56b62916cca8efd3edf35d89e8105c2cda92bc3ec39ac94192fad84a38a284ba

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/05/2026, 16:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
Size 1.6MB
Sample260527-t2s19aex2w
SHA256 56b62916cca8efd3edf35d89e8105c2cda92bc3ec39ac94192fad84a38a284ba
MD5 11049dba99ea501d8bef02fbc2530d1d
SHA1 76117c9daff3c4008a80eddca1a685d592b0a315
SHA512 a947043b5b79595165be41e18dc1b0ad093a6c498e463bdeb9756f7b6a2129bb99fefdc2294de217050d63e7284de15de8be4925c4759de38abe817bebbdecbf
SSDEEP 24576:8T+exE4+M5PXWJLnQ/tbw/2Mkjy6Fr7g0o:81EBqPXWJLQ/lFTjN4
TLSH
T1F385C02335C0D121F9624533A9328A99D5397DB88F6095CBA38C3D9E6C793C16B35B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1344	alg.exe
2548	DiagnosticsHub.StandardCollector.Service.exe
2160	fxssvc.exe
1216	elevation_service.exe
4492	elevation_service.exe
3912	maintenanceservice.exe
1336	msdtc.exe
4384	OSE.EXE
1272	PerceptionSimulationService.exe
4208	perfhost.exe
2840	locator.exe
1496	SensorDataService.exe
3952	snmptrap.exe
3468	spectrum.exe
4812	ssh-agent.exe
3336	TieringEngineService.exe
4956	AgentService.exe
2888	vds.exe
2724	vssvc.exe
2812	wbengine.exe
3972	WmiApSrv.exe
3128	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2a022699e7fc2e30.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_161703\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000606e7f9ff6eddc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001487bca0f6eddc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f043b69ff6eddc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000318f02a0f6eddc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005196679ff6eddc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
2548	DiagnosticsHub.StandardCollector.Service.exe
2548	DiagnosticsHub.StandardCollector.Service.exe
2548	DiagnosticsHub.StandardCollector.Service.exe
2548	DiagnosticsHub.StandardCollector.Service.exe
2548	DiagnosticsHub.StandardCollector.Service.exe
2548	DiagnosticsHub.StandardCollector.Service.exe
2548	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeAuditPrivilege	2160	fxssvc.exe
Token: SeRestorePrivilege	3336	TieringEngineService.exe
Token: SeManageVolumePrivilege	3336	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4956	AgentService.exe
Token: SeBackupPrivilege	2724	vssvc.exe
Token: SeRestorePrivilege	2724	vssvc.exe
Token: SeAuditPrivilege	2724	vssvc.exe
Token: SeBackupPrivilege	2812	wbengine.exe
Token: SeRestorePrivilege	2812	wbengine.exe
Token: SeSecurityPrivilege	2812	wbengine.exe
Token: 33	3128	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3128	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3128	SearchIndexer.exe
Token: SeDebugPrivilege	756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	2548	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
756	2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3128 wrote to memory of 4024	3128	SearchIndexer.exe	105
PID 3128 wrote to memory of 4468	3128	SearchIndexer.exe	106
PID 3128 wrote to memory of 2416	3128	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-27_11049dba99ea501d8bef02fbc2530d1d_amadey_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:756

