42fff6c69ca79a94c61270532ff71ea581bba45eb6a888ca8aee6e6229b9cb16

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 00:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
Size 1.1MB
Sample260707-ajzxasbs8l
SHA256 42fff6c69ca79a94c61270532ff71ea581bba45eb6a888ca8aee6e6229b9cb16
MD5 e8aa37b5e632aad6e36eac90aa2d1dc7
SHA1 1d82d91b44d80f3dcf8bc0f73a3d988dde27caae
SHA512 f7fffa0e60596afa2157d2db73c70f4e7be8cd58b5d8a5a0598830409e86c5f49b25816b05026f801b349a97ba6421b9fe3c9f8a244b2ee576a634900e83a048
SSDEEP 24576:IHv9VDzhVtJdH+MgNPuHHASIbGKiARu6W2qTxi9trwUl7eFsj:I5JR+DPQAScGhARub2tkrFs
TLSH
T12B45E026F412C432E1B112F0697DABA6906DBC354B6449CBB3C45E6A49706E37F32E37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 12 IoCs

pid	Process
4288	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
5516	elevation_service.exe
2484	elevation_service.exe
992	maintenanceservice.exe
3320	OSE.EXE
2644	PerceptionSimulationService.exe
2932	perfhost.exe
3716	ReFsDedupSvc.exe
3584	SensorDataService.exe
4712	ssh-agent.exe
2764	AgentService.exe
2728	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe

Drops file in System32 directory 61 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f2c985a92468fd14.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_123281\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000ee45b3e7a50ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000048039beba50ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000436ca0e7a50ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009a2543eaa50ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005d1631eba50ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c73ce428a60ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe

Modifies registry class 37 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2626306573-1585762579-411806764-1000\{8FFB39D6-69B3-4923-B0C5-28E1E90A5A54}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2626306573-1585762579-411806764-1000\{1FE73315-AA3B-481A-B45A-ABFE597A000A}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\NotificationData	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4288	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
4288	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
4288	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
4288	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
5560	explorer.exe
5560	explorer.exe
5516	elevation_service.exe
5516	elevation_service.exe
5516	elevation_service.exe
5516	elevation_service.exe
5516	elevation_service.exe
5516	elevation_service.exe
5516	elevation_service.exe
2484	elevation_service.exe
2484	elevation_service.exe
2484	elevation_service.exe
2484	elevation_service.exe
2484	elevation_service.exe
2484	elevation_service.exe
2484	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 53 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5664	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeBackupPrivilege	3716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3716	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3716	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3716	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3716	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3716	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3716	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2764	AgentService.exe
Token: 33	2728	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2728	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2728	SearchIndexer.exe
Token: SeShutdownPrivilege	5560	explorer.exe
Token: SeCreatePagefilePrivilege	5560	explorer.exe
Token: SeShutdownPrivilege	5560	explorer.exe
Token: SeCreatePagefilePrivilege	5560	explorer.exe
Token: SeShutdownPrivilege	5560	explorer.exe
Token: SeCreatePagefilePrivilege	5560	explorer.exe
Token: SeShutdownPrivilege	5560	explorer.exe
Token: SeCreatePagefilePrivilege	5560	explorer.exe
Token: SeShutdownPrivilege	5560	explorer.exe
Token: SeCreatePagefilePrivilege	5560	explorer.exe
Token: SeShutdownPrivilege	5560	explorer.exe
Token: SeCreatePagefilePrivilege	5560	explorer.exe
Token: SeShutdownPrivilege	5560	explorer.exe
Token: SeCreatePagefilePrivilege	5560	explorer.exe
Token: SeShutdownPrivilege	5560	explorer.exe
Token: SeCreatePagefilePrivilege	5560	explorer.exe
Token: SeShutdownPrivilege	5560	explorer.exe
Token: SeCreatePagefilePrivilege	5560	explorer.exe
Token: SeShutdownPrivilege	5560	explorer.exe
Token: SeCreatePagefilePrivilege	5560	explorer.exe
Token: SeShutdownPrivilege	5560	explorer.exe
Token: SeCreatePagefilePrivilege	5560	explorer.exe
Token: SeShutdownPrivilege	5560	explorer.exe
Token: SeCreatePagefilePrivilege	5560	explorer.exe
Token: SeShutdownPrivilege	5560	explorer.exe
Token: SeCreatePagefilePrivilege	5560	explorer.exe
Token: SeShutdownPrivilege	5560	explorer.exe
Token: SeCreatePagefilePrivilege	5560	explorer.exe
Token: SeShutdownPrivilege	5560	explorer.exe
Token: SeCreatePagefilePrivilege	5560	explorer.exe
Token: SeShutdownPrivilege	5560	explorer.exe
Token: SeCreatePagefilePrivilege	5560	explorer.exe
Token: SeDebugPrivilege	5516	elevation_service.exe
Token: SeShutdownPrivilege	5560	explorer.exe
Token: SeCreatePagefilePrivilege	5560	explorer.exe
Token: SeShutdownPrivilege	5560	explorer.exe
Token: SeCreatePagefilePrivilege	5560	explorer.exe
Token: SeDebugPrivilege	2484	elevation_service.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
2584	sihost.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe
5560	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5848	StartMenuExperienceHost.exe
1920	SearchHost.exe
5560	explorer.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5664 wrote to memory of 4288	5664	2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe	87
PID 2728 wrote to memory of 1452	2728	SearchIndexer.exe	99
PID 2728 wrote to memory of 4984	2728	SearchIndexer.exe	100
PID 2728 wrote to memory of 1428	2728	SearchIndexer.exe	101
PID 2728 wrote to memory of 2912	2728	SearchIndexer.exe	102
PID 2584 wrote to memory of 5560	2584	sihost.exe	109
PID 2728 wrote to memory of 1164	2728	SearchIndexer.exe	116
PID 2728 wrote to memory of 5208	2728	SearchIndexer.exe	117
PID 2728 wrote to memory of 4868	2728	SearchIndexer.exe	118

