3eab63d900b6c93a0d777ad2f448468fcee35feb66b11d495b5da8b5e36f1ed4

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 03:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-12_506b27204aeee6b7e1491648a18ddf8c_amadey_elex_lynx_smoke-loader.exe
Size 1.3MB
Sample261113-dqm3vsfx2n
SHA256 3eab63d900b6c93a0d777ad2f448468fcee35feb66b11d495b5da8b5e36f1ed4
MD5 506b27204aeee6b7e1491648a18ddf8c
SHA1 a86be5dea755be29b2af1b5bce84480e383f20d6
SHA512 ebbc4d46c2bab2549aa525078f21ede7d9886dda4d2fe16c4dc69c8d9aa041b8f11bb2498483a5c9e4f2320716dd200267370f6851f6fb5a616085954e4d56f9
SSDEEP 24576:04ZZQufMz4MMMMMMf8XB6D+InjiogsqjnhMgeiCl7G0nehbGZpbD:0EZQUu4MMMMMMf8YDtnNcDmg27RnWGj
TLSH
T1105517D195C38CDBD41A0A316474D9B7542A3F246B34A3CA2EB0F5B95ABFEC13F12816
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
2468	elevation_service.exe
5004	elevation_service.exe
1960	OSE.EXE
1328	PerceptionSimulationService.exe
5688	perfhost.exe
3092	ReFsDedupSvc.exe
4768	SensorDataService.exe
2428	ssh-agent.exe
5592	AgentService.exe
6048	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-12_506b27204aeee6b7e1491648a18ddf8c_amadey_elex_lynx_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-12_506b27204aeee6b7e1491648a18ddf8c_amadey_elex_lynx_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-12_506b27204aeee6b7e1491648a18ddf8c_amadey_elex_lynx_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\771686c83a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-12_506b27204aeee6b7e1491648a18ddf8c_amadey_elex_lynx_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-11-12_506b27204aeee6b7e1491648a18ddf8c_amadey_elex_lynx_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-12_506b27204aeee6b7e1491648a18ddf8c_amadey_elex_lynx_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4192	4952	WerFault.exe	87

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-12_506b27204aeee6b7e1491648a18ddf8c_amadey_elex_lynx_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007b0513ec1c73dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005be4f72b1d73dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000018a605e91c73dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008e2c71e91c73dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000add8f22b1d73dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bf9d3dea1c73dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b92fe32b1d73dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000046ea4e91c73dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cb7ad5ea1c73dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2468	elevation_service.exe
2468	elevation_service.exe
2468	elevation_service.exe
2468	elevation_service.exe
2468	elevation_service.exe
2468	elevation_service.exe
2468	elevation_service.exe
5004	elevation_service.exe
5004	elevation_service.exe
5004	elevation_service.exe
5004	elevation_service.exe
5004	elevation_service.exe
5004	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4952	2026-11-12_506b27204aeee6b7e1491648a18ddf8c_amadey_elex_lynx_smoke-loader.exe
Token: SeTakeOwnershipPrivilege	2468	elevation_service.exe
Token: SeBackupPrivilege	3092	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3092	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3092	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3092	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3092	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3092	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3092	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3092	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3092	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3092	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5592	AgentService.exe
Token: 33	6048	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6048	SearchIndexer.exe
Token: SeDebugPrivilege	2468	elevation_service.exe
Token: SeDebugPrivilege	5004	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6048 wrote to memory of 3248	6048	SearchIndexer.exe	102
PID 6048 wrote to memory of 3512	6048	SearchIndexer.exe	103
PID 6048 wrote to memory of 1484	6048	SearchIndexer.exe	104
PID 6048 wrote to memory of 3608	6048	SearchIndexer.exe	105
PID 6048 wrote to memory of 2488	6048	SearchIndexer.exe	109
PID 6048 wrote to memory of 5376	6048	SearchIndexer.exe	110
PID 6048 wrote to memory of 260	6048	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-11-12_506b27204aeee6b7e1491648a18ddf8c_amadey_elex_lynx_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-12_506b27204aeee6b7e1491648a18ddf8c_amadey_elex_lynx_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 528
  2⤵
  - Program crash
  PID:4192