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1344

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2548

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4440

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2160

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1216

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4492

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3912

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1336

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4384

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1272

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4208

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2840

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1496

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3952

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3468

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4812

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2032

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4956

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2888

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2724

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2812

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3972

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4024
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2824 2684 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4468
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2860 2836 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7a3785b6660b1c2fbf280d260a2b9998e10c810a0f746f610304083fccc19f80
MD5 d699719817929cf668c4fef415cc29db
SHA1 7bdd38ec69c4e06e135b2c1f1a9b7fb64df32db7
SHA512 d4b700ecf4a09570dba7c3c449920b7bcf471409ba9a332ae57b3780ab0c0f408ca3b7003f3055cd23cc6a0b242fa73ea50670e47cde07eec7eb352447b6b8d5
SSDEEP 49152:rb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnoQ/lFTjN4:53q6HjB4Lm
TLSH
T141D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 39d20fb940ce6354f6bb51880b8337f9ec71e16ae04d2de3d469e35776bf2be7
MD5 6554a9c070a0abab25196cbd673d63e9
SHA1 76a4484cdea77902445cc41b45ff1f87ba7db447
SHA512 d7f37dda7fea7072345d67934cfe9065bcd4dfaaba786ad390a17dd1dbf0a39f1bc699965c13c38aa9c5b14b2999b68823a13204a25ee7a8fad0e9d817b8e3b0
SSDEEP 12288:B1XLsswWkxy2lRq2czAHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:vXYfDtczAnnQ/tbw/2Mkjy6Fr7g0o
TLSH
T18C65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 924055ecb6ab3aedc5c63698c5efcdea618283a3272631ba84b8cdc408dc1711
MD5 3d90deb09b1e82fc163fd66951778d4c
SHA1 c9e33d94e4bdde9f410b3cfacd7d96cc8fb05553
SHA512 e34aa13f42f07fbe280d897af8f340aa5d47ba4a7eb84a2bfb9aba927ac1c80995af7145d08dfba9b4be17b9b4db2fd869173b6dbce56a7666a28acd88f2dd2d
SSDEEP 24576:50Le5ji0hmxLrMgnQ/tbw/2Mkjy6Fr7g0o:5Pji0AltQ/lFTjN4
TLSH
T12C859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f2a36333db89b89052cefc8d52094fb8b307ff594a5fe3077189c041a40f7194
MD5 7364b2f531448e351685a101ca051bdd
SHA1 45affb2bb9cecb28b182723029cfb7b87efa1f01
SHA512 e8ada7f5f353906925d22057695095251ac240c44721e6eabd89c7e9be60855edb15adb6a4f509871cbe1a71912e14dc2d9fde56b3a71ecbf40a2db4e2d8eb50
SSDEEP 24576:Ha7/ezSC6vUyD/aqgrvWE6q8wyuCnQ/tbw/2Mkjy6Fr7g0o:K/ezSC6vUzPvxHjyRQ/lFTjN4
TLSH
T15D755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b5d6d62b679819fecf0fb2ced7da8efc6fd8955358056d74f5410c38ec69d0ce
MD5 7c028d3181a091751588ee3b375dcdf0
SHA1 63bc54615e125b92d97f9f1ecf074001f2ad098f
SHA512 a14c05b00e9ad5cf030b1d6073459736a437c6d77f33b7b76c87b399eaf21fb5b55fd6336041fa556ebe0cfb32869be6d2fc859dcc0b6247e56f616c2fbb6033
SSDEEP 24576:3VbqPb88hv/l+6jnQ/tbw/2Mkjy6Fr7g0o:3VO88hXl+0Q/lFTjN4
TLSH
T137559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 87f4bdda6f7b29279fce96c9f7221a7dd3af6882856c66280b4be809709fb8c4
MD5 fa55b89e7e49bbe7367d22e04cef1743
SHA1 187afe9a9e4493520088dcf14b73d9256cac9532
SHA512 d5bd862aace191208d6e172be2b1c48930523c28a7ea3c214ab348506559585b5ba1f4c1dac3f6209581791be1490801b6c48e574d000b31a9672ac4e9218295
SSDEEP 12288:3z8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:3z8nQ/tbw/2Mkjy6Fr7g0o
TLSH
T18F5523696624F887FF2B06F15CC38582AB7B0DC1AFD4AB4E6B44322D853C39456DB781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 7f98355903c0fd5d3880eba29a744fc7401c91e560d3b332bf02895b30287bfb
MD5 5f0a56b887d587defb7699b0e323bf29
SHA1 1346ef12e9b4836d983c7220010d7d5aa5ba7c19
SHA512 b576e17c0512f86614691b3f931c39df6f7e1f60a60de54b10acfdee975ee559580c90dc5d3d03c0f7b4a190ea73a8f240a6afd7b9da83ea52494ef9c4715dde
SSDEEP 12288:1eBNUbTVO86ULGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:1JIU7nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1B775CF3BAE28FCD2C27E4DB85A918640E77278704F51A3CBD164830EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8e65e28fa4ca7d7e02b0399f2a1c9c74ca3595243ebde2957a2f27f5da367420
MD5 9a86aca61b225d346bda0b3d56580dbb
SHA1 1b363ad6674e8728197877693b53ef54c5e0a641
SHA512 46b8459cbffaf5531313adfaf71b880c77eaac970e9757764ed3c45a8bc99dc6094d45b47baf6cbb9006bb9e285ce6480f17c1772f11dcc6fadfc9a220f0bc17
