6de96fcde8f6e8dad580f36557061683a2d0dca643464fcd3682f56dca21d6ff

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 13:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Size 1.4MB
Sample261113-q4c62act4x
SHA256 6de96fcde8f6e8dad580f36557061683a2d0dca643464fcd3682f56dca21d6ff
MD5 3f7329926245db085bf3526e9a83f31c
SHA1 f3c235ec0052451c9ff209ff010070032b9e4a6d
SHA512 786b4ae9f183e26cc05267b9698d03f11cedb26e82b7d51597ad6ca6dee3dc9c2309a65f700112f7c60b0293f6fd1c3c8af3b2357d910737d6a960a818dade21
SSDEEP 12288:xDXCs/YAh/elvhI7Y34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2i:xuU/h/4KrSnnrFb4PM4MYgLxEVyGLA
TLSH
T1506512B1B4C080F2C966243345F5DFB4563EBC74A8A2950FA399393A6F333D15126A9F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5008	elevation_service.exe
4060	elevation_service.exe
4332	maintenanceservice.exe
4976	OSE.EXE
3524	PerceptionSimulationService.exe
2300	perfhost.exe
2404	ReFsDedupSvc.exe
3960	SensorDataService.exe
4532	ssh-agent.exe
6044	AgentService.exe
4196	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\66ad9d15b68fd3f0.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b2d269b97573dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004d9d64f97573dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000065822ba7573dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000334827f97573dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cdf643f97573dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fba384b97573dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002b5172b97573dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
3528	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
3528	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
3528	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
3528	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
3528	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
3528	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
3528	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
3528	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
3528	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
3528	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
3528	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
3528	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
3528	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
3528	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
3528	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
3528	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
3528	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
3528	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
3528	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
3528	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
3528	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
3528	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
3528	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
3528	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
3528	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
3528	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
3528	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
3528	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5008	elevation_service.exe
5008	elevation_service.exe
5008	elevation_service.exe
5008	elevation_service.exe
5008	elevation_service.exe
5008	elevation_service.exe
5008	elevation_service.exe
4060	elevation_service.exe
4060	elevation_service.exe
4060	elevation_service.exe
4060	elevation_service.exe
4060	elevation_service.exe
4060	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3528	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeAssignPrimaryTokenPrivilege	6044	AgentService.exe
Token: SeBackupPrivilege	2404	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2404	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2404	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2404	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2404	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2404	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2404	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2404	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2404	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2404	ReFsDedupSvc.exe
Token: 33	4196	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4196	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4196	SearchIndexer.exe
Token: SeDebugPrivilege	3528	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	3528	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	3528	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	3528	2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	5008	elevation_service.exe
Token: SeDebugPrivilege	4060	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 2432	4196	SearchIndexer.exe	99
PID 4196 wrote to memory of 2792	4196	SearchIndexer.exe	100
PID 4196 wrote to memory of 2480	4196	SearchIndexer.exe	101
PID 4196 wrote to memory of 3428	4196	SearchIndexer.exe	102
PID 4196 wrote to memory of 6064	4196	SearchIndexer.exe	104
PID 4196 wrote to memory of 1516	4196	SearchIndexer.exe	105
PID 4196 wrote to memory of 5964	4196	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-11_3f7329926245db085bf3526e9a83f31c_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3528