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4952 -ip 4952
1⤵
PID:4276

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5004

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1960

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1328

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5688

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3092

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4768

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2428

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5592

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6048
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3248
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3512
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 2836 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1484
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3608
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2488
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5376
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 2836 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c77d8f281f8cd3cc1edb816a81bab2921a2915581d0baba79b29b1cbb8aba139
MD5 0b362a7183bd1d3fa87ad053c3bd5aa8
SHA1 27e7ddb9e2a474f0e716ba3e1fd47728d86bedfc
SHA512 37fb507a881a5a8574940ebee278c0261c808020edd21b9ae450bde82e91ebfe00e8be52f37d81f0c36b817a23e9050152424ba09b289e8553a0740c44859686
SSDEEP 49152:Gb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnkDmg27RnWGj:43q6mjBzD527BWG
TLSH
T11BD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 24b4bbe2ee7e95108ca5bed8ef88f705f9fd2e7f380ec23435ed51194402b1d2
MD5 9197dd851b65e1aa76daac1d364fd1ab
SHA1 cf38d2b95a8071d5b5e56af6a89fe26ce4f04694
SHA512 e9bfd6e965bf544c09e8a16e92e02286184e19bf11770ff51943f46f3cd0bbb3460bd5d94d6e8d27c64e16b2ae7e4716e750f29d35311d34e4cd93dc30ba98fe
SSDEEP 24576:OXYfDtczA7sqjnhMgeiCl7G0nehbGZpbD:NtcmDmg27RnWGj
TLSH
T181650129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 19d78171ae22108370d5e2a01c00bb002f4f07c7ab289390862ca0e795b4c82c
MD5 e523519c1c4f0550757d493231efb8f4
SHA1 b815745273a8e7aa48e85ba69cced72c029a0567
SHA512 e39bb2be36e3f4fbb0b2097ff0d009dddd1dddd22ad699f2d4f5c230ba004537d6ac51ffb553ba29ec223d506c5824861a5a3f9df57be087072c3c8e4d5e6a6a
SSDEEP 24576:30Le5ji0hmxhrMZsqjnhMgeiCl7G0nehbGZpbD:3Pji0AzkDmg27RnWGj
TLSH
T131859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2452d44a08a2a9f038720397421563a84d83a4fc80125695cbeed1f151a20b55
MD5 bba5b978d98e6e50300ede6f651288e8
SHA1 006fe0ca704643dd704e61a335170195a049507a
SHA512 dd2b6766890c3a51be63fc74e3e19df27ed2e3029b8c827260c2a6d5d3a58e542b55ba480fb76db7930ea3219ca67c904614770abe450bf4c71570aa6014ee63
SSDEEP 24576:5a7/ezSC6vUyD/aqgrvWj6q8wyuTsqjnhMgeiCl7G0nehbGZpbD:o/ezSC6vUzPv+HjyoDmg27RnWGj
TLSH
T16B755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f10d28e9c79e645035316e0f9a7ef754e7ac6f825cf39214befac9b22a3236a6
MD5 fc8e07f7aa09302a07cc05b4aeefce7a
SHA1 20c4448d3b7d29cf8ea130d0919c43020d634f57
SHA512 1db730a89359cb7dc183640765dff9c76af34bdd797dee89343270c60d392b816d56c781798f7ab9ecf327dc5db97d10a32a5fe0e2bb19214d3f0ef7c7dda784
SSDEEP 24576:XVbqPb88hv/l+BWsqjnhMgeiCl7G0nehbGZpbD:XVO88hXl+EDmg27RnWGj
TLSH
T177559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 37d8d1e1448e43ab879f3fd8ef6dc0abb1c74157accefc38ff5d81abb72fbbdd
MD5 cd84f0391e26081bb7c806a838df1c28
SHA1 83e91468d511ef7fec53b10c9ddb2f03ca4adc3c
SHA512 b41745e9f6e1fa88a1874b12206d4ae2901d53b64994a7983ec6db3d41948ea933f422681c828eee5f1e5b6aa83da610df27b5da139e23e510524c737f99fd63
SSDEEP 12288:jGFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jGFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BA4523BF864C50CAEB7608B5C3E9F11EAC177E56982008436AA37CFDE5B5458CB39423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 271b498749a6fb2548f317ccf9b56bfa0379a4087a4eec7bc4234307ef9d5250
MD5 a3acfec1480608a49e24efcd2e1f64b1
SHA1 abda5c454f6ca754ea64487754b9453e98df618c
SHA512 7685d45f0d8f5e9487519409b723d1428b22730ec375ef25901c88eb5e2c5875503e0c58c7516ce20932d50bcdc93752fa3b264472b6e403db8cc3ad8d298c11
SSDEEP 12288:IeBNUbTVO86UeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:IJIUesqjnhMgeiCl7G0nehbGZpbD
TLSH
T11865CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 abce41dab4e3566d1f33b1ae60064eca1b502cc3a416cf1f72762a7efd8c421f
MD5 bfe7a51a39163544840fa32e6535721e
SHA1 051085b360211585665568d8d7debc5b24b72b7a
SHA512 f4a27df8911ab8bc696c2ca5b19417f61aa8688e8b85d8be1b943b58b7f46a65057a6397e05325e2823964ca2f2fb2feffd732d9d7fcac83efae4eb2321e30ff
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THJ:XQvGAdlCEL8c/WRNw5CnD527BWG
TLSH
T138266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 07bbf3e63233c0af80b8cfaa7f20ae24b6d76b81b13e5a49586c1b2a27350102