SSDEEP 49152:hQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH7:hQvGAdlCEL8c/yRNw5CdLm
TLSH
T1C9267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 43c6b41618da5ed73e1f80ff92075f7d425702c92108e62e6f27266be84ec9e0
MD5 24b05b2ee13c389b03bad5ea9469c8d4
SHA1 7cc730c095360aece2a3353325c108c03c53d41d
SHA512 b4291e4004e1567ef7dfb6b499f909d3fa93107cb4b2a9faec39849f3b15a86ba10da37caeac00ed68eab7b184f487fe2ee9677112a86957d1aec6d41c2335eb
SSDEEP 12288:jAwSfxL/2Dc39DLLmt0LDQewsAjdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgR:cQewsAj9nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1CD75E031FE74E436C77F0DB21B26C706683D69604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ea3697c5d9e556ab4fce973cd027a6c74b2d9546567a310e6449733079328b02
MD5 cd04a35d6d60d844a275f5021fc03ec6
SHA1 a6ee2f140b6cfd0d2244ffaaa562419be6d93db1
SHA512 65dadddb2d099615467edc010e05da07b60d774e60ad3955d11ab0b9ee53388bc83fade19981d664d3ed5d1049e454338b71d352ea712a23628b6fcd6019170a
SSDEEP 196608:VUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHqL:VUEtQevvqc2W1cpV2EI32
TLSH
T1A7474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 62d5ed8daaa27ca828e531e141f9c016315ee3dea36c31c6484f1b52a5ba4b27
MD5 0b01645ce3b6cb550684800fd12aafd1
SHA1 c0d301c562a0ba030979988dcd4cf898732faca3
SHA512 e72bf53ebdecb61164356aae15fa68e05f3f8dedc797a437fee2f769bcefefeed336be95f9d0072816e40dc0e1317df731b8cd7163a458036ffb0533f17dab4a
SSDEEP 49152:CCbRquA/m2yL5zQfFiV+XenmE3/zdQ/lFTjN4:HoqtVjnmRLm
TLSH
T196D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c34da55a384382eb74146a55f66ed0cd0947a35021d0afaa05964a6a239e5e9e
MD5 ce8df74dfd4e8da37def4bf55cf93ed6
SHA1 477bacc80c4c21521a9d494c11bd5bb02bac0f02
SHA512 11b9afb718ca2c9ea0b7cdcd86ed954a3d3b0a01e8c4663eab5a24c4bbd1255e62ef93f50d50379e671bdbfddf05f883783b755114458cc806aed936b99f938a
SSDEEP 24576:fAhGLJIFoiwtA5l7S53mnQ/tbw/2Mkjy6Fr7g0o:fAMyFoiq5WQ/lFTjN4
TLSH
T1D135AD80E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E37A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 71e7ce819591fbd0d831ca86fc4d63ef5a1c3fb2a3c4c77d81acbad8209be5be
MD5 b42b0386c87010beb41e3ef59ef771e4
SHA1 8af30610f8a1eed17c28f55f9f071f6bcffe63b7
SHA512 90e07df2cb5353ca00f31552705f34560eda7a492de760119a8e77872a7c7eefff2b189a9f308f424979313d1c979520f006e4101b65f46efa18527998987372
SSDEEP 12288:Cmw5HEjsChN2BFgl0WDm+CiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:bwuHOWxnQ/tbw/2Mkjy6Fr7g0o
TLSH
T18A65F14A36A41CF9EA6742398993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 225ed187188dde5a5598324f6b1c71839dff89609cac388c9897b162fddb5d56
MD5 07336dd4c59c5bbad9af063719386ccf
SHA1 716d534e45bb9b9ce262d9575d56faad220f9074
SHA512 987347f3323f13d8d621c3e2b3f10e543d903f73627e231a1c87482699abf35d8154b2e21cd8e898e3c7773ac30a6656b308434b048ebbb5b897e8520a152318
SSDEEP 12288:hXZ1IytGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:pZu4nQ/tbw/2Mkjy6Fr7g0o
TLSH
T16655126933A470FAE66742B8CCE28646E773388267B193CF275402695F3B7C11E7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b7733133882183a3fb8e1d005bc4b5cc9060fcab8c850cae88a97a1260906598
MD5 9fa504ecc5c26051a038fbf31fb56da0
SHA1 0ce6bcbb94a9510fd8829b08904523865ae2a428
SHA512 3fefc53e88120fea571f6c607bf910e1cacf2a1a6d1c75a22116b6198ec0d4df0ab9600f47839a216b3ca1740879f45349b910223e3a757e98e4508293e3d273
SSDEEP 49152:8j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uv:TQRQyi36YOcPQLvw2gAf+PN3ULm
TLSH
T194667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 1de1b01f2c1e05c6422c3b230ba02bf04bd62d018714c134c64c9e581c6c45c8
MD5 6971ddac2ac06d134a7cbe8b1ab645c7
SHA1 94199416b4f0e3abbc823ce21f45738f4b2364f3
SHA512 56f88d8ad141d69484d9e041f4107e90fab36eb9312d5083d9da3a29b1422a9be15108c4a7ad3df97cbd105101f1b28d3471b4484ef392da80f8488fb12e733e
SSDEEP 49152:Pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uv:+QRQyi36YOcPQLvw2gAf+PN3ULm
TLSH
T103667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 bc297f3386f0a3f4dcadc015ce41389e1c44f553de79c8fd1ff7ceb1d088a73e
MD5 532dcaf7155369f52121ed37ba8dadc6
SHA1 cf029ecff49636f30f35f51f9941761a88243dab
SHA512 5306c3187377c4c51fde7471da30ad800f744e8b71007033246ea14ebd87179c38f82318ae857397fedb422183d3bb4a919d6067799ed73103ba7052f4874bb1
SSDEEP 24576:fwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0onQ/tbw/2Mkjy6C:H68Qg55nhheWu7PNU3/tQ/lFTjN4
TLSH
T1A0B55A33B2F60099C44DE1769F46872196E27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 32b97a40ce240ba674453fa351972dfa348c93671f15dcf145f2f8dab130d72d
MD5 b2d1d7c5338e51c679f46c5ebe5a2cd5
SHA1 da3365dc1ff5997931f82aeecb7bedf3d67aa4dc
SHA512 08c058d1404a6411d129f5f16e063c8942bc6ffaf3a8b5f9ae1a2a42eda0924e35ed5235dd30b6444cc895168a7f074911fc4fe748265a53ef5d9634ff6d14b2
SSDEEP 49152:z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99N:my5112gYy5azzVvL69nLKnhZfLm
TLSH
T143167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 af4615d12c36fc0e543c06138b9b3f6675286bbabe31c1ef357919cbaa86e233
MD5 ef5e1b29867fc6c4e89fb48dec7a5a1d
