B61A3CBD165C20EDE235E55E75C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b511cfcbf383ce18d670f20145660e6de1d39df42eb604712a0efbd72ce9eebd
MD5 920936cf0664d68afec2cccc8caad949
SHA1 f2aa881ad65ad1f54fbfa419dc239be70906273e
SHA512 f625ea75f8ceaeed3944c4e22fb543091c94ebb8be8c42449b6657d3050d5586a308ca6615a27121fc7c03082d1f8ca72c504a41b9370b41ac9e605796b6663d
SSDEEP 98304:RQvGAdlCEL8c/WRNw5CyR+l9EDl3VxA+:OvyEYc/W3w8y4sDlF
TLSH
T1C9267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.9MB
SHA256 29d962990c62779ad2a2c0a8ae9a63627ccbaaf4263b96e5d5cd626c57df151c
MD5 6a365316cc950e6bfec8d2ed9901826e
SHA1 fbf82c16d408186ecad30136185c43bd813656aa
SHA512 7005f51839a79fba97bbcbd6522f938dea7dcd10e3fd3f14b8cb1cea02beb0597b0f69acb10f02a7be7de14ce7e7c8ffa7d1e152225c16c693f71052fcbc2bb3
SSDEEP 24576:QfewsAjxRPWxNs298r3OCDIjG3gE9ow+8xA+:6ljxR+ft983Dl3gEe8xA+
TLSH
T1BA95E031FE74E032C77F0DB61B26D716543D79204BA11AC3E3A88E9E59342D22776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 97d5dfa19c305382a490414c4f3b9bcd98a1f636616d24216495a00f1b29923e
MD5 6cc08ea084a07f51786d204241c217d1
SHA1 214b1d4f36be063407f5d3a58a5093cbb09daf4f
SHA512 024b30d61f3a4be0faef7eba86f90bdbf85a3c049fa65eb4b33a4464708848a5037cdc88db240affa027cd5f19ab0f9fc20267e95f876481ca9344bcb59bd590
SSDEEP 196608:uUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHJ4sDlF:uUEtQevvqc2W1cpV20I32R
TLSH
T125474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 36538d8252bc9a4e613deede38e06fbf060d619871b0c8b38b4aa9d85bbad7e7
MD5 0a4315a40b1c2d0b8c3e1a5afd5bf5c0
SHA1 09de2be1b27e10041e3206951592548aed2e2089
SHA512 fb3ccd0c36f0e3357ac071e813c12fe1cc7741c1a9317a16fd5430b21ffe07b83d1c64a9bd59ef2ed220994da186aa3b21315ad5f1943636573d684b033c6ff2
SSDEEP 49152:CCbRquA/m2yL5zLfFiV+XenmE3/zRR+ft983Dl3gEe8xA+:Hoq2Vjnm2R+l9EDl3VxA+
TLSH
T1AAD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9ff8f9842aba7c81affa6cd13a872e33cec3e47f3c0e7b38a3306840122922cd
MD5 32b4e59d3576ca1a2a1cce2adb69dcaf
SHA1 89024b5d2728bb184b2598641f04fa3e18c39fd2
SHA512 8c1e804f0035c1ce7b2c409d37250c775c6a094204d40594d7aa6804c3cab53e9a85834d13741d1db45637e3a431cd9f04cb5965fed6974c196eacd62731e3c6
SSDEEP 24576:vAhGL6IFoiwtA5l7S53WRPWxNs298r3OCDIjG3gE9ow+8xA+:vAM5Foiq5mR+ft983Dl3gEe8xA+
TLSH
T1CB35AE80EBF955D4F5B3AAB899B69171EA76BCA65E31C20F2150C11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.8MB
SHA256 fe0113e89560f9c4bf6ab6981b85939aa08cc9b1b875139c5259e1267201c22b
MD5 d2f4e5b830a6c77ac6397870fae7e93f
SHA1 a7fd1c19cd750b1b9ca050ccde1000cb2f8b9b5c
SHA512 efa42ca31dae854dbdce1320ea4478b449e950d4b92a834c9824a70bb768c1dca4f9f6b00fcdbc2d29e6b7e3d2001ad598ab9b8469b8272883b9d4ae963eb19a
SSDEEP 24576:NwuROWFRPWxNs298r3OCDIjG3gE9ow+8xA+:NwSOqR+ft983Dl3gEe8xA+
TLSH
T1F685F1453A981CF5E96B81788587D132F7B3BC022A75DB2F4760C65B6F37321AD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 5ec8a06a724a64d7461850ccbaec40b7fe0fa2ccc3d5bfa785f3c07c6bd3f22c
MD5 7fcf9a840e00168267e5cafb47e495ca
SHA1 a2c677798f2fcf22ed7344adc670ad734d7bdaa8
SHA512 859ca3b60e708bef19b81d99f21ed1908332c09d2425ab0d48093a1789e3f72ae9b7f694549f652f150a69c419896540557e8badb45d61e4df968efc086b3d1e
SSDEEP 24576:MZukRPWxNs298r3OCDIjG3gE9ow+8xA+:+R+ft983Dl3gEe8xA+
TLSH
T1498512493A9830F2D66B81BCCDE5A141E373784627B513DF542086A66F37ACA9E35333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d0e25937bf564424ae6e99f082d825b2c27ba2a651a8b6b7a4db865117e1ab16
MD5 d924a9f65e755012fac0d5d7ae24a93a
SHA1 dc1f0af37ee9ac0db7f8b5324f38434598b1ad04
SHA512 3df9436e0c488304f25d462f17c6c189de74b7cfcd5bb82640108fd7a31e256225ecd2065eb420fcf3b7a769ccca956920315b1ebe391c0d783ba03ef2d761ed
SSDEEP 98304:HQRQyi36YOcPDLvw2gAf+PN3nR+l9EDl3VxA+:WQyiKanX+PN34sDlF
TLSH
T121667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 3447269695a63082d46df6d02605766ca7e1e05c8e91874f9c72f22d5f1bdf7b
MD5 592248449d67349d63d17268539aed81