MD5 b4a0f033bc0fc7352b33b9eb391bb22c
SHA1 1545d53af5e2c9b5661a842b0e72719008d6cc83
SHA512 5274793268c31920dcc34dedb1cf09da770f1c9b1eddcad67f0a363195708b1d4d78daba855f504adb14de50c0049ad95583a51944e0e5cb6e1281a67747d39b
SSDEEP 12288:NAwSfxL/2Dc3mDLLmt0LDQewsAjIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:+fewsAjIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14075E031FA74E036C77B0DB60B36D71A582D7A204F6119C3E3E89D9E99702D12736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 25c8daca0b1ccd2405a539292c8e6b10c2710f537df6d9d32875db27467263c1
MD5 ab203417828d3c353520ea2b7c04fb83
SHA1 2d79407325b81e5f638b00cb6627ec74102d896a
SHA512 5b3f801120c975f608c5e7bf5f70089916c6df4a4554901f1f54e6b03db79a00ce66aca08bee8ce581044ae0386bb0de9f0659ff2db899a4c0d3b36828d35997
SSDEEP 196608:mUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH8VQBWG:mUEtQevvqc2W1cpV20I32DB
TLSH
T1C6474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 16a43191a5cd342049ff49ccbaf97395991b3849b66840c30fc63603d0f0f416
MD5 7e11d3b3d231d8fa4141e12159fadeca
SHA1 1f2636745426254b79dccfb419ff9e5d79286712
SHA512 504708ff66c98321a4c1891efa941f0f32f6dc7ba575a45f783fa887e622ab33be753d541947a68892a6c19e32905551563ecb952eca6c745b246a8e44c0d18c
SSDEEP 49152:WCbRquA/m2yL5zLfFiV+XenmE3/zUDmg27RnWGj:boq2VjnmLD527BWG
TLSH
T1AFD58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b0c975cb7d900943ae959bc15e11282993485aa62bacffd3d5b062d4844a2012
MD5 01524eda32967839e85550c99001fbbe
SHA1 ee065b62a0607e711aab6e1abdd640577a1e812c
SHA512 9e5234e93c0e0ffacc58bbd3f2107d5dbc93627a44cea59d1aa80a60f6e424dace414fa08375b48f527b703ac3903bf145a4320668719438582c34825cf3c10c
SSDEEP 24576:7AhGL6IFoiwtA5l7S53XsqjnhMgeiCl7G0nehbGZpbD:7AM5Foiq5bDmg27RnWGj
TLSH
T181359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 74dae203c18a331249b4208440efa5699e86349b424ffac14aa7b59deda864f6
MD5 501eef6ad71622a2676858a502352567
SHA1 abd267adb73ef79486d338a2b82dabbc920005d1
SHA512 499350332b62b661251f44ae1283208fca961a835bf996ec6bfeca68f7294882dc0e89b9bf8295b1a7dc3cfdfd40caa38f7c143892779116f20f7a67c645c7ac
SSDEEP 12288:smw5HEjsChNEBFgl0WDm+CzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:JwuROWcsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E465F14A76A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 59edeb535865ebfaa05d7e0596e0e20c48ea01dc7c64d70412378fec1be902d6
MD5 89d98e7374d61269a0bd2bb1caf96a6a
SHA1 56ab2cc307ec86d31c0fb78779d89d3124c291e0
SHA512 c07271919e5734b43b4a353d6833e61c51dcfad3207bd770dadd7d5abf281e1b9f6409214b3cbfeacf7bd2eaefd8ec0909977be84dae8113b4b07eade3022411
SSDEEP 12288:+yZ1IyYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HZuhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13D5512AA239820FAE163417CC5E5D609E7333C62673043CF166659AA6F73AD44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a42381caa324806df8086959edefe10d73b9e1b4aac9f884ff07ed7d87ddc84e
MD5 d7fda1cead324f21a4ab89ff29442a05
SHA1 daf98bdfb89ef7e9574a8ce1fbbee39289e66a02
SHA512 2dadbd36ab008d21f891735d7824fb855575f707850f21f97ac454ddb25f417014ba7c879ee7e931fcd914660ca5fad2a01cc3da2f67e3b2ad7746b703339ac8
SSDEEP 98304:HQRQyi36YOcPDLvw2gAf+PN3WD527BWG:WQyiKanX+PNGVQBWG
TLSH
T172667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9bf11e09de970eb809b7375a12c904c3b5dc4edbfab3967002fb99c49b6a15fe
MD5 8576349dbb0282ef3165ef79d15fec0b
SHA1 4a2224303ad6ea21d133c1c7239cdcd1456c732d
SHA512 e4cd10f4073249ac62b95355efe6ea87d2e0e94d58e6cb610b8f25c0979a525c6d1307723645a59e0bdd42bdc5211e1fa7574d7b31f8a3d3e0862ccdf580c0dc
SSDEEP 98304:IQRQyi36YOcPDLvw2gAf+PN3WD527BWG:fQyiKanX+PNGVQBWG
TLSH
T17A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 57a87111fc8b86220d066c6bae9b02564f7e5c8ad849bf2781a6d9816be60cc6
MD5 32d70d7df14dad4349151d05d6b6fb42
SHA1 0ece35c30ef359626fe8c4710eff0b1446e0e642
SHA512 c4b08484c9cfd158aac704e878c08653722dd6c21b111255b2c6877fa278a353828e8f7023babbffd6f3818eadd3af7f602b50df583751a55eda9abc00825980
SSDEEP 24576:1wvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0RsqjnhMgeiCl7Ge:x68Qg55nhkeWu7PNU3/kDmg27RnWGj
TLSH
T10FB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1b848b601a6769ec7d28f413a1e5ab0d7ccf8d1667ea418f95a41b21b5039600
MD5 85d0ad7f91a98c4d71b258230f10005b
SHA1 8d466c63e0f034a7826c070481407dc0e8f25295
SHA512 a429370ab5c60ff8ec346eb9984a8b539b2e2e197f0fb2774f4873d322a5aba56752fd730ed20695aed6359271898b4f7eafe10664d837c2d4f98d0863baac91
SSDEEP 98304:Gy5112gYy5azzVvU69nLKnhZ5D527BWG:3LIHRWhTVQBWG
TLSH
T1D9167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 456bb829c2d9e8940f038776608348e3098d17366d10d5c19241b68a5aed91bd
MD5 9db4893b5e3e07793bf22ddcad9e7a70
SHA1 cf15de49010054813d96dcfcdc8ddeb9c0987d8f