SHA1 9c213ab47cca49f532717786ce5212ad0819bbc1
SHA512 32778bdd0decee317d4fc29ab933dbc88f627c0450f5cc508602e42dfd7a567918fd07080084406378445747c80f35cbbf94effa451a60a5dd22e4a0096c6a59
SSDEEP 49152:yB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glXQ/lFTjN4:Au6JmVxd2d8Lm
TLSH
T196D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c346e3fb13d00da88f3e23606fe580f362d92d2aa4385224ee3a54a903ad7255
MD5 ee50c761380cd0fa5a25870808c0fda0
SHA1 589b728e2a1c654d93e9fbb7a5d68336ddb44305
SHA512 536768f3bded039148d424594f28afe14cdd4433ceeb5546bc35dac0964238fecc313c01d136d363818c1c6d3e7dd2429a0986749d5d29605ffdd2300ce3baf1
SSDEEP 49152:J1hpsNoJpF1A6UU44CwH7R4xbQ/lFTjN4:JmifPbRRLm
TLSH
T1E4B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 08cf8c7f95ad06f65005d58aa03fef85703a1685ae583f3831015ef836047840
MD5 2ce5b048d16bc1597f20acb31d3eb634
SHA1 4de6ddec5d49edec94d9f3377f67a6e6185ef59f
SHA512 c17afa697e3edc43e7bfcfa6913312709b24f9c2c6b48a8821d07ed7799e05adc98d2e17944478624185c126e26a207a8735191862463c7d5a475d9b80505a02
SSDEEP 49152:FSuZQIY0Be2KRRVtOnks6NMHq4Q/lFTjN4:L5dKTi61bLm
TLSH
T19FC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d62aa13808043d4d2e6c8a12f40d8c42faa0a152bae013edff5a1a2cf8d89288
MD5 8ae97d06372843ab70b931978bb56d37
SHA1 e2430d46129396f7f34d288d25e6d9677b782845
SHA512 8fcdce9d820ae583587505c1c96838049e40e5ceaceffdca7f220978e87d354868f089b9c7652d8357c0be73120c46173b30bc6b3571cdb5443a649b3ec27f10
SSDEEP 49152:OhtSn8EApI0figngiDn0AP5wnQ/lFTjN4:PX2iyphVLm
TLSH
T16895BE13F2D900E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 2edb0187210620ea2f14177a42af90642f75d8d3ead1d2cea830a6cefbc72504
MD5 4f3c2a5dcc729d39eed1aee2567bfe78
SHA1 e89e7d1a45642bb3d110053dada66be08ded5071
SHA512 6c03bd5ee052caaa67c130cb67bd8cb1116b3cc00ab5b3c1b0ab7d65cc5c7df156fb1aaaf0b8c11fb9355da7c3ab28488cd5e497ee3fea7a762d1f030eaa0bb7
SSDEEP 12288:xUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:x0nQ/tbw/2Mkjy6Fr7g0o
TLSH
T17D5523686965F98BFB1706F188838182A77F0DC6BFD1A38E77482129D67D39006CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 e82cfbc7e5b7aca4c19c97c48bd982f26a239d6a9383e0b58967241726706b4a
MD5 6c6fd1b174bf015cb779e4b0d9e3e11b
SHA1 3c44d1a4301c2c7d58233001f14c1673f91cb4e8
SHA512 78ae510ca4cbd387d4059d5ed809772e5a00b107d2a0ceccb258d04ba00c7c90413a9c44dbfa240413064920c20814e3bede7e00550167afdda6036c9b895003
SSDEEP 12288:npGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:n5nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1885523687965F98BFB1706F188838182A77B0DC6BFD1A38E77482129D67D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 7700201306dc7737698243bf2abab3ff6b208e2e8dba3feb777270b6e91c80bf
MD5 96aa07266e24d648f9f4115d2e73cbcd
SHA1 17abef9daab1840576db4fda02dcc3e82b850439
SHA512 4b1d85d2ae72187dc26866e249c2c8ccda29748ecee61d4d85f49ef13da2daa9daf882d5be42148f7399ec41db2f997410079cd58f3b823a1e3ac052870ccd86
SSDEEP 12288:SjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:STnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1955523687565F98BFA1706F188838182AB7B0DC6BFD1A38E7B481129D67D39406CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 12e49cf0df1b8eeb179aeee0872fae4ea4adbf292428a47857f1583655da460f
MD5 61fbe2656f3905f627ece1d8487184d2
SHA1 7740e4c7d6b0e61b4da4ac603aa4fe46837ba499
SHA512 568e65f1985697accd7a19a9ce44a0663012b3619bb124722f3b56ca3b1b911bf42d67320e54e7c8c75767eebf4765455ebac4cf58dc5f2f10b7b48c762b4766
SSDEEP 12288:JVmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:6nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1C75523693669B4C7F92742F4CC938142F7BB3CC5BBA1A3DF6B0411194E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 9f362fd97f67c856373b51416de667946bb962869cad8825571cc32d54334b4d
MD5 9ba55a250d8b45739d23a1e6141fb668
SHA1 b4a5975a29887e98f3fb309474ba15069de9441b
SHA512 6493c9506c57789f70088489273b0be92e56f15aa761cc7fe89d6df3302e250dcb70b823173ad3ae14a79a4b1629298df0015ab70ba1474e40532272548f505b
SSDEEP 12288:5OGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:5OnQ/tbw/2Mkjy6Fr7g0o
TLSH
T15B5523687965F98BFA1706F188838182AB7F0DC6BFD1A38E77481129967D39406CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 3696ddbf35aafec399e05a90cabf58b0cb5fa2841eb23701ced961375f9db94f
MD5 667e06b6c5737b43694200842f2e2f3f
SHA1 ffc2bf2b68393060b1200ab93ff58f43b23fb357
SHA512 7dee74c62d06ce4443029a81c24bd758b21a1aede74048fd5d157248b20f93726b6e831330d47c0fe3c64b5b8c4d6fa9de75c24beb6140dba8f3c70a616d7744
SSDEEP 12288:51GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:5VnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1135523687965F98BFA1706F18C838182A77B0DC6BFD1A38E7B481129D67D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 ec062e53c18dc0ba8df7c47589bd4b1e5af01f1b30eeeb32f225a4a8dca8bb84
MD5 1fa222cfe85699c051837f933fac9f77
SHA1 8fc2651e7152c697aab84ec7009521a7e51879a2
SHA512 b968936438767163bf01963c964dde43d76d39993a7cca289ae764cc68c937be4126d362e8ad97c279a2d1a37ab69526f9a34067040780697e2d52d5db899914