SHA1 5e3751f85340378df95160588af841161d204eed
SHA512 ad3156193be48f3326c5c01ef770dcd252c239881e8a4e308471027bfa1cc0372c2afdc669e22e60c54e45cc582b271e3f25e2bcf54dde20ca89958698832231
SSDEEP 98304:CQRQyi36YOcPDLvw2gAf+PN3nR+l9EDl3VxA+:ZQyiKanX+PN34sDlF
TLSH
T16B667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a2ccd3e1aa86cd11938e318cc4b4f8875bb289983bc7e83d1f21f06ee44dc4f4
MD5 8799b50882517bcf2faa95bc2a58c3c4
SHA1 696b1b49d1140e0917a23b8054b170e3eed74c47
SHA512 b6ded9257f7a55dfebb595b4c6539c2009e3c8bc01727018be529a478b44e34b333c87ae205cfd9ab676ce28c7d21e238aed7871c6325e91594d722149b61825
SSDEEP 49152:V68Qg55nhkeWu7PNU3/BR+ft983Dl3gEe8xA+:jthTRc/BR+l9EDl3VxA+
TLSH
T157B55933B2F600A9C44DE1769F4A973196D27C758FE0E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 cbcf6fcab37966fa3c1452b737def15bfa5c328c998ad2b1dad9f906fb88f875
MD5 2a73cb5510feab6423af8434aa25088b
SHA1 75b9b5251684886f0b50d594e246ba707f8aeb63
SHA512 3aa7a7f00ea01abaa5a6b2f5a1d94e3a6b3f77759a8f9725ed5d58b45e956217a20331f604a7f35ad93a5fbc6caf07e7d6816ff55e0e36578e7439b526cc9931
SSDEEP 98304:vy5112gYy5azzVvU69nLKnhZoR+l9EDl3VxA+:iLIHRWhu4sDlF
TLSH
T1D9167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 512daab0352271e99df2ecf7ab9f8540f138137be52d846c46c107fed6ca06d4
MD5 13536e2f921f3a4c0a1cfed99466b568
SHA1 1a84ff14a6faa7a9f661c7da1f9b162168e0a26f
SHA512 efe293307cf0ccb7661ac6ae7a0a73cbbc742509ab8259534558e6d48ca71c897255a651d76a35ca5833b0ec241baa37791328115f71825114490a828b1f7fa6
SSDEEP 49152:jB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glWR+ft983Dl3gEe8xA+:Vu6JmIxd2dWR+l9EDl3VxA+
TLSH
T1BFD59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0696406248b5060ba35380512e8088c8c391af76fd56fdb718fc221b27437f78
MD5 5149b1bddfed90c3acaf98be8540abe9
SHA1 430768c7ebba42dd295ecee7c97a9653ee2ba362
SHA512 e2f0cadd80de5b241af568be8cdafceda70465ce608a719739534922391a9cb874e873af876d15fca549e84e8320dce4050636ee4f2f777232d573b7a115749d
SSDEEP 49152:G1hpsNoJpF1A67U44CwH7R4xDR+ft983Dl3gEe8xA+:GmifPqR2R+l9EDl3VxA+
TLSH
T1A9B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4e28456b840976b19d82240a1f8b61eeb4c5899549874b86abe9a701a22a772d
MD5 1011c8279bc803fd8133320bcb435aa4
SHA1 9aac47bff26ca0ff3479cdd8c8914f9df31ba3ce
SHA512 f5549a272a2b5ecf2b1a4ca1c67818abf9e88842d0bd290a901b26d6754b1beb1d128ee40c6ff41807268f38456d99de3782d75f43fe6185a78d7d4a43c18118
SSDEEP 49152:5SuZQIY0Be2KkRVtOnks6NMHqkR+ft983Dl3gEe8xA+:X5dKqi61kR+l9EDl3VxA+
TLSH
T13CC5BF03F2E941E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 dcc10220d78ff4917e0afdcab39569014653345f7832d74af1b8f6af9fcd5200
MD5 3704f7f138e4f9c69280c692df5fe6aa
SHA1 21a56351fc6d3e969041a1d40ea6ebbf3ca751ee
SHA512 f03407471db7faa8d38b203bed74851ac0bcc779657c7dd0116bed9997774dfaa6534548a8c7c1328464c8a474d092aa519010152037d2bf84aa46da5d94c955
SSDEEP 49152:rhtSn8EApI0figjgiDn0AP5w/R+ft983Dl3gEe8xA+:qX2iWphKR+l9EDl3VxA+
TLSH
T16A95BE13F2D901E8D05ED178C7468632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.6MB
SHA256 1b4d189de8c4906dd71c9d6b20cd4b7757b048c14b905f4ebe4af37f1a58111d
MD5 017ee2c33ffac6e66724e556011d41d4
SHA1 b0b211f872cc8ecd9b4cf89954e9cf65ff1d144f
SHA512 eb7bba231d9b280ce625e205957b6e3b00ae7124327f0a9d263090ae46baab58f79f8a78e209217191639dc7458cbf950288205eeabc7fb817e7be47670c46dd
SSDEEP 12288:NQRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:NQRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1537523003C4D75C3DB1F81F98A86B0E1E0275D4F78F925F3E4618961BE7A65EA9804BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.6MB
SHA256 ec09284d2d340da7f1880b5bd31a2fdbf1e10a0aada5154354b0825aa5debaeb
MD5 16caf4bbe413f5c7eef407c111c19c8a
SHA1 361daf3e36b5b55aa0641da0ef54cbb3c9ea383d
SHA512 576caec7a1d03e32b0a24f7cfb0c364873360e2ada198d59a5f1ec24eeb8e2855d494bb0bc12dafd213e99427b029d620615df63ce234a1476eb6b46f847ec45