SHA512 fa22d89a4eed30da983acb3f5cc4e15990dfcdffae22778af94e7bf74206c446c080ee80410868b98554797732891cda9058ab0dc653cdde10072c79a9766c6e
SSDEEP 49152:XB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl/Dmg27RnWGj:5u6JmIxd2d/D527BWG
TLSH
T136D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c47265dddab80f13a66163be69554fdc74e2a568551bde17b00553b77641c82e
MD5 54e6491e80a700d92145fdb93330256f
SHA1 74e8b99e93460ca177fa1d98eb71b4f9a15d1242
SHA512 45949514b8092992ba65ead0779b463698aadb56c85dcb56649e453ad00a29ec9dcd9f3b97b07636252794d73a71c60316ffa6d3fd299a4350e52f5aba0b6a4b
SSDEEP 49152:c1hpsNoJpF1A67U44CwH7R4xSDmg27RnWGj:cmifPqRLD527BWG
TLSH
T18AB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2009a9c0fcfbaa02d85461983dce31245bbd6610105237542d436f603c57671a
MD5 94d078a0b1cc06585323dd83d2cdea9f
SHA1 080cd79ea4f3ce1079d65c0266c7802bd9b211db
SHA512 fe0f4a61f7cb68f00a6977ac0e6397f883bc4c14417ca9f5830264f2c505ed00cfcfdd7c7e3e7b894ab4d52cd65f9cd59ccb89c17b2325f8445d0badd950ef88
SSDEEP 49152:dSuZQIY0Be2KkRVtOnks6NMHq1Dmg27RnWGj:z5dKqi611D527BWG
TLSH
T12FC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f56b142b25e55a4c12de629ff360dba4a56ef6a51045547f4499b8d2d9810355
MD5 cbb973db5717411cfb1650f9e3c64f6b
SHA1 b33d25379aa05d1920ece03ac542b4202ffb847f
SHA512 4de04eb0a3b97aa663d27ff3dedc82f7681abc163d18578506d869cf5fdc7111e7224177626ad8f6f3e52b1ff82fc8b192d6e6f2b32681cf169e4a66b3a34024
SSDEEP 49152:rhtSn8EApI0figjgiDn0AP5weDmg27RnWGj:qX2iWphPD527BWG
TLSH
T12195BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 605f3c4cdce4cd6f3aaa4dd2705dcb0bd664733e0cf52db717a336397bb453ed
MD5 f16e395502f4391412be22fe28d04f14
SHA1 982460aae8134601b9da4baee6ae0f17e474a338
SHA512 9ce4297f032fa9ebab2d5a92329591bf29023206ef5fd8cca7f5cd69c842a93cc09d81875b4c7a7b32ff60e8a1cb446706f07f5531670b35cc36dcdff07d07ce
SSDEEP 12288:otXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:otsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16B4523BE955C41CAE52648B5C3E5F14EAC073E5BE92004837A977CB9FBF24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 a100efac2522a58af1a09207db4d112ab18eb6998fc546dac68446ab693897a1
MD5 630ab11ed49b94198cd61c4876833487
SHA1 f6700c8c294ed5dd93bb9798993f71283b317bf1
SHA512 a9f126b9b6fde83bd6a7e05d33f7daeefaab88944e7d5e28598551b0c4c173e17275d3b999e7b552179bd7e3827f7a845acb8a565314905e94afca4df2b2ab02
SSDEEP 12288:pUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DC4523BE955C41CAE52648B5C3E5F14DAC073E5BE92004837AAB7CB9FBF24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 8b506fff89b85a0149dab4bf33a49ab06b77712d972ad0c31dc71d51ae815058
MD5 5ec2f3a8a6b3a2ca47e908f055a16e6a
SHA1 3ecd64065516f90e997b08307fdb62bb71315666
SHA512 5c0b015a7ebe9e9b25d7ae346fab9e4ac1b4d7c134daf7e97d1f977ab6f9bbd4609069cf7f4640d9dc9854438dc8bab56f7f0948c2c043097183f1b020478d46
SSDEEP 12288:wGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1904523BE955C41CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB24584B38463
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 8f37f24a1af90a972c192c7ff0b37f4c08d0d2a535065f2fa6d082aed1b8e4d7
MD5 939bba70aca701096f2e10a040ae63be
SHA1 2b3a42eb82825e34e9d45fd272dc63f7c6ec3c12
SHA512 40980ebd930f8dce71b0e6a8b510078a66d9ab36ee42b9caeaa7d40348349a88306de6cd5184f9a8389666af58dcafbf487549aac4ebefc47ca2f508ccddeb31
SSDEEP 12288:bV3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CA45236F575C00C6E83685B4C2F5E11DE8237D96EB3005DB6B532CAD9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 c0f7b49373d8a02d47df15d93d7ef02791d3274184e8bf46051821ee2ed77a30
MD5 f1b54d9359f4c4688630be6c7647268c
SHA1 61162afd13be3eeb95fafa6f2981c25eaf7cba1a
SHA512 7f65232d14e7c504cd32b27893c6a05a5a9939ab1369f72edb9bb3544502db5b3b21be21378451dd6c32a65c435de941161f39685a4449ee7a6b4c01196e04af
SSDEEP 12288:NPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1354523BE955C41CAE92648B5C3E5F14DAC073E5BE92004837A9B7CBDFBB24584B38463
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 5de7d52f25ce30fe1e347f5de1901c4ab52f733abf30f3748586fbca4c6da6fe
MD5 4958fa4da43955af92ed7f9eb7cc0666
SHA1 a2357c4c70970f570ab17a35e1e595a1eccb9c19
SHA512 a30598f0e270a70d300893ac9fd71fb498249fea61c9a1edf8501cebd54c1897b3d9cba097e67668b75ca141eef5a24660615a12c8b0a6effdcfd2a191ec68a4
SSDEEP 12288:DQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FF4523BE965C41CAE52648B5C3E5F14DAC073E5BE92004837A9B7CB9FBF24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 babff53cfee7add7110b681b3394180759457e780a755bfbcf1999bcf115a2c5
MD5 660f7a48c341921a7859332770b4f1bd
SHA1 096052e75acc6fe1fe8cee996a9047bf6c63991b
SHA512 e6f55864275954a2519de9b894dee7f06944ab95489e0678f03ef600959c32dcd4f97792ee28789bce964825d82524b64741f1e495d52135fef07ff373e4c06a