SSDEEP 12288:RRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:RhnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1465523686965F98BFB1706F18C828182A77F0DC6BFD1A38E7B481129D67D39016CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 744e73d1ec9279b0ab037d5ea12f439086c235193657c020b2ff9a2b70b44c1e
MD5 ab331e2cb157a045d4dcc9b5305a8226
SHA1 36a9e628e249f2fa57a6fa420c758f9050106e49
SHA512 72b3f1497be062dc763782362f879c0e7089f78918c35df7756caa67b4a49fb380ef4221db00b927fb8b489540280f57157a98ba2482333ad513761c8c61b83a
SSDEEP 12288:yiZwbDzzFEoS2cPvyJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:VZM3zFVSOZnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1D77501A8B3505CF9ED67427ECC528906D6B27C5A1BA0C71F13A4322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 e88cb58a2c5ec1f2f4bb744837690ab47ec93598e59dda3d8a4c842136f573ec
MD5 3de36ff3e5677773e7c0cf761bfeec1f
SHA1 600de2b6cc6aff4a0dc0159ee0d8a16696643275
SHA512 306b3cdcb77678d08009d9f867699798b4a68cc99ac257b1729bce0c3412924f18e19ac3c377a5ccb83bbf8e98d45a0009c35f94216a4845f375dd46d5922bd5
SSDEEP 12288:+IGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:+InQ/tbw/2Mkjy6Fr7g0o
TLSH
T1425523687565F98BFA1706F588838182AB7F0DC6BFD1A38E7B481129963D39406CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 2bded1e57f14a5d24f3c5d4de74c6db83cd5c688959a388cf4b0ff71ac6befcf
MD5 b9817fb24f1529bbc4310d3a310a856b
SHA1 cdf50129647b83c500a4f1abb2bd8d90c1763447
SHA512 97028df7aa5b3cc71aee56035a403b7d803a60f25118862f721549ebb76b1681809493635e0ce21092ceb2b7c6a992e8d892fe32ba4aeb893df9dba619f07459
SSDEEP 12288:fMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:fMnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1955523687565F98BFB1706F188828182AB7E0DC6BFD1A38E7B481129967C39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 4458dd867dd911f0e7f02fc2a4de13bb3f5243cffb8c24e768d5e86f90d4d091
MD5 95ea1e117761a7bf1e695f448ffa3904
SHA1 71317a308da68ede4732bb2e5ad71e3f80556009
SHA512 71b300c67a313273ce533a91a7bc991a7d90d97922898a5e3823e13a35c80a438f8289905c81c0696aae3d7ca24567ddf7ffbc29ae1ab0b8312dda37bab32d37
SSDEEP 12288:/yPz5L8tGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:yzyNnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1D965021772A530FAE537427888920A02F77678725B609B9F2794037A5F3B3D05E7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 97da63431064361045bbf4a954b85e63850e87a8af7dc81c506367c1af583930
MD5 453997e11e9b9011e571798a2a603ed7
SHA1 109015abd459cb88918552d39d89712c68a0bea1
SHA512 61ee08a428fff5b8f2fdacdef5f08e451b287640bc93737aa33682ba08365ebafb8f09693941784a79ec26fd3df9ab1a8b02b5d7a459b7f31605cd77c606f5b7
SSDEEP 12288:6IGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:6InQ/tbw/2Mkjy6Fr7g0o
TLSH
T19A5523687565F98BFA1706F588838182AB7F0DC6BFD1A38E7B481128967D39406CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 06b94effd6dd161f2228420423b6cc1d11bcb54bd46c98ebfac41b1f1abd4af3
MD5 dfb5afbc0d195864781422e9eb4f2376
SHA1 9db159e099fbd9e3ec056008b56b06153e3c8691
SHA512 578416492463a8135457ca6c4a373dc0921edf7477e712888790bcdab2b782becf1a5cca98f10d7a98f665033d04aa8a69f7bbe2be1e4c47e952c36e174180cc
SSDEEP 12288:3IGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:3InQ/tbw/2Mkjy6Fr7g0o
TLSH
T1F75523687565F98BFA1706F588838182AB7F0DC6BFD1A38E7B481128967D39406CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 9e4ce6ec1b378d1be97eb54810bf14070920d692c7a95428954faf1d41da2bab
MD5 1f2a8af9e7134a3d990ce41eb7ef2b75
SHA1 3436a2b05b8de69b3b78f21ff59d8285ca575989
SHA512 00077c2b5af236c28a84acf227637dfb51622baf9cd576646d29e01816affc366a31f2540e247423070b9bf33f19fabc1869d61482e922d8118ffa4f6d538d6d
SSDEEP 24576:VCUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAPnQ/tbw/2Mkjy6Fr7g0o:VCUxPTY+8Wg2lIL8lrIUJLWwOQ/lFTjG
TLSH
T1E265AE1DA3EC0896D4BB817589518A06FB72382E1B22D6CF2160C33D6F27BD55E79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 6309fb3f8fa64884dcbd6e26d0cffad77c2a6167ac9174c30733cf54146cb66d
MD5 cd8574b7d4315f65eb74311f6316cd50
SHA1 5ee39e592023b17c45c91b6a6bff4f7ad99f248f
SHA512 1ecdb6d9cb81aa90103df10f375bde6880b79ea99ae8ebdae6ea1fda649dec4d3a63b49df61a0222aee7b79d3152c85f0193fa567a99520dd740223635ce903f
SSDEEP 12288:lssf4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:F4nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1B665F119E29852D9D12E52B5CB828641B3373C9597E1D3CB67C0F13E1F3A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 3235831101e15c3e22725ed1521330b57714dd08747e18e13419d1eddce7426a
MD5 7fa7a0ac8b303ddbac292d894efced72
SHA1 032c9e0fe670cc9de40819f6ce0c912f94926822
SHA512 bc818ca7a96162b5386e94265b9f990fd4025aee672b30d47de2685a95e32a95f019463e05b654d2d36cafed674432cc3e9a5e3a8f0b46d6efa164baf05ab156
SSDEEP 12288:IDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:IznQ/tbw/2Mkjy6Fr7g0o
TLSH
T1E15523696668F94BFA3B06F048938111773F09C5AF91E7CFBB042269953C3D01EBA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 6496e72b4195a69d20f371e356712c8f7bda6e85fc6462d3cabb06bde14f6b87
MD5 00807cefbc651b41b0148c13067e4f71
SHA1 5f90474829f05bcba5998bc44fe35cfa5fe96746