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5008

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4060

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4332

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4976

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3524

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2300

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2404

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3960

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4532

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6044

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2432
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2792
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2480
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2988 3044 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3428
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6064
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1516
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2988 3044 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 98830f2659b51c74dc875440d5f7eaf5c7e26f39d5e255ef09263c51eb603fd7
MD5 9cd9b847025faeb30df0ca3f92bccd5f
SHA1 c7d1d1a6fb43d8b49e8ff4ca75b69667783417bb
SHA512 5f64b9b9410a5a6d3b3cdd7ed128ccff3ca31d6193ed6a31dabe67448e520d2e852114e8acdb15276dbc981e1b38e3b70611c242feb37e40b504b18b024f49dc
SSDEEP 49152:vb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnjj4MYPVyGLG:t3q60jBzV6
TLSH
T178D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 e7d0700d5a64cf197f9db105540cc6fccdc7c3541daeca153a9beb0b726e94f2
MD5 32d51f72e0c2efbc496c690d714fb90b
SHA1 b8da263d4969691c7836bc2050f505d5f831b621
SHA512 054eb32941133c4a1c9954dd1494402d2d6a1ba213bd12da93c67f3a001bd2aed8c1c109e199afe05d5d312a10044d9ed489bab21a44da741f8bba848ee529de
SSDEEP 12288:X1XLsswWkxy2lRq2czA+34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9Q:FXYfDtczA1SnnrFb4PM4MYgLxEVyGL6
TLSH
T1A365F12977E408FDDD6B8278C8A28555E633B8518760F78B03E499662F333C85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 15823d8cd0ee6501d4e24e743d9beb22b8fdb219bb66d50e780fbdc791f902f4
MD5 6609c64d636a69df7cfc3123f04cc381
SHA1 08d8ed97fd3ddf3b3dd52278e2b175dabb87b37e
SHA512 eae351ea9479d9067b1a13408d9a60b90c4c67c92baed6cc93688ec0db8101805b98016f6f5a8a238edc79349f56b600f39c38c25f8e968cad5947768f7fb340
SSDEEP 24576:j0Le5ji0hmxNrM4SnnrFb4PM4MYgLxEVyGLt:jPji0A7Uj4MYPVyGLt
TLSH
T19C859E66F6788375D073C0B9C5D2A68EE97130825B308ACB4286D77C3F676E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9942f622b9001c6af41989a63330916705c75be4b1481c71278f8193c5b8c068
MD5 9998813efbbe79bdfcc6ed11d5f43a27
SHA1 863010c3341d5d11b7a60f150c3d7bff17d461a9
SHA512 1ff34791a2c2cd3bce1711eaed9296286d7b15627f8c91c0947be0add2666b38a09692fd0aa9e110b1f9885b279ddef656d2cf9ba5afcf62816e426e3dd57134
SSDEEP 24576:3a7/ezSC6vUyD/aqgrvWr6q8wyuSSnnrFb4PM4MYgLxEVyGLx:6/ezSC6vUzPviHjyQj4MYPVyGLx
TLSH
T191755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e75f1f1103f63ad06822512c66865752a77100c50b0dc82e83cd9806bc98c800
MD5 adbecc4248dd7affa20c2a8fa8fd7cb2
SHA1 8d1f5ee8d03f97c5239cbceaf996465fc705818a
SHA512 cbb9abdb8d4fd8ebf93f3be2cdb4b1fa41724cf72ce72abadf9e822eee887c7990999be13b47397e625a0105d717b049053725544c53c2ce659945b6b74d08b5
SSDEEP 24576:CVbqPb88hv/l+bZSnnrFb4PM4MYgLxEVyGLS:CVO88hXl+Gj4MYPVyGLS
TLSH
T13B559E66F5B48331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 c6ad2ec611232236115afc19ff6d4947461395787bf863caf65cf3957842c158
MD5 aa82aa1a71a3801221055528855929ea
SHA1 90c732c0eeab7504bf1735e7ff7cf2484d6ac020
SHA512 51f9559f94f71341c71e550c20d08efd7301d58f1ad50dac79471f2d945c77b22e419c242af447dc7a99922836505750a16aede2f19cfdffed07fb87642876cd
SSDEEP 12288:hjz34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilU:hjMSnnrFb4PM4MYgLxEVyGLq
TLSH
T1D34523A65BDC10EACFAE15B0D1B96AC8E6057C61F875B10B6750785B3A3F20DD891313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 a795b9f0ce92995f82573e4317077ddd3766ec4fc009fc7e0c44ff34a9853c34
MD5 ea3e6fc64f5aeb811f7cc1d250c90db0
SHA1 63247256fc5fa2aaae3520383bf0bd951ef9e269
SHA512 157baf8d6d1270303de61227dc3dcfe33f725361d6bd32ba52fc68ac1e404da01c525735fee981f03bce41813f362be7085c0edb4e150ac083f17443f80e6c1c
SSDEEP 12288:leBNUbTVO86US34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilR:lJIUhSnnrFb4PM4MYgLxEVyGL3
TLSH
T1AD65DF3BEE28FCE2C67E4DB856918740E77278308F62A3CBD165820E9E235D45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3c57166f38ec746f84eb5e57986a2de1ad71eabca22d33a7deddcf928628a310
MD5 e8f5567da6fc43ee056435e7548ac634
SHA1 700ba59c2c56aae047422b26470b0382600b170a
SHA512 ee73b6f0cfb9856a47c4d59d75cf3a274fe99444915007df44a0cbf678ec2094e15b4eb1bbcaa6c4c064a8686c8fb065abe1ed9b10d5ee0b5d2beb289aa72726
SSDEEP 49152:rQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THe:rQvGAdlCEL8c/RRNw5CmVQ
TLSH
T181267C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 ff3991508fb1bc2de665d277f22f4053eae55ea3bf68e09c94cb16abc856b995
MD5 c873561f0e79ff2ea3c224c0de5bb080
SHA1 73e401b85c0cb3a5625f61e385d2ea378927866e
SHA512 c2700c4fbc3b4b88e5229fdebe2d2144fc605b9425b51b2470cb5c259ccfb0d904d49d487a63c9b5b9237e2d1a50abb1df9e0dcfc9bd0c53e4ca02c0e6b34b4c