C:\Users\Admin\AppData\Local\Temp\2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5664
- C:\Users\Admin\AppData\Local\Temp\qq_setup_21445\2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\qq_setup_21445\2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe" --temp
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4288

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5516

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2484

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:992

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3320

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2644

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2932

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3716

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3584

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4712

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2764

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1452
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2626306573-1585762579-411806764-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2626306573-1585762579-411806764-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4984
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2972 2968 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1428
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 716 2464 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2912
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1164
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2972 2968 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5208
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 716 2464 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4868

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5560

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1920

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b98db381d6cca126045d11ebd0f46707f9581ed4945e799528c94c63db7641d9
MD5 9a1b68db9b7a17b30a379f1c2c54c731
SHA1 2bb9cd5925ebcb0a2e612541f7d412974bd49fa7
SHA512 3f394a53712cec50ce918e3ebe85c4f1e6dcdfd2185aad056775089079568f6f688836ebe45fa3e6428d83f3785c89f659e00b2bd02d051b75b6e2a441069cc8
SSDEEP 49152:sb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnxub2tkrFs:W3q6tjB6ub0kr
TLSH
T1EBD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 f836a650ce21566a00d8203b69d86338f723f5b1899f824276dd961e5bcccd53
MD5 78aa75e904ce941470b16c3d9d65dde0
SHA1 009d6e324cff6a351e10ee421a5e3a4d5c5b8bf5
SHA512 3e9e538bdfeff41dabfaf1b66f44815b4c67f9c5df7d1cfa84dda58fc6c4d124034933025d847a4c4126ecb41d4c7f1394359d0a439ab06f93b43d136c042307
SSDEEP 12288:D1XLsswWkxy2lRq2czACfugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZJ:ZXYfDtczAGu6W2qTxi9trwUl7eFsj
TLSH
T1B1650229B3E408F8ED6B827CCCA18515EA737C4147A0D78B03E499661F277D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 e8a75f87b163afcaa7a268d2399f9692a330673c351a113c5e3cd39d1de40cbf
MD5 4aa7fe90821c6adb00cdefdad89bb9b8
SHA1 e2c550e1211ea1fd15c0495d25eba98af0ddd5bd
SHA512 b0ee9cab7f216187dce6d43b24e450acf327c118b681cc0516d7ab21cda8359489d9a11afecf079da276a73f572e575c708681343065a1410b8368e09819795c
SSDEEP 24576:C0Le5ji0hmxnrM5u6W2qTxi9trwUl7eFsj:CPji0AxAub2tkrFs
TLSH
T17E859E16F5748331D073C0B9C5D2A69EED7130865B308ACB4286D77C7E6BAE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 041dcd02a88fbf61a582a77fd369053013fd2deda5e6829851083a66865e6817
MD5 29cc8cb1331c9dc7af611c7be78604b1