SHA512 d02817c86ba0cc20a9eea463bd37301efaf3ceda35814731a0548232be8944cda77cccc72161c5dc0560a3c7797d246333d31d19379cda68bf502753e41b8366
SSDEEP 24576:d8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCdnQ/tbw/2Mkjy6Fr7g0o:iRZwQCyiHiQEaaPnMAQ/lFTjN4
TLSH
T1C785B01E62DC46A5E0BAD2B8CDA74407E6B23816573197CF1290C27D1F37EE45E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 9bba9aca59d1c750833bfc0d6a43a6a329e8b87ab8c63de1d80184129b958fc2
MD5 ab9197c6be33072a3f334abe2c0f6f94
SHA1 c8b53fa183329c140a9bc0165e1905e9c13810c5
SHA512 8a34fcc8343f47e4a72e8d2826f01c85deceb3002285674820e022f0d732139492e2376ca0d2c60d0da04f96b8e3b71319e14c7bd298d7c804ad6a6c7c8403a3
SSDEEP 12288:9bxA1U7KTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:9bxA1UGDnQ/tbw/2Mkjy6Fr7g0o
TLSH
T15955123E26AC24E6F536917988C28106D3327C56676193DF26C4823E4F3BBE45D7AF81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 d3e649189b45cac1a03e121fd056d89c4884810b46f4cd44aa18e1b89b1435db
MD5 72b03e30730479196e92a747453e5919
SHA1 6740bd21ea7788fbfb55d7dbfb185a9558829bf4
SHA512 0b3f19a542ef1f66abee19c7eb590c4bdfb4abb9401ba9f505b5192d68bb0f3b00ccce0af48d0c27c6403d20b19ac9b7d422e63397662c43328a9e70e777a2ad
SSDEEP 24576:hjsmP0yHaqrVqHra44KDzMsrnWnQ/tbw/2Mkjy6Fr7g0o:hjRP0yHfVqzlAsrnWQ/lFTjN4
TLSH
T16D45AF2EF2B910B9D8AAD176454107B5BB71782D1F209BCB0170C234AF1AEE85F39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 95a03e37f299a6049a2412481787bbc6ea1647812da2f42e16da55b7adf1cff4
MD5 5d1e29b8abeeaeaf48efceffbb7cc62e
SHA1 bc217517f297d03eb40b5bd0e4b10a44bd00058e
SHA512 a4a55eca6b07e4e6f1c3f3095b3b80bce16d8bb1e727a16e0f0d4f241a255ec03d82667ce2b437754242f48db5ed5ad9109fde0c3571c62ccac9b88a2e078451
SSDEEP 12288:zVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:z1nQ/tbw/2Mkjy6Fr7g0o
TLSH
T15655236C6559F98BFA2706F548838142773A0EC17F91A3CF7B482229967D3D41AFB780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 3507162bbd576a8dad8e25c6182461490737a840df357fe2e1672998f46deadf
MD5 936c5d3e27adc1b0f898ff70ba5381c3
SHA1 e6d8dc7f388e8d516ed1ad5e4751f7ba1ea2f127
SHA512 58d222be268c89d98d54f7c78b58a3e1bbd3b33e5196aa612e9db5e9ba5fc5c0349db585877493573a0a43519236e6fe851041f7aeef4b58cd925ab73371e9ee
SSDEEP 12288:9Ob4A4LWO+vAYFTHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:awLBUTnnQ/tbw/2Mkjy6Fr7g0o
TLSH
T17275F155F7A450F9E92B817CC8A28616E372789D1764E7DF03A84A691F333E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 5554b1267eb7a84579dde4a8a1741ce7484158e3ba5a89f30c42efd9f8557001
MD5 fa98ca8a980eba5399f4ecd9f431906b
SHA1 0b518639da68ba4a2def285c2920fd7056ee4c66
SHA512 cf538d3c9fb810adbd3526b3c5313caea16ec3969b8f84f9fa28f8a690286ae2a428085cc8891d5df12fdd501f2cbe1c2a22a29c87093746bb283ce67ac6d177
SSDEEP 12288:t70VmuIYNvUyBpEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:KKYNHqnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1EE65F12E62AD1CE5E53B91798AC38209F2737896175193CF05A0827E1F27BE87D3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 fa70f5b96651228544afc561ce3377949be05e473fa52c96055831e48ffc5bec
MD5 dbcf6678db6fdf368cfd75fcba3f6d06
SHA1 995d7615d0361691e2ae6683271db69cbdd0b572
SHA512 c7d46782e435a1cf02c41c881d67c2b7256a3095e0cac6635cd0036d636f7c06caec48c3b234b54c3991aa0f5354d5c443203a235f2184fc119cef8e78d7d3f5
SSDEEP 24576:pnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKJ:pnXoJJYH84VVS6AmEcJas+cHBjSSKHPZ
TLSH
T19B65BF6DA2BC04E9D5BBD17DC5C24506F5B278621331C6CF026082BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 8e317b18a939283b600d0fe0c096f6c27a5e2df76d03d3a3f444eea489e9f00d
MD5 437b2f8fe9af3115ae7fbc9b3436916c
SHA1 0b5f88ea823650b7a2992ea407fc7f512c9b5ada
SHA512 b477b9e7d729da54dbff7c62e69b4f41afaabe064c3acb209e4328c28119e92c1555a713e50d1670681309355c3c26be8e5c757056e2d3c3d3de5c849665371f
SSDEEP 24576:Rv7Xbxd9Tuycf8M/TYlSuxwr2PCcnQ/tbw/2Mkjy6Fr7g0o:RDLL9TuJ0M/TYW2PVQ/lFTjN4
TLSH
T101858D5EA2EC52D8E47BD6BD85A39047FAB2B895273081CF1250856E1F23BF05D3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 f342ddf08a1e5adc23cb954b6669b1e9567f211682766000468c6b5f5f54a2e1
MD5 7c078fce250bf8428d3528028a495d56
SHA1 c6acea61c2744a1ba009001c6ae3c341f93dd3a6
SHA512 78afe3545158653efe75b0c576b2c012a25423a632ea3eb3626d3f3c44ca486067b5b3c8bfc066f4f7ab6f9417d5f19e16ed72e5caae7725ffddb04c14612d2d
SSDEEP 24576:9egJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wnnQ/tbw/2Mkjy6Fr7g0o:9ngOJOmPOHhnQ/lFTjN4
TLSH
T18A55BF3FA7BC15D5E03EC17D8A938916F6B1786613255ACF0550827E5F2BEE42E3AB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 ee36cda10fa4c61ce3b27d69b4a438ee46fd09209637a67e08b8c6da3e3b9a42
MD5 107d7a14238c5c2ff4891c442fd404ac
SHA1 ec91edaf683cfa38b0aa45ca299f9e852b8853ed
SHA512 93bc27916f4d99284992fffbab50ff7279824ad679d430f3be6125fd01e6d267a3ec82148f10160e97bacdc5ad9dd35f9e20d2a4bbd2bb607fc8e9166ec2c3a5
SSDEEP 24576:FLJnJiTk3R3waE4JrOVnQ/tbw/2Mkjy6Fr7g0o:FLJnJK8R304lGQ/lFTjN4
TLSH
T16675D03CD2A810E9E477C2B481561756FF32346D2B216ACB29B4D5353F22FD0AA79F48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 cb46fd31a2d1ba390d380d084f01c54597a84397d560dbf0242d934f7669ff40