SSDEEP 12288:z9RPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:z9RPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1DB7523003C4D65C3DB1F81F99A86B0E1E0335D4F78F925F3E461C961AE7A65EA9804BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.6MB
SHA256 a57da07fb724aa5030fa78294daea23f9100c742a1a7a08d58190e50683b3d37
MD5 456bfb3ce43cbd6ee6fa02fdb09d727e
SHA1 c1497a580027c348f97d68a3007d500417c9be59
SHA512 821efe5f35ebdaa10e3f68f0456f6ec0fe26baf6c86d1b24d1c83459ffcd205eaa2aeef123579b103f76a4e4ffc24add88714d2710ea76b3527afea602b57c4c
SSDEEP 12288:xrRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:xrRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T11B7523003C4D65C3DB1F81F99A86B0E1E0335D4F78F925F3E4618961BE7A65E99804BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.6MB
SHA256 a7298041bbcff4b48d2c3743b5a134b67cafc798345c1a16536a2703c839e2a4
MD5 7bed9c7542e4837173600d3a58e81d47
SHA1 2e8ed2f4bc9b30db685f235999f518bbf76c3e92
SHA512 a1b7e1da6ffbdc05beaae3c38b88db9d9543f8a40ed7382e3b499b39e3a08a1c5220dbeaa75770999bdfd10c9f629fd45d452ca68467c58739b8c25b88217c83
SSDEEP 12288:RV2RPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:iRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1317523003D4D21C2D92FC1F9CD86E0A2F273BC8E79B526FBD41049625E7639DAD60A76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.6MB
SHA256 3e0dfd1e58904272eacb345ce6d7c1bc49276307a4f91d4708ba14e075322ed2
MD5 c3e8fae49edeb8d5e62648bdfdc88220
SHA1 5550ab7b05708ffab576db1d7918d5c0bf0762c4
SHA512 f3a5b18039f4efa39e9d8eae2397b70e93c50a2d053152126f146d02cd570a43463723d6dde6c3f67e80ec27e39475823c774b58ffb5f825c843c6f1284efa8c
SSDEEP 12288:DORPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:DORPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1677523003C4D65C3DB1F81F99A86B0E1E0335D4F78F925F3E461C961AE7A65EA9804BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.6MB
SHA256 12d8c27f33c9920cd41340a8edc5d5e2ebe4a381bab78b1c3d89ca6c98e8f270
MD5 7ea7cb22b118328739354d57fe13dd04
SHA1 3da51b3bba8b574a33710d3fdabcb30a2ebf45f3
SHA512 8aecf68a3b029300e92a8a758151030cee784483ed71a2d73298bb58c2fb5b7e09aea1e96d559543c70f381339d81faa8c601abef13e944595da5d1069f63df0
SSDEEP 12288:h5RPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:h5RPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1227523003C4D65C3DB1F81F99A86B0E1E0235D4F78F921F3E461C961BE7A65EA9804BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.6MB
SHA256 c75097eb1842e785355bdb3334fe21bac998dd0928912cab2c206ed243fe3600
MD5 995a693156f1aa2be77e68aa43416b94
SHA1 1c74422584ae16515f6cfcc1f7e680d793959502
SHA512 90a332504c7089f98252892ca0977866364fec6b17a81fc77ce4d2ef4fe0a05b5c6dee7c464ffce90b6928fbc0c2501a32059794d1347fe9a5e7c380167ba73b
SSDEEP 12288:NVRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:NVRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T16D7523043C4D65C3DB1F81F99A85B0E1E0235D4F78F921F3E461C961BE7A65EA9804BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 cfa9a509fb721243f7737728397fd640cf31b67157df47f7d4b825c7aa5bb7b0
MD5 ed8210a1431ad8bfa7be854f2f63b0e7
SHA1 8ea3e099647cca66cc0a1bd117ab754fb4f97909
SHA512 a29715f14e1a48d042767ce33ea580fd6aaa0ac064a3de9867023a1b114f4e5d1d9e69fb87b362060cff350fa1512d7d37517ce0040de4c7f2ac10ca913b091b
SSDEEP 24576:AZM3zFVSOdRPWxNs298r3OCDIjG3gE9ow+8xA+:AZM3zfpR+ft983Dl3gEe8xA+
TLSH
T1A7950194779418F0EC67817ECD559912E2B27C4A1AB0C66F03B036675F333A11D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.6MB
SHA256 6cf796c7cdcf561327aa19a43c30119d97a725957df89a7635a6b8fcce5504f8
MD5 c59a5e71db0fc554ae23448b03ff271d
SHA1 28c5acc1eebbc1eb5f475664d6bafeec0ff71a9c
SHA512 71aa3fdc86895bded3138379419e40d691fb733525fdf8ac6dbed82f32b3168b193b5f693d9926ab7cf05b90ac50c1ea4c8597529cb7e313f99f4fa242c8acaa
SSDEEP 12288:8URPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:8URPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1207523043C4D65C3DB1F81F98A86B0E1E0375D4F78F925F3E4618961BE7A65EA9800BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.6MB