SSDEEP 12288:6AwSfxL/2Dc3DDLLmt0LDQewsAjI34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAZ:PSewsAjbSnnrFb4PM4MYgLxEVyGLi
TLSH
T1DD75E031FE74E036C7BF0DB21B36D706542DB9204B612AC3E3A89D9E59342C26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7182f1eaecd5ece842d3dc7b14476358859a4e7f528096b2ad2c53f51eb73828
MD5 8aff12f0c3d2cfdf31c0fb1ec420e83a
SHA1 0911f555c225df561dd3489591cf0c316969256a
SHA512 56649daa2952321cc9af951d135e4c6aad7b6c8e23cd5293d430a7997f2b8d853414bbfdd248bf96908b0f54eb89b7d1fc54748257b0df22a8a5ef022a686109
SSDEEP 196608:rUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJH:rUEtQevvqc2W1cpV2RI32
TLSH
T1E3474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 26138c03ef0154dbe58e8cd3bee9e94f44fd90472c2dde094f2c5dd5063ae0fd
MD5 5b32dc1e99e577893d3f7901c299aa3b
SHA1 979005fb211392aa931d6a0db269bcc278039c06
SHA512 26907d26bd7e4f97214b0b836840889be5c979c1f98c7c89755af5457950302642632ec7e1472e57b05a2d05dcb17b50344349510cc6a74d5a5825f5f02ec64c
SSDEEP 49152:qCbRquA/m2yL5zifFiV+XenmE3/zEj4MYPVyGLg:foqHVjnmSV8
TLSH
T186D58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7b123fd4659544b965c3d79f5a127f97f4a9875735b588867a2e7d4ef68a67e9
MD5 7ededa436e1dcc6bf84c436c0d73d55c
SHA1 b040e184cc6d28cd15ca6d1610510aecd6eec987
SHA512 be276e073179b73fa27afd50fb43044d0149515b2619f565bf75ac4ffcc787fe046fa993b39dbdef160f2680577b407e45bfe0bc731d0d8b15ba4045a8182c6a
SSDEEP 24576:EAhGL2IFoiwtA5l7S53OSnnrFb4PM4MYgLxEVyGLj:EAM1Foiq5Zj4MYPVyGLj
TLSH
T1D235AD81EBF955D4F5B3AAB899B68170EA76BCA65E31D20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 428159edc4ff1a4f71635e8f183bbf4aaa49bdb6b753b51c86e220c8839a8241
MD5 d87456fc732b987bf4b04d1fafc8c915
SHA1 4ccec2f1a7f85ee717c4b35195754c4f484f92be
SHA512 3ad54f2649019895ca3958b943c31e404d178109552923073a8a166e704d0ace79dd0befb5dea9395ab2dcffccd970ecd6238db52b7927b409445bc14f040afb
SSDEEP 12288:kmw5HEjsChNSBFgl0WDm+C134XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqb:BwuXOW3SnnrFb4PM4MYgLxEVyGL5
TLSH
T12065F14637E81CF9EAA74238C597C535F7B2B8122A21D71F1760C65B6F37311AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 6ecd6d4cbdaa471bf340dd5263db572e2f578859a7d8df33dc1b22b47090aac9
MD5 05bf6d1bc0c4e3f1c3f3941494daee50
SHA1 5910608bf709b8513f12d2757f2ac506e20dbe63
SHA512 4720ebfe1421570f6904b2b1705336dce36e75445b86965e116de7ac12e59ca04d1dfef6a4f35a7781bb23cac20fd1b6572a6e0a3e9af1d79bed171f2dc65d66
SSDEEP 12288:R/Z1IyY34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2iln:JZugSnnrFb4PM4MYgLxEVyGLh
TLSH
T14D5512AA37E820FAC6AB4274C4F55688E3227862B77293CF1650655A3F37AC55C35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a6a835d565abbd38a172ce92e0442fcf6b5b50ee9872a753b10c734f71b20f16
MD5 7b91c87a7320ffbceaaf187d86647223
SHA1 1338d186840dba0ea6b2e9b3eec534a8e68b8601
SHA512 c5e7a247b806fddb8c9884eba5f1a160c43b91a610ea0fc04cbace71b70ecdf3fd6903e2c0c529db96bfaddc6781c0ccfd82a0449b826661b0d946be383a90c9
SSDEEP 49152:sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UW:jQRQyi36YOcPhLvw2gAf+PN3nVI
TLSH
T13C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0a32e0c80d20dc5c167da50e7560392e217ff6ee3b6f4584c92a42206f1f4c7b
MD5 f70a03d3774f16ca0eff3966375a7644
SHA1 864f52da89b2deb2b4f4efde2a059628b0762a50
SHA512 be0a9dfb2407a829239b23d4519be2c8e86b6a155b727c215a6047dbfe7f6cd286bba92ebaa2f82864286c99c655e514e372960653b9ce6d8c4f9d02312c6a20
SSDEEP 49152:lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Un:8QRQyi36YOcPhLvw2gAf+PN3nVV
TLSH
T120667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 72c7a050ab523c18796fdc9d806c10962d0538086922bf60f0eb1b5f34bfea00
MD5 745fc697174ca714970aef733c6553eb
SHA1 9c22babe18aa2fa6ebf191252b2a5d48d8439f5a
SHA512 92073fcc7505a4f62708b19b2dd6d5fe329f80046fe8173b9a6da60860e68133e38352698d48ba940e8a1d5255a222a49a7c61e1fba9371274b04bed0951f2ff
SSDEEP 24576:AwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0QSnnrFb4PM4MYgr:m68Qg55nhceWu7PNU3/Uj4MYPVyGLQ
TLSH
T1D6B54A33B2F600A9C44DE1769F4A972196D27C71CFE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 effe3e6959bad92331aebc36b6ed766b2696a4dc08da3bed367c81f3abffd90d
MD5 5969f6f8cf2a6c2d7e8e7c203afd7f02
SHA1 112d17bd379ac8d42d5624d7c25686b196500655
SHA512 2632b50d99c8dfdd93d31f4c4b5f9bf76d6a208f395456a4e92932ac75d4fb9236edc80d373c17cda6a50b66ab044978584f49722740b670480eab21af757bb4
SSDEEP 49152:M3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99p:py5112gYy5azzVva69nLKnhZcVR
TLSH
T101167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2fb778ff7fb008c73d79ed1942fa7cccf3c225bec19b30bd235eed9cf5fed242
MD5 469fd289acf3a8829aafa8d8ce2acf03
SHA1 4e8273049cde2c7ecb2871543e824bd0f261d25c
SHA512 6c245ed200df45dcf9e82afecfb4e603c3431fb56840545e670b7a521827e5aca3d987d1f059c592543e58cbfe9e3d63f854c6ea186f3b944182b193943e59a1
SSDEEP 49152:UB+taZ3usBWOBr4tEG20bqx0z+n217aau1gl+j4MYPVyGLc:Ou6JmUxd2d/VA
TLSH
T15BD59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 81d303f8f1b7863bdf90943c5d8d7759fa4477a17e5fee780913ecd8449ecca0
MD5 f16560472bd51980c890b997f981f9fb
SHA1 d0f1fb857e7298568fd1e1de862dc9170af208fb