MD5 14c1e32ca8e95d9875f250e055e52e2d
SHA1 f4d687ed775c920a3463c8d82e6acd48a4152560
SHA512 ab71c5d2fa284c6e587b981a63385b8058b0d110c783d9f14ad4b77ff6245433bd8a6c04b7a4a07b3ec33797ab63865a015848bd5f6db41945caa23c04b0a6b7
SSDEEP 24576:rA9GqCceDQncA/BmlvLto8cFVr9og9P/Z6pfnQ/tbw/2Mkjy6Fr7g0o:09GqCzDScAZmlvTcFg8Ph6hQ/lFTjN4
TLSH
T1AC955C15F7EB5298E8B3CAF1C96294159B327C409B34F7DF0A80CA6A1E32BD1D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 d3f74530be770ba1b2fc6d0cefb0f27f4928fda5a2482507f18a31f75fc9e58b
MD5 b9cee26f7aeb424cf346a07034148aa4
SHA1 f08bbc6b6c385ca7ada549797457e67bcf815082
SHA512 439c03d5fa7ae2a00b905e96712c448a624af27c5af69e38dafae3bcbc81b8234808b8bbbbe395ba4f8b42799a33ed41f55285f42f7ee89a696fd0206fa96091
SSDEEP 24576:HlYJeXm5jUuE3nQ/tbw/2Mkjy6Fr7g0o:HlYJeXmRUuE3Q/lFTjN4
TLSH
T17555126D366C70E6E22F41B988928545E372B4A1275163EF62D0C27D8F7A7E41E3DF80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 54ddcf21ba72191415afbdf668ca8139f4e8d1224db9f1d5fa71f3bb9039457e
MD5 98d490edf72d3798b6a8230f6a11cb04
SHA1 ed290d345e366163cd4fb8dc3a02717f140c9e6d
SHA512 1bc2212fbc8973acd1264e89edddabc056557341a56307ba8225a36ada8b0a6afc6af7103e6eb00a5b2929e665f6fd567207f579f9e693612c70ddc4b68540e1
SSDEEP 12288:0Fu6kyWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:0Uty2nQ/tbw/2Mkjy6Fr7g0o
TLSH
T18D6512182394B499FA7A0678CDA38191AF3A7C50AF5093DF66C0E33E5F3A3D06975B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 f68921deb2f73d6f63aec9e258fc34f09c46ec08dd002f58ee70f113d25dad0f
MD5 b6938ce03fb5553e6fce24b3b14e60d8
SHA1 005d4cc28cd617b2b901aed41df45918900b63e7
SHA512 931e74459c04567ac5100224d53a76868017dea40c119740e0a26e8595c771a821d9c55b19320687ce87504033c34dcc8365d1a43ed70896b46c3856494de236
SSDEEP 12288:yPHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:+nnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1C955236C2624F48BFE2706F448934542A77A19D17F91A7EF3684A139CB7D3D019BAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 90fcb15c3f4f9eb5b2c8a929524e8411bda676c6019a712e014be5e7d94d69c2
MD5 21f42e9305d136730af6ce89438405b8
SHA1 c89a2df20c1430c6b6128eaa54f7be6a02e34469
SHA512 543c5d90cb58707a69d7d1e1e33325f0727e1cc2278e537667c2817f33500d73fc54dabc4ba75bf4cb453220bd148afdb0424249a5a1fd3a1d8309748a851362
SSDEEP 24576:pC+TyQIu93VAumZr7jmYnQ/tbw/2Mkjy6Fr7g0o:p/TfIq+YYQ/lFTjN4
TLSH
T1F9558C1DA7E91DCAE276C675C8A34493E633B872176186CF2044C07D49AEFE8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 3808d9e0cc30caef0c625f6f72f4e9e617fabe622086f7debdfe30443c4e75a8
MD5 b416d6eb0a50e9ae0f11083f642ae3a6
SHA1 474707ef392bc4cedf2a7e067a29b2e216d4dc72
SHA512 9d7e34b56c8e4d6c8575cfaf274beaabdca7bf531023940db2cf6627437bb537502f6d94c297375a04e24b30bc51d90683379a0301217436f26221fa4ef9e8fb
SSDEEP 12288:dcyrWOstaa3kcs7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:YLQikZrnQ/tbw/2Mkjy6Fr7g0o
TLSH
T15165F11EB3AE10A6E56B827C88824142F7B37471575263DF5290C37D4BBB2E97D38B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 876d4192537fdb9b62859d21a2d4acd907fc5f43ce47f0c121911da040300313
MD5 20e6f9e98825298b530ea52533054421
SHA1 8e05b5f15b49d18a27e59a172a4f04c9b49a6d98
SHA512 7bf259fc80b37c485373f33caf5f63e7af5aa16015aa1539b32f192e9bdd10d44233f566bd86efd0f71da4af968c0d2456aa855125be46629dade9b4b82d494f
SSDEEP 49152:PpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAP2Q/lFTjN4:0pC7b4+80GTk+Lm
TLSH
T127A57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a2d461e4908aea2433550e3c01c4e13a3082c5279a635a70880ca6c9d8b7cf86
MD5 d3e5e9af68381755106869adb71ef395
SHA1 d6c96c12f4e11dac753ebf896ef18ac938ab1134
SHA512 7a787b8b82fbc5a678f7ba9f40a7340516f7851699a23b041d4b90e107f1a96ad98dea7f2bba35cd0fb84f96b9110f1f3a4e36fe9ea206a9015d9e281b55341b
SSDEEP 24576:8SAwJPE1IDAo+4Kt+l44135UQunQ/tbw/2Mkjy6Fr7g0o:8qPCIo4Kol4/QuQ/lFTjN4
TLSH
T14A55B02AA7F956E5E17AC7B4D663C501FB733822133163CF5290813E0E26AE85E79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 ae5da51f04dde75b766f06b9d34f2c427759995a75c0e17c9932edf5ec0504f2
MD5 3b049783b6dfe2e510b8086a69096944
SHA1 4bbfbc3195331fb05635496c526a3b3b8a0310ca
SHA512 78acadb2480b78a3f36a7b2bfdb10890830e12a079f2e98ccc73e6610218c7f83c87fbe02868b8259d4c20fac75d9c423660cb46e817e3fd0b6d046cb100c6a2
SSDEEP 12288:9SsyLCFBoPLCRys6NQ4t+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:tyLXPLcf94t+nQ/tbw/2Mkjy6Fr7g0o
TLSH
T12775E03EE66C08E5E57AC27CC6A38506F672389D037166CB169091791F7BFE4693EB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 74533cb87356e4d10b1a587ef03bc62ff5be8f20ec1f943e07dc6dad12ba4183
MD5 507e6b61e4ca46da3e966ed76ee0ce76
SHA1 9092eae962d6f5252a479a50deb44f326ec84ae9
SHA512 23f1028f27da556b548dd852abea40bfd1457f42c2280b4d7d50409e8cc8b3af83a9e6a61b35f219b9a123ce5f7db3c82977f08e985a768fd46e8b88d67ec189
SSDEEP 12288:39lyvj3IkxjbBzrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:3Wv8qjpbnQ/tbw/2Mkjy6Fr7g0o
TLSH
T14C65126D26A474D9F53A4374D863811692767CB227A4ABEF36C8D17A8B393C0953FF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/756-1-0x00000000021D0000-0x0000000002236000-memory.dmp