SHA256 7688c92ec5282bbcd4d8614cb3592241699c97930bb589ac25254d2c612f3e20
MD5 441a32a9d41828bad185dc16e39b995c
SHA1 6d797450c0147e85174af4821624fbf556047301
SHA512 3152f40f4ed3e1a016a617a8f25bbe383cceaf49c9af3310780d4b6fa9683dfff9fe6b78c6c0034067ec2072c9002d6eab961cfa4f178ab1fe28a9d93d7e62d3
SSDEEP 12288:jYRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:jYRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1847523043C4D65C3DA1F81F98A86B0E1A0375E4F78F921F3E461C961BE7A65E99804BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.7MB
SHA256 525c88282f19aa8b7bc56a60a97e7506c83138a5dd5f58cf460986ac213905fa
MD5 85b45f2be39f65938a4a16096d890fa2
SHA1 df79341919b12ade3ffbbc2784ae5795789c910a
SHA512 4c63d0cdd0bd2a0a73d693f2001fce5ac413c22091c10269f29d770c26a90d4af3271ba389ad63a587d791e2dff7b039f2877121e7519483104ea131132307f7
SSDEEP 24576:szyhRPWxNs298r3OCDIjG3gE9ow+8xA+:sKR+ft983Dl3gEe8xA+
TLSH
T13A8512073A9930F5D13B8278C8921952F372BC361B749AEF526046722F373959E3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.6MB
SHA256 81b6719efb2761671871ef3d317ce28cea81d6686788ea2ffd25641fb9383ad8
MD5 6391ce40afd6b78db1e73091afa8bb1d
SHA1 523b06589fb8d13719542e43328d8c4302c6a9d3
SHA512 c85dd67be2ab78346bc42a688aad8db0ccce8c5883c1e005124cdffcfd32b88aab60b5db3dfac814e492c74ab385531038010f77b4df971f05bb75b74c34161c
SSDEEP 12288:XURPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:XURPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T18B7523043C4D65C3DB1F81F98A86B0E1E0275D4F78F935F3E4618961BE7A65E9A800BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.6MB
SHA256 63002edeef70eda209e93701a5887b5a34699373b39a9e7429dc7bc5a0444937
MD5 e57c6672f57870d6d9652f3c76e8f060
SHA1 bdf9fa41d366efd43a17cca4848b1f5aec41ac48
SHA512 bf6f2e9f8aedef362130e5cd28d41cdacb65ac0d943dd055f977fc92a3d4779e0bd06f7e679e5e94615fa86a6d29f7d5c9d9024edf3b2bf3425a5cf20bddc310
SSDEEP 12288:VURPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:VURPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1777523043C4D65C3DB1F81F98A86B0E1E0275D4F78F935F3E4618961BE7A65E99800BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.7MB
SHA256 2490d4122e7cd0afd243cf5d6188b5b2b56589590a1b66ef7ef2ef637277f14a
MD5 8a79b0adff16124dd4af3a534f7d504e
SHA1 c03f9f09431dbf8c50ec067d63d64c3e9d4b2dc5
SHA512 90759194aa5635f2b566201cf54ac4e29ab268ada395f790afc9e73b1495e0856b2ca3406d42cbf99a1bde0130622389830b914eaff919d845e709196167a4fc
SSDEEP 24576:3zyhRPWxNs298r3OCDIjG3gE9ow+8xA+:3KR+ft983Dl3gEe8xA+
TLSH
T1298512073A9930F5D13B8278C8921952F372BC361B749AEF526046722F373959E3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.8MB
SHA256 416ac7476124808c00979d9dfd7677e3d221396b66c668028e8034de04e565f0
MD5 0aea14efdd3fdc4b68eb3115c1b91865
SHA1 37154a4c20fd03cb0fc41d5e95bdf851bc96b77b
SHA512 4c57c71967ad9d73ce6888ece5acb272a8fb431efa0af4dda64643fc474831b1500435638b7f7aa9f04256d7701b7f8d44a3615c5c16e42664d070aa0e83f1cb
SSDEEP 24576:8T8aLl3z0zD7RPWxNs298r3OCDIjG3gE9ow+8xA+:8T7LljCR+ft983Dl3gEe8xA+
TLSH
T1C3950194779418F4EC6B817ECD569912D2B27C4A0BB0C66F03B036675F333A15C2DBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 2.0MB
SHA256 8a433eebacbb288b22713333ee45d03b00dd0efa336c9b1293e297023b5dbb14
MD5 8c37077072f607df6e964e04bda0b15b
SHA1 730a8e89f1d0e7532208a1e54b6247878986d4b3
SHA512 53eb73f2870dd7a9d36d24fa917e0b683a5b5c76a1cde582d7628af5916b1c6513414623c026a232570ae6af7379576b2808e81d6760e5bc345934229c577310
SSDEEP 24576:s3rd9CHKy7GZHRPWxNs298r3OCDIjG3gE9ow+8xA+:Wrd9CHKyapR+ft983Dl3gEe8xA+
TLSH
T197A5CF90B7E810E4F0B78A75CD669512DA767C5A1B71DE8F03A4261A1F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.6MB
SHA256 fd1fc8000a225e0e7bb1a9621e3a6529449635220963087cad60e09b5bbfce88
MD5 1d8f177f42aafa77b5debde5714bab1a