SHA512 c8d1484dbba95f82c5292265544dde9c65a13b8fc9b07147947c6036a6eb90611026bd125eeeb4acc95fb4abcb07b84f3392e86824abc5e12f067ef05b38002d
SSDEEP 49152:f1hpsNoJpF1A6BU44CwH7R4x6j4MYPVyGLi:fmifPkRSVW
TLSH
T13CB5BE13F2D900E8D06DD17887569232EA62BC460B34B6DF0A90B7962F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6bf23bb93ac84f67ec161f1ee1f3ba47913c915a0d47b17dd66b83e1231a0925
MD5 a394238241a46a07ed5464d5ddc1a6d0
SHA1 72c0e9e5f72d77853c49867b77532c0e1044543f
SHA512 a786750df5e1d58256dc767789e8e0edcd2e67f7c5ffdfb9a0cfcf1cf191c1f53a85a9f43e94a963389a3de34d3a33b2a990cfdd14c0994fea17fd2eb64e00e0
SSDEEP 49152:/SuZQIY0Be2KNRVtOnks6NMHqzj4MYPVyGLh:F5dKvi61gVl
TLSH
T140C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7b7e984613ae591ee8986400bece586122cd78c27215d685d018e2246b918a8f
MD5 7b3ee2c6c221246c1c1b6d1f00f0b4b2
SHA1 883b79d14a45618fcb749a3318da990c4594d4be
SHA512 adfe2591913658d2441f19b8a87df3f6c4b1fd813ba593facd5fd05e654f1a2ca10ba2b6708a4a4ad2c1113c83da702424bc3f50a2c316c076f77b1f378c112c
SSDEEP 49152:FhtSn8EApI0figXgiDn0AP5wOj4MYPVyGLB:0X2iyphuVt
TLSH
T16695BE13F2D900E8D05ED174C7568632EA62BC160B35B6EF0A90B6562F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 4460fa63028ad9ae1c72dd2bf3c39c262d8a10311061efe5961366bf197ac009
MD5 2ffd7b07b01c6842865ea05dd29ca6ff
SHA1 85dc6a7703b3385fa5e1ce8f0fbe7b2940dedee4
SHA512 dc8aee3f5507e9e5ad1282ac471c75439aef5b2ce149754083b5b20f9f0e31a5122e0bb76385424e2c88288523eb4ad3c52553fc6491536e1bea5cf9fd6db53f
SSDEEP 12288:/734XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilY:/0SnnrFb4PM4MYgLxEVyGLC
TLSH
T18B4523A62EDD10EFCF5D16F0C1A966C8E2097C62F976B20F7B4574173B3B20D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 0a94476837dde77931cd2a6f80f40bd4a6131bff3a5cc38998660167ce6b2882
MD5 f343bfb8943fda22fb1e7f8a38fabeee
SHA1 f882b19771cf0bcfd6e334fe5d1904d572a001c6
SHA512 0489ccd1ad86a874dee1f593f251b320de8199bbbe647b88420997ee11ec9bdc7a87f201053814403e341a014a79bba135c0797c21fc133d7838bcd5e1d849a5
SSDEEP 12288:1E34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilh:1PSnnrFb4PM4MYgLxEVyGLr
TLSH
T1E44523A62EDD10EFCF5D16F0C1A566C8E2097C63F976B20B7B8474173B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 2ce63b939f27ed556e96901515b7bbccd7aa0af0d521f73c1c8181244ada6769
MD5 4e1d64bf63def12cd876a02881db2ef7
SHA1 fd82611356ed203a13b89011212d743f9c4a8a8a
SHA512 ce418a8cc0a45a88c4aa30eeb30ef997f214b38de09b743658456ec87885dc824e6e0adc94c19a2ef34a2b24198a412ab44e05cdcabda12583373b30526f87ef
SSDEEP 12288:ua34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il8:uJSnnrFb4PM4MYgLxEVyGLW
TLSH
T1BE4523A62EDD10EFCF5D16F0C1A656C8E2057C63F976B20F7B8574063B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 6327db2ba20b0d49c0fd7b64838f786cc8f88db243dfddafae3a0d5091a1d042
MD5 ade88bcebbd47fe4b272692b6d251cfc
SHA1 1eb41d4fd44163134723eff01f73dedc94eacc3a
SHA512 f4d34d7edf915ac828d0c9816e702fdf4a6bd12f37fc9e3911ae07fa9ac09b920fca1ab03cff8674d864cb2401d7839b04ec0106b1ee799bcfe62128d62790f2
SSDEEP 12288:nVp34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilN:kSnnrFb4PM4MYgLxEVyGLj
TLSH
T1314523662BDD10EACE6A96B0C1B556C8E215BC62FA72B35F6740381B3F373489C71721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 239253fe95941773daee8e0a19ff359d021b5a200701f8c3a6dca2016013570b
MD5 baa117ae01d36daf145879801cb723f5
SHA1 2726cd338c75ad0aa2f2519f9c327bad44879076
SHA512 5ba0c83c2990ae0aed2fdc9f7f72a5ec131be482fbdb0b3b9b490393ac90a0a941233352112103e2a673ba6059749faeeea975c02c147aa9de2f41c5b09c9638
SSDEEP 12288:lB34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilO:lGSnnrFb4PM4MYgLxEVyGL0
TLSH
T14F4523A62EDD10EFCF5D16F0C1A656C8E2097C63F976B20F7B8474163B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 a2eb08d3193fcf080e2b9148d921f175b292702d34e256756fb09a63920002e3
MD5 b04173762537cf75b3a31e42866b6eee
SHA1 ef902feef6809fd19eb94868255c4503dea879fb
SHA512 3ca47ad5c339351a0198f3d52fea42f8a7dc65b16b82f95281f726b5e7b8f673231b377376d79e5fd867bc2dbfcfb8e688570f781972c2f8cc7c2d484701dbb1
SSDEEP 12288:hw34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilA:hDSnnrFb4PM4MYgLxEVyGLC
TLSH
T15F4523A62EDC10EFCF6D16B0C1A566C8E2097C63F976B20F7B8574173B3B20D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 cda1f4a3204448b1b3abb81d439d7795a9f8c0f4dee8f246935a924c00cc922d
MD5 5c037d72f773bda49bac087e67760ea6
SHA1 8beaa60d992af5b8ec6f78886aa28beabcf761eb
SHA512 1a0f22d3e030c53438486d350cba7efc81c6c79d00a4a4fa6cafd4f15d83898ec7b35cee67055da5c2b4b0c1987aeed2a3e80cc29c89a2af475f332ed672f387
SSDEEP 12288:Dc34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilf:DnSnnrFb4PM4MYgLxEVyGLB
TLSH
T16F4523A62EDD10EFCF6D06F0C1A566C8E2097C62F976B20F7B4574173B3B20D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 7c82c5666fe04c50cd25b38c8fb23fec99ec990ed685c8b90a988bb6a14a587a
MD5 ddb240897975b518ba2a40b3bb0d7f08
SHA1 e49afbffa4678ba53886be38311f621181effc8c
SHA512 f2df6680e30fc5d19c52c5326e99aa2d5d99416c2d2a0472e751b1738839d9154376cbbfcf7a8889dc20148de9dec296c94912edcffef1c3bb8352bd36c7f1b7
SSDEEP 12288:fiZwbczzFEoS2cPvyk34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r25:6ZMMzFVSOvSnnrFb4PM4MYgLxEVyGLo
TLSH