Download

memory/756-81-0x0000000000400000-0x00000000005A8000-memory.dmp

Download

memory/756-6-0x00000000021D0000-0x0000000002236000-memory.dmp

Download

memory/756-0-0x0000000000400000-0x00000000005A8000-memory.dmp

Download

memory/1216-37-0x00000000004A0000-0x0000000000500000-memory.dmp

Download

memory/1216-128-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1216-31-0x00000000004A0000-0x0000000000500000-memory.dmp

Download

memory/1216-40-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1272-93-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/1272-160-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/1272-90-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/1272-84-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/1336-150-0x0000000140000000-0x0000000140165000-memory.dmp

Download

memory/1336-67-0x0000000140000000-0x0000000140165000-memory.dmp

Download

memory/1344-106-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/1344-13-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/1496-180-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1496-115-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1496-373-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2160-70-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2160-28-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2548-16-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2548-110-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/2548-24-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2548-15-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/2724-161-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2724-372-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2812-165-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2812-374-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2840-169-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/2840-111-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/2888-371-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2888-157-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3128-178-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3128-376-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3128-172-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3128-220-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/3128-188-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/3128-204-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/3128-181-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3336-147-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/3336-370-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/3468-126-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/3468-120-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/3468-305-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3468-130-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3912-63-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3912-64-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3912-52-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3912-58-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3952-118-0x0000000140000000-0x0000000140143000-memory.dmp

Download

memory/3952-225-0x0000000140000000-0x0000000140143000-memory.dmp

Download

memory/3972-170-0x0000000140000000-0x000000014016D000-memory.dmp

Download

memory/3972-375-0x0000000140000000-0x000000014016D000-memory.dmp

Download

memory/4208-164-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4208-98-0x00000000007F0000-0x0000000000856000-memory.dmp

Download

memory/4208-104-0x00000000007F0000-0x0000000000856000-memory.dmp

Download

memory/4208-107-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4384-72-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4384-78-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4384-82-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4384-156-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4468-396-0x000001E5C31D0000-0x000001E5C31E0000-memory.dmp

Download

memory/4468-381-0x000001E5C31D0000-0x000001E5C31E0000-memory.dmp

Download

memory/4468-406-0x000001E5C31D0000-0x000001E5C31E0000-memory.dmp

Download

memory/4468-405-0x000001E5C31D0000-0x000001E5C31E0000-memory.dmp

Download

memory/4468-404-0x000001E5C31D0000-0x000001E5C31E0000-memory.dmp

Download

memory/4468-403-0x000001E5C31D0000-0x000001E5C31E0000-memory.dmp

Download

memory/4468-411-0x000001E5C31D0000-0x000001E5C31E0000-memory.dmp

Download

memory/4468-412-0x000001E5C31D0000-0x000001E5C31E0000-memory.dmp

Download

memory/4468-413-0x000001E5C31D0000-0x000001E5C31E0000-memory.dmp

Download

memory/4468-415-0x000001E5C31D0000-0x000001E5C31E0000-memory.dmp

Download

memory/4468-416-0x000001E5C31D0000-0x000001E5C31E0000-memory.dmp

Download

memory/4468-414-0x000001E5C31D0000-0x000001E5C31E0000-memory.dmp

Download

memory/4468-417-0x000001E5C31D0000-0x000001E5C31E0000-memory.dmp

Download

memory/4468-379-0x000001E5C31D0000-0x000001E5C31E0000-memory.dmp

Download

memory/4468-408-0x000001E5C31D0000-0x000001E5C31E0000-memory.dmp

Download

memory/4468-409-0x000001E5C31D0000-0x000001E5C31E0000-memory.dmp

Download

memory/4468-410-0x000001E5C31D0000-0x000001E5C31E0000-memory.dmp

Download

memory/4468-402-0x000001E5C31D0000-0x000001E5C31E0000-memory.dmp

Download

memory/4468-401-0x000001E5C31D0000-0x000001E5C31E0000-memory.dmp

Download

memory/4468-380-0x000001E5C31D0000-0x000001E5C31E0000-memory.dmp

Download

memory/4468-398-0x000001E5C31D0000-0x000001E5C31E0000-memory.dmp

Download

memory/4468-382-0x000001E5C31D0000-0x000001E5C31E0000-memory.dmp

Download

memory/4468-400-0x000001E5C31D0000-0x000001E5C31E0000-memory.dmp

Download

memory/4468-399-0x000001E5C31D0000-0x000001E5C31E0000-memory.dmp

Download

memory/4468-397-0x000001E5C31D0000-0x000001E5C31E0000-memory.dmp

Download

memory/4468-383-0x000001E5C31D0000-0x000001E5C31E0000-memory.dmp

Download

memory/4468-395-0x000001E5C31D0000-0x000001E5C31E0000-memory.dmp

Download

memory/4468-391-0x000001E5C31D0000-0x000001E5C31E0000-memory.dmp

Download

memory/4468-392-0x000001E5C31D0000-0x000001E5C31E0000-memory.dmp

Download

memory/4468-385-0x000001E5C31D0000-0x000001E5C31E0000-memory.dmp

Download

memory/4468-394-0x000001E5C31D0000-0x000001E5C31E0000-memory.dmp

Download

memory/4468-384-0x000001E5C31D0000-0x000001E5C31E0000-memory.dmp

Download

memory/4468-393-0x000001E5C31D0000-0x000001E5C31E0000-memory.dmp

Download

memory/4468-386-0x000001E5C31D0000-0x000001E5C31E0000-memory.dmp

Download

memory/4468-390-0x000001E5C31D0000-0x000001E5C31E0000-memory.dmp

Download

memory/4468-389-0x000001E5C31D0000-0x000001E5C31E0000-memory.dmp

Download

memory/4468-388-0x000001E5C31D0000-0x000001E5C31E0000-memory.dmp

Download

memory/4468-407-0x000001E5C31D0000-0x000001E5C31E0000-memory.dmp

Download

memory/4468-387-0x000001E5C31D0000-0x000001E5C31E0000-memory.dmp

Download

memory/4492-129-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4492-62-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4492-42-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4492-48-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4812-144-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4812-135-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4812-141-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4812-355-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4956-151-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4956-152-0x0000000140000000-0x00000001401AD000-memory.dmp

Download