SHA1 2a6f46cf7f5afd3afd467b58cf5d1e0a04537f7b
SHA512 3e8d70feba05cfda1d60ad3690d8694c51c5992f03a8be9462d9a2f6fef97a14587d657e49adcda5b5b453126c5bb1d5a2d66613085bc9b0fb1f53397ded15ab
SSDEEP 12288:yLRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:yLRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T18D7523003C4D75C3DB1F81F99A86B0E1E0335D4F78F925F3E4618961AE7A65EA9804BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.6MB
SHA256 b5badec07ddf05b9524009394d69227f3b14e7edeb083457f63cc2ba3e036143
MD5 4d837d8f54718cf41c5d6d3ae475803b
SHA1 9590aab9ebb83348656707610172648b03545f69
SHA512 05d9defe4b1615d3cd198924acef18ab3abe4c4672483588b33a1f45ac01210ffbb631fc5c9ad5c4ab6c1f672d2c6508b8cc9b1aacacf6abfd6c3208b882c3d8
SSDEEP 12288:wBRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:wBRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1697523043C4D65C3DB1F81F9998AF0E1E0275D4F78F925F3E4618862AE7A65E99800BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.6MB
SHA256 afede86f0cfed11a75a43c6af9b4090591eb0386a068da3c2ca961bfa2bf7786
MD5 1f81fa83570452a12ef5193f2dbe2fb2
SHA1 46f4d796181a9ec1e9b91faea84ee10e8a69a0a5
SHA512 a075df1e84f07817cfdd95cd9990a2f99d9cea6352a6ffbc48bbae7f0b48d0df2ebb0f65acaba02c2a4fa6e7c17a2d3ccb3756be5206fbac3b93e2ecf197ff91
SSDEEP 12288:06RPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:06RPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1097523003C4D65C3DB1F81F98A86B0E1E0375D4F78F925F3E4618961BE7A65EA9804BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.6MB
SHA256 a493f0bf2e58f0a0633e1b4e358d0d229b2eed3da17ccb883512847d28c3b628
MD5 b9ee6e8ba7b209235edbed57740a4188
SHA1 39043a4d90ccca715c65c72677f79beb055a4fd5
SHA512 d1c9076d8a5417ca3731ec5d12b07e3ff8dd9e21c5b4e5793f6171e13209b92235d693363b490e7a3025a223e08d5469e655bd79af8ccf103a1f92ea5f3a25ea
SSDEEP 12288:BURPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:BURPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1397523043C4D65C3DB1F81F98A86B0E1E0375D4F78F925F3E4618961BE7A65E99800BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.6MB
SHA256 9034232b13bd0cbf10cbdd6ed0cc735e9d24ed32374def0a483e38be625fdb85
MD5 83bff3262be4141d689b2ddeae5f21bc
SHA1 5a03dc5e1c6ebde55ebcc2276fa0e68dd8a95223
SHA512 d4dd4c76cddb57959e94241b1b0f9559fd186ed7401913738d27da51bc78b206d939f729fa27e72c9fd8e04812140872144494f9f6b843d6f4515e26a0f8c8d3
SSDEEP 12288:8LRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:8LRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1D17523003C4D65C3DB1F81F99A86B0E1E0335D4F78F925F3E461C961AE7A65EA9804BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.6MB
SHA256 4cbddc22c68f2cd8202c0430c8ac5ddf228deb585e7b871519d25cdd4d93b6bf
MD5 f43f9a3fe7646087a3da7b996e7efe17
SHA1 ca34ee1366b09d8879cf14ca6aeb26fdb54c5de9
SHA512 593537ebd96fa7e6d703c280db4b87b45741352550b9057fb459d4212273c9617b3a0ed94876e322a82fec73a1fa3f79084f7bffcbaecaf6e15df4d0fecaa086
SSDEEP 12288:IsRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:IsRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1837523043C4D65C3DB1F81F99A86B0E1E0375D4F78FA21F3E461C961AE7A25E998047B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.0MB
SHA256 2ce767395dcbb84056bf5084f0e019426b0f86986a545e44875754bd6b632e69
MD5 08302bfbbd875987e2512f78b8b5b85b
SHA1 169f4e9eafe4529d2911c504170db8771957509e
SHA512 f76b87c1bbb3a7a5eccfd4d85c813fee88aac92024daec64bc5bbaf6e3e613071b3beeea07c60ecb7ef53e49ed18ba2250fb1a4f9e03ea07cbadb76ca73a24d3
SSDEEP 24576:bfwvzk9RX6wkyAIIRPWxNs298r3OCDIjG3gE9ow+8xA+:OMnYIIR+ft983Dl3gEe8xA+
TLSH
T1AFA5DF29EFCC44E1E177927C89A7460AF2B178591B31C2CF029653AD0E37ED4AE39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 5d3a6abae6f47e9d0aa567d0213a859f74341ce1fea915e334a3016234c92a1a
MD5 e4f9a895e89995b74051712e975a43c1
SHA1 fc9f655e6052a42df7d2f2d58d06427212a9ad34