T14A6502A5739018F9DD67823EC9658945E2B27C265B70C61F13E4362B2F333911C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 5fe7612dc3f9ec6b6bece9469ebb1860a3cd625e3e4bbaa33d733454fb246038
MD5 203d19a7cc6c2b77830643e413550970
SHA1 0e960aa67a07a823de1f905d7b40a76f103c819f
SHA512 49fe0e830d4eb7a99c7141de3dab45a306a63d9747b57ca55493b54150d8203daf0098aecbf79c0519d6336b381551dba5f2eb4616024c08c524b08593353282
SSDEEP 12288:pv34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il3:pwSnnrFb4PM4MYgLxEVyGL5
TLSH
T1A24523A63EDD10EECF5D06F0C1A566C8E2097C63F976B20F7B4574163B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 3aa26f5dd7c6d717c677671442d0c68d749f1fa9515fbeefc4b0da9ac20bcd78
MD5 24b93690979d9b62c099f01ed8011bc1
SHA1 1761d6ea1413a8de71db6ab9ac48ffebd348dcf9
SHA512 db2226dd7d60d2b6dbb8881788e2fac725433d9ff5bbace88c6aba994486322f5e10c908b6ec3c529b5b657ffe40fbbce6b21b6ea7afd61ecfc73ab94f7c7c5c
SSDEEP 12288:UD34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilC:UcSnnrFb4PM4MYgLxEVyGL8
TLSH
T1EF4523A63EDC10EECF6D16F0C1A566C8E2097C63F976B20B7B4574173B3B20D5891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 913808f30915d0eccae7e0ef204fa1c80423da05e60312aa3e82cb19ccef2439
MD5 a97ff3cd1be316152efa9f22e3a44471
SHA1 8e8a5eb4b163e57439ad94529127992a4f2ae9e4
SHA512 441b57531b5753f313084ee6007da6e8d16ee3fea66abc31f5b3d9a4c5ae1a72030ed40eccdfaf71c9057b9a4803e991607c4fb71ebbfb71152aa4c6d06a71c0
SSDEEP 12288:LyPz5L8Y34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2iljB:mzyrSnnrFb4PM4MYgLxEVyGL3
TLSH
T16A55025737A530FDC67A8274C4A21A45F336B8329B309A6F279016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 a4ded0bf29cf273b03688e0b7e8ec89ef6ed28821c79463a3e9dc7913b837d1a
MD5 4a0863e0ccab2a26ba41803cb83876c4
SHA1 b981c4a99d79f33cbb338d072e4b09c6f1fd6036
SHA512 6edbb93bce5f3520c0a2d4e41b057c873c433b17fa78f327ea80883e1757a212143df98d1c0d07e74e5f8f7b693ca37e7a72100a02e2e93ddf3dd3ab7da3c0b4
SSDEEP 12288:av34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilf:awSnnrFb4PM4MYgLxEVyGLl
TLSH
T1334523A63EDD10EECF5D06F0C1A566C8E2097C63F976B20F7B8574163B3B20D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 e8a18fbd010c74c2a65bbd42143543408158e3e5db42a24a1e4893d1544d36e4
MD5 761fc4311cb9fc8c3d0d840c0d596023
SHA1 e111e744aebbcc4448afdcac64e902f82d3369f6
SHA512 9f7499187fefef202a2650037b7c91e9b4ef2a39897d55c367d5d43cb252884365d45f03aa312edea4be553814aa6f77c0638c7fcc6ef90f92f2250e546d6ff9
SSDEEP 12288:Iv34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilv:IwSnnrFb4PM4MYgLxEVyGLh
TLSH
T1034523A63EDD10EECF6D06F0C1A566C8E2097C63F976B20F7B4574163B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 fa159c8413d04efe75175c2bd9a977c7d66968261f59ef41c949ab053144a377
MD5 8c40d961c96e9f19e378523e99d31d64
SHA1 a39fb93922b9c0209c1a062cd566e2c0a6f848a6
SHA512 487b1d08dfe8e4dca7135a3c6785b9623b156b8e15040225344e179f78ae4c087c3eacb06917ae608a179863a12b1bc4efeea385f6dcc5b660e5f08578433110
SSDEEP 12288:HyPz5L8Y34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilF:qzyrSnnrFb4PM4MYgLxEVyGLH
TLSH
T17C55025737A530FDC67A8274C4A21A45F336B8329B309A6F279016773F372849D3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 c35c568e1c279136cdba3d26fcc4e92affd6aa893226aec12724ac5386ee668c
MD5 b44d986d2c9a450e4aa52035030321e3
SHA1 f132d2f3c8ded613a7b8caeade027ea3531728e9
SHA512 cb3cf5f79c4952973c3990a70adc7c75d0ad44b54140885320d4e035ba1ec535373b24791e1b84087f6b53fc9352bb8a13880527a69de0a1c02bee4f9344c252
SSDEEP 24576:ZT9aLl3z0zD5SnnrFb4PM4MYgLxEVyGL0:ZTQLljNj4MYPVyGL0
TLSH
T1B06502A5B39018F8DD67827AC9658946D2B27C265B70C71F13E4362B2F333911C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 1489910f0cbb1345ea2e12a91cda32aceaf0f239d92d8395ed33e39311ddd5a1
MD5 3b9832adf41341b7747f4b384e654f27
SHA1 6181f7de7c63651d1ad2e36430774296701ae6f0
SHA512 130c1159c268901a93e913d24481ea71c8be3cbcd18b2c25d010d654fb618d51dd25b59fd97cd6e4f6af7489f6edb301dd5547543aed2a2b71061b6cb397a936
SSDEEP 24576:O3td9CHKy7GZdSnnrFb4PM4MYgLxEVyGLc:Qtd9CHKyacj4MYPVyGLc
TLSH
T19E75DF90F3E810E8F1B79A35C9765501DA767C6A5B31DA8F03A4251A2F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 98aa080c7a85d006d20d764a2bb52519880906511808222c4ac05a15178dbae4
MD5 153dc1809f8e2106584c3d323880c2ea
SHA1 7d244b9ecdbd5ccd285736d766335a8af156c4cd
SHA512 f4e475f9b306bc714a78af4aa4fcefeedd64f2fe2a1795bddbc8ea2c039fe1880b77e4604aa90bf523b9208d54200b145b326c8053e9b76e863fec0b6b7337a4
SSDEEP 12288:+634XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilc:+pSnnrFb4PM4MYgLxEVyGL6
TLSH
T1A24523A62EDD10EFCF5D16F0C1A666C8E2097C63F976B20F7B4574063B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 a88f9cbb08d35114ff783fd96fff60fee0dba03cd583a4d0f1de56428703e616
MD5 5029949182db7f8427e9eef45629161f
SHA1 1662cb37bbffdd03c001a5184b924ca032666f0e
SHA512 7e50b0d6a3c1fd51bcd3e7468e9c93c223e1b1b0a1c6eb2ba82a6021939e41aeb1cbef008c562c4843fccc864b44878f516fb7bff29913d5027558d8ef3ee795
SSDEEP 12288:h434XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilI:hLSnnrFb4PM4MYgLxEVyGLG
TLSH
T1024523A62EDC10EFCF5D15F0C1A956C8E2057C62F976B20B7B8574173B3B20D9891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 ecd58b9d647cd2f4ddd26a4e51e02d73b1d24fdd6963a1d4f53aff7174742162
MD5 581a6aa86aa8ce9f5becbcf1c554f6c1