SSDEEP 12288:JMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B84523BE955C41CAE62644B5C3E5F15DAC073E5BE92004837AAB7CB9F7F24684B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 6ca90019e1318e5227b699d67c68054420f14526d57570d5f05e3d84ca964f05
MD5 0825a38bbfd4eb754fbc53916ea2d24b
SHA1 eb97f2c3e5e9c3934a8672d2b224fa98482d4ee2
SHA512 8c6b1f4fcb1561ae75c66390d1d28f04990bd53b7bce65cc26e6addaecc6a5d1b9fce2a506c5c5eab031bc8b48930df4482432703735b1ee2406c71369d8d922
SSDEEP 24576:+ZM3zFVSO0sqjnhMgeiCl7G0nehbGZpbD:+ZM3zfcDmg27RnWGj
TLSH
T1726501A9B35418F8EC63813EC965D90AD5B37C5A0B70C61F13A4366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 5770cd4e4e653d4db9bf682a6b0722ff801e1297c60dd1f4f5ffddc35bc9203c
MD5 dda3c60f5c4c895abbda2813554c350f
SHA1 2a23263b68e85a34a279b0fd16b1203df401a844
SHA512 f336d9685a1ff5181abe76bedfbe04fedbbc1c8b4b7084d3c424044e64f0cc260fcc884f23a6d147b586c43f170757ebe992b3cee8ad12d27b2797155f20b73d
SSDEEP 12288:4xXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4xsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1204523BF955C51CAE52608B5C3E5E14DAC073E5BE9200483BA9B7CBDFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 e40793443d4bba301d9ed8851ab2ff816a44fc48bff8ae43fe1ad122f276e378
MD5 0ebebe6fb659dfe6264dfd30439db295
SHA1 74b3ecba4fb5127d9ed65a98b67be8d4b68aa7ad
SHA512 0f69928a009332bb7490290805a4add9ecbff545d06267844578b312d666e7205277fafc2fe02ee77f277e537235f30549a2f0302f4eac21bac02b977a92505d
SSDEEP 12288:CVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A14523BF955C41CAE92604B5C3E5E14DAC173E5BE92004837A5B7CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 66b776cd386f95b9338250d19b9eb840a978bb26c7b87069d360c7d63cd9bd9a
MD5 4d6eba040474064241a05a83a5d57f02
SHA1 7bb37f7e73ba9a67483dd92abfe65fdaf7f1601f
SHA512 896558d80cffea3db05d0624811c70ccc2cafd83f247869b62a137088b72262a324f086ddb9e34ba70c633c7d03d8fda57dee7b630932895e3817fd6e2eebaf0
SSDEEP 12288:MyPz5L8YXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VzyYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C255125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 312d61e82242daf54ed25e4e08ed33660427fe956539b8bbbf5b689032ac878f
MD5 ca33231a3db1ea00724d561fa2d52333
SHA1 4389757cd4b3e029e9e1987a6d1547d185e58846
SHA512 c25e1ca6a31179315040b2d6ac43666e675c6c12557ed6e731814c297073dd4837d8ff8cfccf1d5490bc25b9aa195847fb85058bf8cef9ae35b66998627a080b
SSDEEP 12288:QxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19A4523BF955C51CAE92604B5C3E5E14DAC073E5BE9200483BA9B7CBDFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 99adbc6c762479826f7437b2ba2827f9d32b103769ee3f100fdfc9bb8a9a11ce
MD5 07c94ecb7570de354d116d98fe758cf6
SHA1 63794f92015de6f770f8ac9efb6081a2ce00c501
SHA512 437743fff8a98c348ab6071948c89e1ea7efb0c7fe53412562d8b3a45a47fdf175669aa684a7c894455f2cc21c3f2c29ba4555bbec3c9f7ea469cdd8be8f88f8
SSDEEP 12288:PxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1184523BF955C51CAE52608B5C3E5E14DAC073E5BE9200483BA9B7CBDFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 561b7ccd67c77ccf1cb3b066eab653e8478355cbbaacea15d86995418f7a685f
MD5 90a6a0f1408e9428c25733c0f83bb81a
SHA1 0675503bd1c6fcf569346e1dd659156fc281125b
SHA512 5b72763748f31e009c8285eef5d20c12f86ece97d7b0ff966e7d3c5765a142b0f110a7feccfd27a839743ce943062a96ed55412eea87fc31536d77deb96fadea
SSDEEP 12288:yyPz5L8YXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vzyYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17555125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 578325917a2242a702521fc0bee1b50ddc0220011d8e08462a9fceb01555b72a
MD5 528c851c400aa966fb8cdb91367a47d7
SHA1 1d616b373c788d07c33a31c05aa4d105a1ff4fdf
SHA512 57eb2e263154230fe49e4049acbf0711db20c8ee02f7432d22d7ed7d9a2ca8c82bdfaeb855e06d9c41f7fde747f87dea3f3fdc1ac1098672b1cce99cb97a0b04
SSDEEP 24576:sT8aLl3z0zD2sqjnhMgeiCl7G0nehbGZpbD:sT7LljXDmg27RnWGj
TLSH
T1C16501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 464fad462c52128d9ed9d2949b09b3425fa09fd94773cabce60aa3da1d9e9c9a
MD5 576b4c96a62094ebb39dbc2176e69b04
SHA1 b2ce7ced9df2d9a64e4e62f31c62c96a73af3358
SHA512 46882ecea2e26ca23e034f6e9a43dd5a36ad8c2f73d90bfbfeadfcec8129d178e93024b84e9f5ecb280d02b33e0b79465f95b938bfeeec374ac5826386999798
SSDEEP 24576:q3rd9CHKy7GZysqjnhMgeiCl7G0nehbGZpbD:Mrd9CHKyacDmg27RnWGj
TLSH
T1EC75CF90F3E810E8F1B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 eef9a4d8d88fe3d7176e6fee57977a2e5aa07d085a2b15d9e705747193c9dfd0
MD5 8bd8a8db8f860147c70ba371495919b3
SHA1 eb41ce46428f12794ff21ea5cfc4fe88818a45f3
SHA512 13848de9cd939798e86dc278ef9cbeeaacf07caa4cc5224c069a25d10319a4b0128ae347f047c7b66a5bfabb598f60411d69083b1ec40e27b30905950b2f208a
SSDEEP 12288:JmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1234523BE955C41CAE92608B5C3E5F14DAC073E5BE92004937A9B7CBDFBB24584B38463