SHA512 c9cbe20b7786a154e619d995c168d69aa16a7dfe115a58d96f498d31dade1dc398fe4ec2fcca64d62915251f998f8250237ebbf91f664b1a0fabb9a4c539a969
SSDEEP 49152:mYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0fR+ft983Dl3gI:pySzPHR+l9EDl3VxA+
TLSH
T1DF066C56A1A801D5C1B9C1B98F1BCC1BFB7134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 6e2d82cf0feb3ac8a62e7e36d7515005401e462eb0ba32a2335e5c01f22ea48d
MD5 d1787eb5d0608cfeb28905ad55f4fb20
SHA1 6af9daea3041934dbc4909132559a05a8d087e58
SHA512 6b34999a283411a16c3e7ffeb1dc746bd46a6bcbdadaabd6ae76ac05cbd7093dc408b873f8edeb42daf29b3bc8e6ff71a5b86a2cc2c74b0e52f2086421b8ae5e
SSDEEP 24576:q47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYNRPWxNs298r3OCDIjG3gE9ow+8xA+:q47JUQjqirIhCnDHUPfF/PR+ft983Dl1
TLSH
T16965AE1DA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.7MB
SHA256 59d70b3f3cc84d3bf89db101cc25b9644cd5bca1e323aa16c4c802ee600fc138
MD5 870612d9cfc9917bcd0c1da0769a45a8
SHA1 65f2fb1d91fc9f0ef096d75c32c47dda496e2dfb
SHA512 a67a05b96125a6f9c16765a449c709eacd24d5b99603fa36caf40a40de8c69760ebbeccd3465294f9bf32bcaf54feecb20131a9cbffdb056514371327d779c81
SSDEEP 12288:bpsfkRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:skRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T105850109E68812D1C02E91B9CB469641F3337C1997F1A3CB92D0F53E1F7A6949DE9713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 3ab8a1c8dd38b61e8e4efdec1a7ce9b19979877c6616e6df4039904a8c13d126
MD5 1d811ca4a167f64c8a2b6bd614a943f1
SHA1 55efe12ce6c16f3d1f39e325f3d2e2be02c8a814
SHA512 7c68a0b1680e9fc54989f6ea05f9d5eeb0edc5de01d3cc3948a2e632e0a5fd1f39f3c68642d6ec166d90430a6b0ed7c515f954205c2c7aa1f316a16368191d76
SSDEEP 12288:vio4FkcBU3fO7BZHxeJkuFHRgyBUwP9oGgeidkI:vzskMUP81x12gwUwP2Ggeid
TLSH
T1DA3507117226DB4FC6A950321E36D6CCAB70BD01EE04AF17B2C9873FD476659B6F1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.8MB
SHA256 f0bac28aa0d874e3dfb192176ed931438f10edcb1f692585c000d6602bf2513a
MD5 94dbce423127951850c079320a10d01f
SHA1 9022e1e1c72b561503f39f55551fa6c03c1f7a43
SHA512 1b427c8b085b793e8f9e83bec0d51fd6bdc2d7bf16c02fee3552ba941692246608bd899d94105b907f01565c8dbaafca29a144c2d1dc4a6ab8b10a4e172e643b
SSDEEP 24576:gJz/l9f6tRdnojLKOMMxRsx0QDGvfyQZ92cRFNIrFgN4JbsXwBwr4c+F+yzkCZ3O:QmRdnoHcbsABwr4c+F+y/9huCbA
TLSH
T149953B416577DB4FC9BE4037033286CDAB74AC02FB483F06B3858976A86695AB5F13D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 5bc91e75e6f4828a2ee4508156270dd912e8f3d175d2371cafeab1999259edcc
MD5 cf25920c1b665bfbcc19856591c05284
SHA1 4a92f24eca8c535e66655d218b9b95df08f57793
SHA512 32b2c2846a0acb760ee1bbf3ac511841c01300f2b484c4512488728ba3009e15caa12825fa4c4804c27e173a668745f6fe513b0071aebc7653cfdc8e1bb81b6e
SSDEEP 3:OlH/lCS4ROvq/f5dScLkQvqRl3y8Dl63mCllltGlslslslslslsl6h71:KQsi/f5dSSqMmCtEEEEEEE
TLSH
T1A281922A37027A90EA91E0330A2883665323C8EF2C88A7976A0051078D002B98D61628
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.6MB
SHA256 d81af61d0460c2f2bc5b94dbd5bd085507b2103e4bd92edaa362e0ace342179a
MD5 fe562cc34e69319d3219b24c623da5d6
SHA1 bc82cc226168b9190f32522c7fdbd7814fbe1dd5
SHA512 62bdd1c08be597af6ff5ff462db1cb325e06260fa0a079c062dfda244653d76c1d710ec817f21934ceb416ba212fecc63b034cfb27305c117d4000cb03272922
SSDEEP 12288:rF78RPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:B8RPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1A77523112D4C69C2EA3F81F4498AE071B12BBD4E2FF460F3E41186A1AD796CDDDB056B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 33ebfdd2710278d81780c15e406d4d3145cf1fa305cc9733830806bc922b6834
MD5 905e1b72c50f991df53005d1d4ca660d
SHA1 d8e1cdcc5912e9d8e3c074fe2f6b1b02e75c12c1
SHA512 4d7205eb65399307ee466f556d8459bf06c7804f20ace0e18bac1dd5ed476b93c5b449409fbed3ebc3e43b804e808d165e763b3f8705706127dc98b62dc1b77d
SSDEEP 24576:8gb6bmBIi49WNNFpg1rSvFv7bYCRPWxNs298r3OCDIjG3gE9ow+8xA+:8gb4mBIBhGFNR+ft983Dl3gEe8xA+
TLSH
T13165AE1E22EC02F5E0FAD2B8DDAA4417D6B278161731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.1MB