SHA1 b5e8b1f9446b34477397a159d99fa06f0cc4c39b
SHA512 e3f78acd06551dd481d3ba1f23b7cb926e659685f174c5752f8ba92073ff1eb34621ea5823c0758ca0c37289d945f276ef3f0995388371d4670843c963031434
SSDEEP 12288:LN34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilg:LKSnnrFb4PM4MYgLxEVyGLu
TLSH
T1E14523A63EDD10EECF5D16F0C1A556C8E2097C63F9B6B20F7B8574063B3B20D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 63513d68b9c2a97ecf096457c9fca2c9428dec44b5cee2769f6720851bca6ccc
MD5 0bd5d7baaf06e114ba7dbadcac6574b7
SHA1 8ac23cbad1ffc6f72fdfecca91609e41944c66af
SHA512 ed2c6df730fda50eb9a73d42bd010969967248946e9d9659949dc6e8f74e50bdd2d850c7a680d0d5134b4b23893c7fe690af2424abf102d2ec1b0c70481076ad
SSDEEP 12288:Mv34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilc:MwSnnrFb4PM4MYgLxEVyGLS
TLSH
T1034523A63EDD10EECF5D06F0C1A566C8E2097C63F976B20B7B8574163B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 c7b14e91d3c32ec4806959efa6dbc74ac956a362c27717929a5a1880e3126381
MD5 bde3bb595e41f9e38c2fbd4e17f8d686
SHA1 494158e9cebc9b1d2296734e756bbcfb97f1cd42
SHA512 0e2b9509f761148c88bcebb41068d483ac1f52d84b63367d80138d751c8fb695cd084fca8f9c8811cab6c879fd9c0d548f943d1cbf94211dbb0ef4f94d06ce1b
SSDEEP 12288:k634XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilJ:kpSnnrFb4PM4MYgLxEVyGLT
TLSH
T1C14523A62EDD10EFCF5D16F0C1A656C8E2097C63F976B20F7B8574063B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 d8919eb0656b78942953ce1153d55d59820fcd4025083bad0c7a610b5eebab35
MD5 4065dd4f851381e6abae6eecad0bb8db
SHA1 b973518942dd3ae78da34d1fad8967c1347c8387
SHA512 71f54368b48cffe87ae2d73c8d7f5592151e3dd132a9d44b2101b7f2a8792955ebbf00daa510c81916128c47371710afa65148b32914f049e6c0bcdeaefe588f
SSDEEP 12288:Sn34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il8:SoSnnrFb4PM4MYgLxEVyGLa
TLSH
T1EA4523A63EDD10EECF5D56F0C1A556C8E6097C62F8B6B20F7B4574073B3B20D9892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 453018f388b4fce4411d68c4123fa3f3997482b1daaa7abaed059ecc9018dec8
MD5 0d15952f366ff67566a26a3a96fb539d
SHA1 b4f96359bc07952175d478b7f9bbe371efd03b39
SHA512 9f62c6d4493011630275411108336d56110657510bb98d9c8a4c0e87d2b713b5ee5a1c12afc98228a033412118c50cc43cd999b77a08c6f6778f8ce40a0ed157
SSDEEP 12288:9B34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilV:9GSnnrFb4PM4MYgLxEVyGLj
TLSH
T1A84523A62EDD10EFCF5D16F0C1A656C8E2097C63F976B20F7B8574063B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 143b8ccee573b78351bae24733cf25d80c9504bd4fcb94db9e575229f427174a
MD5 9bfad2c6328993eb252d95b7b3dc886b
SHA1 7efe71add166dfe6e125f7ff4032fc603df7f4f4
SHA512 58d8d31e24f2dc0ff1c5b6e820e55453cdf3acf277c687ec6f38d08ee674c093b7ca86c19fdf538247fa378cbf0d72421d3cde6a13bdc8986de9ab550dd58bde
SSDEEP 12288:ji34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilo:jxSnnrFb4PM4MYgLxEVyGL+
TLSH
T1EA4523A63EDD10EECF5D16F0C1A956C8E6097C62F9B6B20F7B4574073B3B20D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 8a970b7de26e2bfd19553f06989d2cb11b4cc4472eedf45c49e61f1a9b9e7cfa
MD5 b2eb7f567a5340e589fb33d17a8cec60
SHA1 e642f1ca985634ee34a7527e6cb026474b1973d5
SHA512 461818a948f0148bd524eb5138ec27b2c3fa9b692c79134383a8add21226240fae4c1d1f0a482e9290de76dde13f1978bdc45663257ad982569acb43c5f7bdd4
SSDEEP 24576:lfwvok9RX6wkyAIsSnnrFb4PM4MYgLxEVyGLE:rMnYIfj4MYPVyGLE
TLSH
T15785D029EBDC04E5E1B7923C89B3460AF2B178695B31C2CF129A536E1E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 ef93aeae51fbfddaaf708c5869642c3221110210d5e193854dc4613f7377662c
MD5 e99dc23801f751e7a7710172b5594666
SHA1 3d6457052d2f2e5a05fc9a85aece4a1166aa49f7
SHA512 3630fa8e4fa7eeda90fd8e98c3ec99e00643f0db10d06816ecfc084ce948cf514e0bffa1887fdf2955beacf6b7f06c80c9113060552b295cbbdc63b96db16248
SSDEEP 49152:0YvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0uj4MYPVyGLN:8ySzPHVp
TLSH
T12F066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 9a435f169e5421cf57c662c96420df93e2efacac32d3dc40d3ea2e3683696a93
MD5 0cf14ef168a84a8dc26f23cc17a325f8
SHA1 692d6ca7938ba749debfad905b266a3f9179e061
SHA512 64c5386c7773581688eba1d7cfb9426cb7d8c3c9a377961355e6ebd20e9ac547976ceaf79ca6c5c4ba8b943e0627d06ef5c77b5c4548344f9d3084a56586956a
SSDEEP 24576:K47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AY/SnnrFb4PM4MYgLxEVyGLF:K47JUQj4irIhCnDHUPfF/+j4MYPVyGLF
TLSH
T13E65BE1EA3EC01E5E1BA827885154A5AEA71742E5F31CACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 98d1de5457ed845c70135847075fc8c81ede8ff611b345848424d23511ac17a6
MD5 6844234e02ce90e09a04a9f5047ab90a
SHA1 c3702b7d4f41e7cc9cb5622ac8a03d14054af971
SHA512 8dceca23c6964d220cce54946f574693aca7cd48ec7caa13c9c8a827627e61d00f3a2c32612e05b3282bfe597f4e18f2901968800cd851b9fee266855582dba9
SSDEEP 12288:7Gsff34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il7:hgSnnrFb4PM4MYgLxEVyGLJ
TLSH
T17555F15AD29801E9C56E6271C3565A84F3237C2197E1E3CB67C0F43E2F3A6849DEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 95769917c907a3f224f0ac691d0b982a664b89c15d7efe090cff41bd06ce4a03
MD5 0b2af7795db92861fb541e6d9a6caff7
SHA1 4d121c2ac094750e24fa2a8e66a017f107abfb16
SHA512 3be7c1c1952ad128a5f0b474e260bc54f0f85425e2359cba204183f9adb7341b8fb70dea92f90ec8fe0957a732e5aaeae760328cd985e7c0ea230d817e3fc411