SHA1 fc17b4ec0bd13d0d560bdf46d1578c8727753f9e
SHA512 6729588080055e38829b06bacff42f34228c59a133bfb402cbf32791a552cdf3a6fba2eb8198c63a57ab22469a6099f6a71887336f954c99fb7233dd686a3d88
SSDEEP 24576:1a7/ezSC6vUyDZaqgrvWx6q8wyunu6W2qTxi9trwUl7eFsj:8/ezSC6vURPvMHjysub2tkrFs
TLSH
T115755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 fb390885eec1697dd1c90350dab73034d72594753b7b369a66bb8abd5a55f33b
MD5 85de310f70bf6b1c25ebff234a1d87cb
SHA1 804ec71cec16426fb80388513dab34478feca22f
SHA512 27c0439108e6dd90d86300808d54db6994312316d702d5e31b7b10b6d40f5e3f3f56e8d716969485143dd7a06a02fb5c54c051060cd33f848d8ab196ca0c8215
SSDEEP 24576:qVbqPb88hv/lV7qu6W2qTxi9trwUl7eFsj:qVO88hXlVeub2tkrFs
TLSH
T131559E66F5748331D073C0BAC5D2AA9AEE3234424B31CACB1246D76C2E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 d02776061cbc9ce9bd3749e626c69a34faa7487c1ba58a75e1c05222ef50149f
MD5 0b8b4010466505ca493e21b83c8f3405
SHA1 1eeeae2cd0ef5c82866041bb4088db66c08dc39a
SHA512 260a9f290674c553588813e0484056cb9a941eb4c7126c340a30e75850fbcb411e88ba92cd5af547a1c1b25bd2e4c9f9edd6a2847d6c384f72cd29ced81a34f8
SSDEEP 12288:vGVfugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:vGtu6W2qTxi9trwUl7eFsj
TLSH
T122452317D0A94460EBBF12F13DB8609D485EBC4589C8C80763C3BDAB487DDA2DDE6297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 6d06b25ab66fc39d3fd81a52d9a16b9546ada04aea3c5024c104acae59924cb2
MD5 f0178f4a2110f8a2ba5a2e4a61da2c5c
SHA1 605f34fe0f8c4117b92847aa01aa89879184851f
SHA512 16416a9ee56e5bddc7823a60d2489a1db7f8e41297f1ce4ec96f69248b85632ad89678bf7f41b13b6c63b306e0c02b5aeb374cadc1b9cdba4df8bd3750e18672
SSDEEP 12288:oeBNUbTVO86UOfugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:oJIUSu6W2qTxi9trwUl7eFsj
TLSH
T11165CF3BEE28FCE2C27E4DB95A918240D77278304F5193CBD265820EDE275E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 783f0393f66802b49313be9a9797a051a223f09c4c59090ff60c0703be871a02
MD5 89f0d6267b1bf9531df1aa772c1a3a29
SHA1 aede63585aee0274d1591c1b02cc73e66136cebf
SHA512 6ecc1c541fb34d815fd786305f9a90e2fa0941a620d81aaa2bcbdf3799806871d225b85caed20e073a828c6c67213a363c1350bb3f5867650002bc12e1ee7b58
SSDEEP 49152:KQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3TH6:KQvGAdlCEL8c/pRNw5CXub0kr
TLSH
T142266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 f1aaf2c79a5cc49a1b60dc115257ae238f6ba31d09e39f6af9479318430014ba
MD5 a5b5347866ea058bc79487e1ecf93008
SHA1 fab594b2fcda365d506863a9a653e50be1abe136
SHA512 227bace6c82cbc44d33a07f35ad2bed650ea3348e3aa843280b8f07d1cc483750162d66ffc031eec7160fa56dad99cbf517b3d5b00448cd2c9cfadab1c0327e7
SSDEEP 12288:3AwSfxL/2Dc3xDLLmt0LDQewsAjMfugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZaf:QwewsAjwu6W2qTxi9trwUl7eFsj
TLSH
T10775E031FA74E436C3BF0DB22B35C71A186DB9204B9119C3E3E89D9E59342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 bde7219979e3ea5427931fe4fc3035c10d2b2b25385328200f70e9c497c49667
MD5 08dec82a53e537869d17dc8176e12bb2
SHA1 240e26b3bc51a44b24a1e3d8e73ad7ea3b5a3bd8
SHA512 b1f5914455f8045eae1669e2207a060ccf60fc0434a45ff9de07843bc4c87973cb19f3abcf2c9007599f2f47d8b157c9fb51f3c4ac5d61f48b49d113908c1e93
SSDEEP 196608:7UEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHoub9:7UEtQevvqc2W1cpV29I32o6
TLSH
T186474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 02d32f3e106008d2326dcdd4ccf690118d6f3b6eb99618d071f017f86c0e9696
MD5 dcbcea1491de4871671680bfe1c54097
SHA1 1b668bf7f27e38329cefab9645c082cf3d23112f