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 ea9003690d1b668fcc1da71a8493a7b7d0919ac403984776b3c686dcb84091ce
MD5 16730a6baa3d1db903e8d633b9fa4e4e
SHA1 b1e028e994d2132e7f8593dec0fcd0f349eb2b6a
SHA512 9ee164384459619d18ac81e1e119c211c7ad7b834d508c0013247f2e4217498cc326e9284d422b25779bbe807bad863440f4805a7baa903653ed7fdf40505901
SSDEEP 12288:a4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:a4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1124523BE965C41DAE92644F5C3E9E10DAC073E5BE92004837B977CB9EBF24584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 c731b4be3afa968315ab62b8fe380f00a89303cc1a5ee7f881f6035502a6ff6d
MD5 95fd6549d1455be9bb9e7f68018de2a9
SHA1 e7f2be3627025506a76233baba572a663ea2a964
SHA512 6edb6b1c43af72e095fafcfdbc8dad3dd48f7f80194ad29c0d031baf7eb834ea51b868d13335a474fb3dbcac29f3fb707d2eb9d1c344452427932e8243f8f509
SSDEEP 12288:MrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E14523BF955C41CAE92648B5C3E5E14DAC073E5BE9200483BA977CBDFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 782eba98a36569474ddb027a06e2c84a3dbe38b9f0894c1d976e7488d503de7d
MD5 400e9b33fcf961ebcb0227b954a204c9
SHA1 b946d951f7d824bc676261fb755cb103216fb308
SHA512 ef9b2afcd2f59b8200e28bfec7beb2919e2721fb99fdba2d697d596dcbadb6e5557a3bafab0426ebe036e010b81e841ef3aa3f19a84526ae131be70314dd8dfa
SSDEEP 12288:GxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E94523BF955C51CAE52608B5C3E5E14DAC073E5BE9200483BA9B7CBDFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 33f7e1773a36d8a37f10bfdeecd0536cfb62eacbeae872d31baa47170ccc1552
MD5 eeff95817f115ccbe640b11b9312a8c7
SHA1 9e2fe1d5149578e204878d73ac1c3333fdee691a
SHA512 9057eefa34bf45c29b47a6a1fa9f327de2df93f40b7a40df5e74c24536342231ee09394e9741a948c183364108d3866979b66bbd1866ae867d42d077eb0375f4
SSDEEP 12288:xmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1094523BE965C41CAE52608B5C3E5F14DAC073E5BE92004837A9B7CBDFBB24584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 83b71b7807d5dc58abaf0bed54df287b76c8a966efdc4853dba47faa43cfce8f
MD5 38bfe739edbf86e0044854a7612ce28e
SHA1 2752ee1bd9959d96973c8130b61d7474600e4111
SHA512 79473bd334dba309cdb823ce5e9cc846632f9244e53f0cd4badf4a0fd7ad28c37af41a2b7948dbd58d7db413e6dd2988086a0d281ed37ce3c3e52b2e2a85a585
SSDEEP 12288:cJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1884523BE955C41CAE92648F5C3E5E11DAC073E5BE92004837A977CBDFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 f81ccbd45bfbcbbbf235347ed96779484fe5e911dc2c27b43a420f08603cb4cc
MD5 9953126335d3f952132ae6910cd11bba
SHA1 84502217161857be17755b30f003db9b8f9a4ee0
SHA512 a42aaee745dc0a995897758ebab168fc75562df6cf564435fcaa157b3d22552f249c21ebf46c7e0e058fec0abd968323471fc373c3166c48e78cc305bb59ee54
SSDEEP 12288:YPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B94523BE955C41CAE52608B5C3E5F14DAC073E6BE92004837A9B7CBDFBF24584B38462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 a8d214ec1c01cfa0140904b971f7ad6dc36fbd4fb316dc7eadcf131dd1a96045
MD5 f8c4fa7b6dedd48edb15dc415eb9fe51
SHA1 a5bc8148634c071675fbd4e3ec545894ebbf10ec
SHA512 a03a45c5a3454784b92a988eec1514ddefca030b36bc924ce9be6afab8131731007c041972f537b36924cc37068ab567973b04816bdd8136f7542891abe58f16
SSDEEP 12288:JuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JusqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CB4523BE955C41CAE92648F5C3E5E11DAC073E5BE9200483BB577CBDEBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 8fad7475089d50bfe969cb29165bb521ed947a0101e3c6e8cdb82390a26de45a
MD5 506c60b374ceb1b48aa74b6b750b2a41
SHA1 55786ffa28d798b494bfd59c6fe08b30e4f8b001
SHA512 52fa380e9b91db5b9996f1c78477f58fe8cc57e54ae9974aebdc15562f171e6bd7375eba086ff449c7e6586958aeaf0b05c44c4b5c4be436cc085ac9032fe29d
SSDEEP 24576:pfwvzk9RX6wkyAIlsqjnhMgeiCl7G0nehbGZpbD:IMnYIZDmg27RnWGj
TLSH
T1C285D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 ecb7717ff3b339e6f45dc734adc1483aa464c7cada48a1c3cf2e1a13e3dd4a6f
MD5 4f76c637068eeaeae021ce4b06b3fad5
SHA1 63e84fcff81abedfea78643ea772118ab9cb6048
SHA512 c580383730cb241c0b75130b49a20879d5f22e9e256c6e1f798a75b620d1102e0a2e57d5b472391a3770f9cc9527e61269c2c786b9a5ea7bc400c083f6064e93
SSDEEP 49152:WYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0+Dmg27RnWGj:ZySzP2D527BWG
TLSH
T183066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 66142e02029098768d6b52e24a1cca9d2918fa1ef1f65476b04e4f271be98940
MD5 bc5feb6c25f84295867a6bb2f19f187d
SHA1 1d8f0cb3b5c09f3fe3a4f81a42bbedd47f6033d3
SHA512 fd147ea79c49eaf07901d5fe7199bc8d8b7480db1e827de6ae9c8614c757eeea12025f27cfab1462c37c36dad52bf55f5eaa704acb60216b0fa749d6f3ff2dac
SSDEEP 24576:p47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYEsqjnhMgeiCl7G0nehbGZpbD:p47JUQjqirIhCnDHUPfF/ODmg27RnWGj