SHA256 e0f86025d9b1b82586eaf8d9b92f9104e0e10fd7c2f7cd6a3bde8bb00c50f3af
MD5 432b6f39f426f1ecbe10412f33647ea7
SHA1 a8e23088e65206a35d6aff101dbece1e660608db
SHA512 5a5f78f2ea6ce173d4c3f7f09d394d7369df4162f4dbcc0474ac5e427f0d7d2753dc563e9905b13373e0d76ac8ad7a94203ab15a64199a401f6096f51efcd8a0
SSDEEP 24576:9G88u8FpJqH1vzria7/mdRPWxNs298r3OCDIjG3gE9ow+8xA+:Q7ZFPqVya7/aR+ft983Dl3gEe8xA+
TLSH
T19BA501257AE401F1D47BD1388A824663F6B2B8151374EFDF06A88B511F23BE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.8MB
SHA256 0159e9d4ddb93b7c08771a481ab7236ed29754de2997f60e589a3625f3f0aa2c
MD5 c198ca4413c7c7c282ab27b1d141671b
SHA1 8819c87872640c95c18edbfa6a02c52e38b1ec24
SHA512 747f8b12df2c0f915ed733c299c4823b775850a4d11a3de0101958a07f10394b2464b5d06b53216171ceb7bf6983a27f9432bd9d655f36f408afac09685c80d8
SSDEEP 24576:zPUr+NQpRPWxNs298r3OCDIjG3gE9ow+8xA+:zJQpR+ft983Dl3gEe8xA+
TLSH
T14685F11F269C18E1E67BE17D89828219F372B8521711A2DF01E0817E5F67EDCBD39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a88b167a63223ebfe64feb9c716b7276e0a4892714da45c41e6a6da8d34dc11b
MD5 aaf1cd3b982f2764e7a4f8e47e476406
SHA1 ab0fdce23ce6cdf1e0701713fe5ab16318f82660
SHA512 0901e7949e2dfdbd78d7256b1e50bab06a8ce68168104aa1bbe976d8d4f1acca1d6d90a42d440fc3015aaf348cf032355775f49d8b69319f55a26f94fc1bea34
SSDEEP 49152:OBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj5R+ft983Dl3gEe8xF:RG05lO43bAR+l9EDl3VxA+
TLSH
T1D2D5CF6E62EC11F5D1BBC17CDAC6460BEBB23815033556CB02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ac8f6de464c95f8202837e87f6aba3257daca268a67811f6411723dc654ad4d9
MD5 fd8f63e1150f462f55571cfb9bf20ea5
SHA1 4fbfbac2423c9d54de78ddc3b4331b5884d40c60
SHA512 64c4324a2fad63133b09c3582d11371cd68f206c4c6249d1caa50dbf2db7009bf4e7029824514027c1e9a401fefeda992f3e59dcb88837ca40995caa0e4cd20b
SSDEEP 24576:Ufa5POZ3dpyWVM50JicR2hG0lasx2+47eidnfRPWxNs298r3OCDIjG3gE9ow+8xF:Ma5POZ3lJt2pasx2+mBR+ft983Dl3gE9
TLSH
T1BC65BF5EA6FC01D5D579D17DC583861AF5B2342613329BCB012182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 0fd7d88064ca470a5ba1e498d6f4d2df05eb208f2cc63e840444451a812194f8
MD5 31f52f73a4cac89e9377a6c42070ffd2
SHA1 6810a802d896f8929c19b2dc345ea892aa47a1db
SHA512 4478e3f6c1aaebdcd54142801e1db0f967c22ca1c3050530204b155da5309b8166a9a2cf4cd72c63b854791f0fbea0b5eee41e106906b8d1a0d49906eaa53837
SSDEEP 24576:dNcwHdjbyQ4nLC18lb/EOjowL7FklRPWxNs298r3OCDIjG3gE9ow+8xA+:dNc/zEOVHF6R+ft983Dl3gEe8xA+
TLSH
T1C7858C1623E901E4F5BBE1BE89779546FA71786913308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 12289ee5e7a867a10cb18b20d5b34fc6c264ef96edb3b1706d4a6f947b3043d4
MD5 2136b4019f2f447b68b5809d756e071d
SHA1 bbefb4c3a984019dfef322326f8f3c53b8cc6a86
SHA512 b9184e0c094166c7dd2c8fb94194a83441f22faaf355383d87fb9e8628e9674f2251fce86c18fc26b07cb0a0cec3125ec880a97f6f0acbc1d61c86ea97541806
SSDEEP 24576:OzkNvNnaFeYhJNtmZBmKRPWxNs298r3OCDIjG3gE9ow+8xA+:OzMwBtOmKR+ft983Dl3gEe8xA+
TLSH
T1A155AF2EBAB846E0D1FEC6B4CD238512E6727851173293CB9290C13F4E679D89E75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.9MB
SHA256 620aeda2b0bed624184ab938328661523d417857535bddd1aa26e293bb44e5fe
MD5 6aa9391200a379a29fb2547e7fa61113
SHA1 315d325835eac70a829bdef7921cc52d9cb465a5
SHA512 3769465495bd4f11c74cbe71bb8a4642fb0ec5fd9e4a094fcb041dd5d12066d3d9d4950ab17f6b133f417cb022b1afd5b2b3b35ed89e7ac3d17e3debae3bfbf2
SSDEEP 24576:BD3FHshBIYQgAwRPWxNs298r3OCDIjG3gE9ow+8xA+:BDVHeBIAAwR+ft983Dl3gEe8xA+
TLSH
T10495E03DEA9C04E0E57BD1BCDA538606E67238AD033266DB0190C1B65F6BEE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/936-146-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/936-145-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/936-319-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/936-152-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1204-69-0x0000000140000000-0x00000001402CA000-memory.dmp