SSDEEP 6144:J3sBC2naBa1b2bk+Zs0uotMxAbgrPfhigbKe1s4M12bzg5OsFtHK85T3OdK7I2/9:a0D8fsgb8s3g5OsV4dK7J3FObifBF
TLSH
T1543517107666CB4FC6A944325E33C5CCAB707D41EE44AB0372C98B3FD576659BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 49b8cadc1987149d46f1d65d3a8b731b5419bd9e3e0668bc8b74b8fcd54b538e
MD5 bfbe884ec097ecda9941486c9dc72802
SHA1 219b423c896c67175bf0a9bb5262648d605f9488
SHA512 a17353b7cd0b9400cf44d3004c3b5db8f38b1f15959cf94301e3cadd4b21dea6a9260d5593d862beac8479fe38af4c3ce78ceedc87a460da2467c04991231cec
SSDEEP 6144:DHUkT8yaPadjFjeM6OnuTtMxAzTtMxAuTR1heohsAyse:AmOOnlsJp
TLSH
T15A650941A437A38FD1B65032072A9B4CAB64EC17B7495F23B3C9053AD85BB51A0FD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 fb6e53e41f90423e46974cf7d9fc463938a9370cd804e2c37243d4c6c79ee9f4
MD5 e1ef454960612c1a4df7fae506f5ba20
SHA1 f308216a40c6296be177aa54a2e33ef4a4ed6881
SHA512 8c1ef57915dfdc3565a9d85b053165aefdb406092bb6223a1f80ad6b6c8459b299ed551f7e7953e1fcde0e56216acb5dc91a365be3c87ca8e0349d81edbec70c
SSDEEP 12288:Qz7X34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilo:OYSnnrFb4PM4MYgLxEVyGLa
TLSH
T1544523722BDC14EEDE7D16B080A99698B209B831FF61F18BB7407446363B6C89CB1713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1abca357a8194177a5087bd0737c0ca80f850e6ee33e13ed6a9a0a64967c8a26
MD5 aa494e7d017b0340973fc6a3a3f6fb61
SHA1 ee571a788438ab579fa9a9c4d1e700fc0831d66e
SHA512 135f4e868be9dba0921a9d65f0f70afc29752b47e1ef5cc98bf3b7af51f041872da97af9a5925371430d375e6273cfeb219eed672203f1fac6d379ecd100cb6a
SSDEEP 24576:Fgb6bmBIi49WNNFpg1rSvFv7bYSSnnrFb4PM4MYgLxEVyGLF:Fgb4mBIBhGFYj4MYPVyGLF
TLSH
T13065AE1E22EC02F5E0F9D2B8CDAA4417D6B278165731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 b77dd113171c71916ed8473398f61b869cf9df7085f059989fa316732d2b7b55
MD5 38474799a58764498e829e4e6ca78293
SHA1 91d38ee6781003ee7688e49286d42c05bdfbf15d
SHA512 6e23ab3bf4261886a2d01474da4cf175170e408bec630def543e99529e11138bcb3512d29a61972fd8a033ccdd8a126b763e213ddcb58604582effc3bbdcdae9
SSDEEP 24576:ZG88u8FpJqH1Wzria7/mvSnnrFb4PM4MYgLxEVyGL9:M7ZFPqVha7/lj4MYPVyGL9
TLSH
T1AE85016577E401F1D47BD138C98646A3F672B8211360FBDF07A88A522F23AD54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 6802de80e51d4052000f9b968c9b068ee2fdfd2dee441d91e72b8e368c9757c8
MD5 9fa76d04aa385c518fd31704c2cb46e4
SHA1 8b0782b60101ee698dd5b93a80749806a070d65b
SHA512 a791e8a2e29a99520717b075e22a02b0c128b1e206d6c973d1c50c6662cf3eadc9933e83c3973afdfc5167ad93e628161f77cb4cb4e3874060fba535c9877b48
SSDEEP 49152:gBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjMj4MYPVyGLH:bG05lO43bEVz
TLSH
T12CD5CF6A62EC11F9D1BBD17CC9C64A0BEBB23815033556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4a5fceec766890fdd359b094beb49eead6e430739d54b2d6f223e1c82401aec5
MD5 2cc80a8a4b07a9315b2e11f35345767c
SHA1 336ec47a3c42891938a31f0ad9ec459b2bb08b66
SHA512 6e21143749d07c3ba0b987a8e319a01a480b58d46a5332d1151a38ce7f00432d97d0b4831ba257820840cc8aeef595342f2d48e88f7e2955d7933f7093633b77
SSDEEP 24576:/fa5POZ3dpqWVM50JicR2hG0lasx2+47eidnVSnnrFb4PM4MYgLxEVyGL9:Ha5POZ39Jt2pasx2+mUj4MYPVyGL9
TLSH
T17E65AF5EA6FC00D5D5B9D17DC583861AF5B1342253329BCB122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 38593f35f7a3bb2ce59342e1effaf53ac6fb8d9d865e7e1a22dc080c648c0dd1
MD5 61296c3b14335dd163dc1a80c3fd0c4f
SHA1 c9434c69d5c8d5e654edb651e7834ef005f308bf
SHA512 adf2dd8b98f35563588882f84f6c6facd58ba674c3f22d789fce1a1cc6d17618b204026524bfb529955043eb9332a883748d7690612d660ba843b17e4702d787
SSDEEP 24576:TNcwHdjbyQ4nLC18lb/EOjowL7FkXSnnrFb4PM4MYgLxEVyGLE:TNc/zEOVHFFj4MYPVyGLE
TLSH
T12F858B2623E901E4E5BBE1BE89779646FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c326a404c81600a80d7dd4d3e2ad1bb09091c271acc150cd9d1a17ae9e47f7bb
MD5 e4d2a7aab0bc982c4b3f27bc0d697910
SHA1 be3b5dbf226a55c65a7b94e878f1a08e77072b79
SHA512 da9b0b07fd44e18cfc6decb1be17ae398c008583aaf30beef7b4605463f70b90ede9695754695aa273a3b87b3ae42786840dcfd539d6e9118c675f0e2cdbca50
SSDEEP 24576:utkNvNnaFeYhJNtmZBmxSnnrFb4PM4MYgLxEVyGLR:utMwBtOmqj4MYPVyGLR
TLSH
T1AC559E6EBAB806E4D1FEC6B4CD238512E6727461173293CB5290C13F1E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 be89ed2a47fa97b7142e21bfd11bb4a72ef032b7a5a73c0313c0f4c91cf55c92
MD5 919368c5f524fdd33cfb5403ee7b5e73
SHA1 e87ef19e6562ffc8ee0374cc43eab19b2ec543de
SHA512 75296535978ad5f04ff00a9dfaf84f40ef591145cf93c5367c6c1bc6dfa7ad0b60841cdc7f63b0fa07bb1b90faead68633b488a3f8a25255e8d45d0d5e31fc5b
SSDEEP 12288:5HvUrBFrEjwaQA34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il4:5PUr+NQTSnnrFb4PM4MYgLxEVyGLO
TLSH
T15065E12F26EC18E5E67AA178C5868749F771B4625712E2CF02D0817E1F27ED8BC39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 d0d952aacf31a6c299aee56b0c9808a8b74c3c17bc6c032461ac82ef2975f45f
MD5 817a645982d84b7a769b34903dd22bce
SHA1 27570a21b2020cc327a92ea0e53f82d830dbfea7
SHA512 dca8aebc83fdda902a3d1d7d1e76ca1b7c1bd75121151c2d11eb937356e36e8e16ac8c550f0214b753d3a8307399407375aec4a7f72ee1dd29313b2ccaea0260
SSDEEP 24576:hD3FHshBIYQgAUSnnrFb4PM4MYgLxEVyGLZ:hDVHeBIAAHj4MYPVyGLZ
TLSH
T1D775E17EEA9C04E4D57BD1BCC6638A06E77138A9033266CB12D491B61F2BED46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2300-84-0x0000000000A30000-0x0000000000A97000-memory.dmp