TLSH
T13665AE1EA3EC01E5E1BA927885558A1AEA71782E1F31CACF1270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 8ace2cd86c3fa7431e72b583428e4d47ef340f175a61f8e4e2369391be3906ee
MD5 232b315654621cff6ba3a449f4a62e86
SHA1 37025f53b7ccb58327eb41fa5322b4f07ba05adf
SHA512 7ebd326d598cf640496d0c7b2d1bc40cd68f26c8364895fcf96cd4b5554ceba860bea9dd8e380824def8dcb73bfcd9e69a036b5d2c6bfb83829b1d1425174f44
SSDEEP 12288:epsfhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3hsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17555011AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 1c1175e18ead159f7f1eb0f733f5d85422784c9f5106dd7ebedb523bc981f66e
MD5 3713462656e529e89ae6609dd74a4de5
SHA1 27f0e9cee78b18b7be92ede123ee07b3c7ed9abc
SHA512 82aa8bd260c2eec9443cb03d585283352de1756917e494d38f5763c20dbba1a3c123a5afbfbc47cdd6e3e740fd69d204bfdb1753b0839a89fe7bab39e2637753
SSDEEP 12288:xcOj3Bq0gUtIaYV5AfFi46XFYq8vGJqrHU57UqaRSvnJ:xL3mYIhi5OJiHUKqaRSvn
TLSH
T199451810762ACB4FC66980321E36D5CCAB707D51EE056F0373C9873F9576A59BAF2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 b6836722d818e150b2a44433d9fdce5d2638cf36602d160774b3bedcf9ee4020
MD5 523f767e901be81f4dbe85c303c1244c
SHA1 f4675a7f65025970754210355ea66a2f76f1d998
SHA512 ad968a1db6bcaba1e5bd95ef543c1d8f2c1a96405193eb30531dd18d6f869da6e1fc9b6a8f3ec044d8eb3f07e9f192a69d666da9a35009b6dd9c674e038e00d7
SSDEEP 6144:u+FYr4cAkz35I1eI1HB1HMPMuiKDeoH4iKDeoHCU0tr9gyrQJDfD5Txt0jg/Kw2Z:DFYskja1sPMuoYr98fD1xt0chxal
TLSH
T12C65F9805136E78FD1BB5031032A6F8DB764EC06B7466F26B389453AD86AB55B0FD3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 975ec7eae1668fa1f1df5383b41a1d00441f905da17e6f96f420a00d1d0d356d
MD5 6dd604e3ccfc9637267164638fdd9e1a
SHA1 e071a82e6688d9ebb74e875b5067a085edb7f56f
SHA512 8259c125dc5940fb3e45b9aa75f5bfb8eb55b51e462ae91e881b6cd58e5af48050c657e1f9f497515630e43f28c07b2ec09f7c5fd156d5219200a0d9688f0cd7
SSDEEP 3:OlH/l+S4/1ksqY04f/tlA3mCllltq3mCllltGlslslslslslsl6gl:KsS4tlqIf/imCtSmCtEEEEEEE
TLSH
T1E98192A94F204A20E28B203508F197850731C09AA8408F9B0648202A5D003B50C02A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 e88ab847ef825e710637c7324eb23d547b28a8ec653a541cd8c6ea2d37541137
MD5 04fe9cda55360cc942a7087c4c2d9793
SHA1 ff6b183152a054d642d843aed378363fb21dacbe
SHA512 06be5e222c3554f50cb50db1c7e71ce0b6af4ba68cd3dc6169ed7d1434cccc9c13c76d9efb99dec61cd43f294bd10ba21c25864cfd823868c23fce4cfbeb08de
SSDEEP 12288:bF75Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:x5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D045237B934C518AF93609B482EAE12D680B7E669F1044C3BA5778FDF6B18C48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 95692e407e3ce57b5453c4f52be2db4d43a6f56464f8c52b54ffec5aea4ee0b0
MD5 399963ee76208c6592bd32553ded5aea
SHA1 d1ee2aa8a538620d51c8606f41af80c9396e238f
SHA512 5f6119a0c55b6e6e4af3dd28366a70e5cf8070e205a8408001621b533c88f9ef9d693db0c9d6e60ab1bf67913a70ee6d353ec0abd00f76d224327c834046d553
SSDEEP 24576:vgb6bmBIi49WNNFpg1rSvFv7bYTsqjnhMgeiCl7G0nehbGZpbD:vgb4mBIBhGFgDmg27RnWGj
TLSH
T171659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 3801a0873482deaefefbe5edf9bb88d57e6aae4cf6329a6ec4b1f4b0b02de501
MD5 41eaed7d4b17dfb8b2a20252551af587
SHA1 9df6e03f65d090432ae4d21ce1fbe1c622fa9c9b
SHA512 98acd0201cdfcdc5229eed0fcfd1632d26ff62f71bd553fe62bc9d5b26c317f71a31f4a4ebdd2b9c9d6b724dd9345c6f7a4b9b261c9247efc91e2d389aa24369
SSDEEP 24576:fG88u8FpJqH1vzria7/m0sqjnhMgeiCl7G0nehbGZpbD:u7ZFPqVya7//Dmg27RnWGj
TLSH
T15885016577E401F1D477D138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 22dec8723e9bf211402711d60defd590e80ea44e580823d92618db15e6654284
MD5 62cf9eb56fd0305a19aa0eb7bb4c5dc6
SHA1 85d732d82234462c199f9355b76a02ff4644c211
SHA512 63c78a56f965ae0481095efdd07f397d9541b3e7dd594cbb67a58fb801a76aa9bc38ab4934627c5d24f77544a961c04d2080398994afeee8111cc54de029da9e
SSDEEP 49152:FBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjMDmg27RnWGj:OG05lO43bhD527BWG
TLSH
T141D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f1f7afab0b52be60e0135b781d8817bd8656d65d04940e185ff5f34938c75bc8
MD5 1c75177021c0a2ddb5b286e95fb09858
SHA1 9e9112f8708f1ba5924da97b2e67f81efde21b2f
SHA512 928889a1fffa7e48f9fd5050f97c2ac16a61773bc7ee84b8bfc8ab523d3bacc50968fa0b390111a8e3b8dde0b59255b5869785411172cbe8d366364c1d8dc05b
SSDEEP 24576:8fa5POZ3dpyWVM50JicR2hG0lasx2+47eidnqsqjnhMgeiCl7G0nehbGZpbD:ka5POZ3lJt2pasx2+mkDmg27RnWGj
TLSH
T10765BF5EA7FC00D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1cc554afbbdb7fa17b0f7888a4d160a24e826e843546d44e33ef689807fe33ee
MD5 be3fc6d328320a704210461ba8214f26
SHA1 59d3b6fc795e42ec39c6989d92d475e365d255a9
SHA512 38e732ce7854219ba9ea46d29b6d2fb0b71649d855883610a03cba9c5ae517ff1c47688f31a693e0f77cf87f691ed9e6763bb0f75fb7518d1545abbef42e1e60