Download

memory/1204-303-0x0000000140000000-0x00000001402CA000-memory.dmp

Download

memory/1204-76-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/1204-70-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/1900-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1900-103-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1900-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1900-25-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1900-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1988-62-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1988-286-0x0000000140000000-0x00000001402CE000-memory.dmp

Download

memory/1988-54-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1988-65-0x0000000140000000-0x00000001402CE000-memory.dmp

Download

memory/2312-312-0x0000000000400000-0x0000000000696000-memory.dmp

Download

memory/2312-86-0x0000000000AD0000-0x0000000000B37000-memory.dmp

Download

memory/2312-81-0x0000000000AD0000-0x0000000000B37000-memory.dmp

Download

memory/2312-80-0x0000000000400000-0x0000000000696000-memory.dmp

Download

memory/2652-42-0x0000000140000000-0x0000000140163000-memory.dmp

Download

memory/2652-49-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/2652-60-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/2652-43-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/2652-64-0x0000000140000000-0x0000000140163000-memory.dmp

Download

memory/2708-90-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2708-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2708-20-0x0000000000A80000-0x0000000000AE0000-memory.dmp

Download

memory/2708-14-0x0000000000A80000-0x0000000000AE0000-memory.dmp

Download

memory/3452-111-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3452-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3452-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3452-105-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3452-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3452-316-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3484-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3484-138-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/3484-130-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/3484-136-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/3484-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3924-1-0x0000000002310000-0x0000000002377000-memory.dmp

Download

memory/3924-6-0x0000000002310000-0x0000000002377000-memory.dmp

Download

memory/3924-7-0x0000000002310000-0x0000000002377000-memory.dmp

Download

memory/3924-0-0x0000000000400000-0x00000000005A9000-memory.dmp

Download

memory/3924-38-0x0000000000400000-0x00000000005A9000-memory.dmp

Download

memory/4144-118-0x0000000000EA0000-0x0000000000F00000-memory.dmp

Download

memory/4144-116-0x0000000140000000-0x000000014033D000-memory.dmp

Download

memory/4144-124-0x0000000000EA0000-0x0000000000F00000-memory.dmp

Download

memory/4144-315-0x0000000140000000-0x000000014033D000-memory.dmp

Download

memory/4772-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4772-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4772-331-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4772-92-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4772-98-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4772-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download