Download

memory/2300-78-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2300-79-0x0000000000A30000-0x0000000000A97000-memory.dmp

Download

memory/2300-295-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2404-383-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2404-90-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2404-96-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2404-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2404-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2404-381-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3524-73-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3524-67-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3524-278-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3524-65-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3528-322-0x0000000000400000-0x000000000060D000-memory.dmp

Download

memory/3528-77-0x0000000000400000-0x000000000060D000-memory.dmp

Download

memory/3528-1-0x0000000002310000-0x0000000002377000-memory.dmp

Download

memory/3528-6-0x0000000002310000-0x0000000002377000-memory.dmp

Download

memory/3528-7-0x0000000002310000-0x0000000002377000-memory.dmp

Download

memory/3528-0-0x0000000000400000-0x000000000060D000-memory.dmp

Download

memory/3960-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3960-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3960-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3960-108-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/3960-102-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/3960-314-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/4060-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4060-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4060-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4060-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4060-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4196-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4196-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4196-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4196-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4332-39-0x0000000002380000-0x00000000023E0000-memory.dmp

Download

memory/4332-61-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4332-62-0x0000000002380000-0x00000000023E0000-memory.dmp

Download

memory/4332-45-0x0000000002380000-0x00000000023E0000-memory.dmp

Download

memory/4332-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4532-121-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4532-312-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4532-114-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4532-115-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4976-239-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4976-49-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4976-51-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4976-59-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5008-21-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/5008-13-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/5008-20-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/5008-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5008-88-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6044-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6044-138-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/6044-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6044-127-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/6044-133-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download