SSDEEP 24576:INcwHdjbyQ4nLC18lb/EOjowL7Fk8sqjnhMgeiCl7G0nehbGZpbD:INc/zEOVHFfDmg27RnWGj
TLSH
T188857B2623E901E4E5BBE1BE89779546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6f33b447b5ca614f364b62ff2741f5a98d5e7ab6979c1edd704d357f2ea351e4
MD5 035eec33216dad7b805a9e181df2ab30
SHA1 f1e9ef6449b9ee10840c9575d4d9d0dded7bc255
SHA512 4537a50fce4a8426569b484c443f2688c36a021ee87f05b59df7f9562a700b243859ea9910443d06b0c3577fb13ab09aaec051e084822da90ee6fc4d9c780b35
SSDEEP 24576:fzkNvNnaFeYhJNtmZBmHsqjnhMgeiCl7G0nehbGZpbD:fzMwBtOmbDmg27RnWGj
TLSH
T10955AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 112850b100f22a81133018a91e3c73eddbabc8be4d10dd5405406beb3b707ca8
MD5 a4d9663cccefccb4d6c1e317402b92fa
SHA1 71b988bdbc3630a7ca51c817d4bdfd491d6b05ef
SHA512 478609a8ee2cae03b6c11e3ee878115bcfd6b2e9d1637aa1ce835ca0673477f6f6dbf8f935953704273df01e8b0099603511a77a482af6adc25c32a39078dd38
SSDEEP 12288:RHvUrBFrEjwaQgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:RPUr+NQgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A065F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 cd689ab9a5be4eb401cbdb3f62e94a13f0a9475245402ecdbbba4da4a920b58e
MD5 9b5511b92ab711de3bd0ad1c60984948
SHA1 619ea1e117597354885599e1b02ecdecf08c628d
SHA512 85d65f72fd32d6f0fb71d859c786a311ebedee1b231f41f9fbc8096486640c6e42a99c7879dcb5eef63255ad6ebaed2d28fda8ae59439767585c1e9d868dafbb
SSDEEP 24576:zD3FHshBIYQgANsqjnhMgeiCl7G0nehbGZpbD:zDVHeBIAAxDmg27RnWGj
TLSH
T16375E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1328-58-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1328-56-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1328-64-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1328-298-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1960-45-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/1960-52-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/1960-51-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/1960-44-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1960-240-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2428-111-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2428-302-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2428-110-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2428-103-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2468-109-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2468-22-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/2468-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2468-14-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/3092-320-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3092-319-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3092-300-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3092-85-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3092-78-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3092-79-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4768-305-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4768-303-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4768-301-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4768-90-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4768-97-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4768-91-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4952-39-0x0000000000400000-0x0000000000550000-memory.dmp

Download

memory/4952-6-0x0000000002270000-0x00000000022D7000-memory.dmp

Download

memory/4952-0-0x0000000000400000-0x0000000000550000-memory.dmp

Download

memory/4952-1-0x0000000002270000-0x00000000022D7000-memory.dmp

Download

memory/4952-7-0x0000000002270000-0x00000000022D7000-memory.dmp

Download

memory/5004-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5004-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5004-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5004-131-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5592-115-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5592-124-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5592-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5592-116-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5592-122-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5688-69-0x00000000009F0000-0x0000000000A57000-memory.dmp

Download

memory/5688-74-0x00000000009F0000-0x0000000000A57000-memory.dmp

Download

memory/5688-299-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5688-68-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/6048-133-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/6048-132-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6048-306-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6048-139-0x00000000006A0000-0x0000000000700000-memory.dmp

Download