SHA512 37790efde65073700e54d593c451052d4272b1186d0ec484f76bffc47a9271af6418b3e12303f50d71ee700cf8a3b3ed748e7a0f064787aeabd4f50bac2354c1
SSDEEP 49152:4CbRquA/m2yL5zTfFiV+XenmE3/zQub2tkrFs:xoquVjnmjub0kr
TLSH
T172D58D0976B8C1E4D1F6C37896A2C647F37178154B349BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 6666255921813d472a21cb764ad901eae31821cfed14bd34dd66e07618ec42c1
MD5 4342d9cb25e013a2e3c2e0036f85f379
SHA1 941ba5037933929c9022c3afb75dfd5e65ac0894
SHA512 14446cfbaa8ca691e12cdc840a2f41d90471dd7d390c83115a4fd97f364a09168b55904797f9bc81ac8d9c7edc603669c4bdc771af3279e00bbe38134d21267f
SSDEEP 24576:XAhGLmIFoiwtA5l7S53Du6W2qTxi9trwUl7eFsj:XAM1Foiq5Tub2tkrFs
TLSH
T17135AD81E7F945D4F5B3AAB899B69170EA76BCA65E30C20F2250D11F0E37E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 01b9c7c0af6f446b8ab9dc9bb96f9ac3e9ead4d5cfa70097cdea99b33e6e2a8b
MD5 c5d6a634fd2e1dc307acc9799a847bc0
SHA1 c7e3ca121a96ae73f1e097c45217d95ce4fe9783
SHA512 a6b09d2c0072bd70755b82e698764bf682574d8107ee1f01492750793312925d49288fa5274995814d5185158d5b0ddab0d77bbe9a8ba4ac7b6ae757efdcb217
SSDEEP 12288:1mw5HEjsChNOBFgl0WDm+CPfugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFf:wwuXOWMu6W2qTxi9trwUl7eFsj
TLSH
T1A565F14AB2E40CF9E96752398557C136E7F2BC022A25CB1F13A0C65B5F37361AD2E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 555a791aafdb2ac1c4cfd2f6c578b4e41ac12d5e7418cd5c97fac80819203f54
MD5 bb47a512fa31a77fe4c96b12923b720b
SHA1 e80528704c17755c905428cb885f5f1ab8cc9cb0
SHA512 2859cc5fb607af416b8b9aaeca2347d1065d7e532cf23cd5138473f0903e1211a6528d30ff619a41ff84cbad769e73dd3f3c6ea8fe233d9097df4430525f35d5
SSDEEP 12288:IbZ1Iy8fugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:QZuhu6W2qTxi9trwUl7eFsj
TLSH
T1D655125BB1E820F4E2AB12789CE05249D7727C42577583CF139166AB1E3BED25D3A323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 832324020d6b73f4bd967f91998fd6531f589d15dcbc861cefe2523357164818
MD5 9619caf1c09a6507aaf8e35b1006c476
SHA1 a35adbc0f413749a19de61a0e134c3005a39e49c
SHA512 629bf8e82f7c63ecc33d104e83921e09e8f7ae190ae7cdd95c6d1aa40cbe36d3a86081369431fbb6a3188ce9d759afcef4aede4838c406c4b23a4d9388a65122
SSDEEP 49152:Ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23U+:bQRQyi36YOcPuLvw2gAf+PN3uub0kr
TLSH
T107667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0bedd072d0cefa67500d0a54609290a16865f204816c2cecdcaef5372c9b3133
MD5 f48a19e72fded903c5c05ee57776539a
SHA1 0ee26b289cfde243d61146df1f4b45b43e667cdc
SHA512 bc274f0a50a981c911e121f0a26fe1c9d20c0f63a6bab548d7913c903b536310cbc30f020d401e77300d67deac2b74de74bd0627dad4c38c96d37cd04d35b343
SSDEEP 49152:5j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23U+:AQRQyi36YOcPuLvw2gAf+PN3uub0kr
TLSH
T16F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7733dd2328b2280af42612db0a09cefeae557a2817d03a007cd34c27906b9d24
MD5 063db1679b207b67b33140e6ec24e87f
SHA1 ea0ee241c38ff166094b3ec34b9f8cfac480ad3d
SHA512 409a48e4d9fe11b2919a7686d6dbfdb3e5ee6105671e86c009fe54d45766a2437725289ff1ece8c1507fd1722ca31315caac4973d73e022376d119baa41afeaa
SSDEEP 24576:AwvLof6SRQ+rn/fDboqxN1nnh6C7DaHGTNHu7PNU3/5W/ohL0xu6W2qTxi9trwUt:m68Qg55nhxeWu7PNU3/Aub2tkrFs
TLSH
T1A5B54933B2F600A9C44DE1769F4A872196D27C758FE0E3DB854172161BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 af630ba18aa1a5ec5c6d175fb269a09f30dfbde165c3f7d4dc30ce7a428f37b6
MD5 2ac31f1fcc20b2dc0149a397cbe11204
SHA1 493cf70f02f6e0dbbf965e3a2d79b3a148eb2305
SHA512 c5e75b145304efd8f3dfd8142b5af72627460ca370f74caf3060346f43146184ccb66af08b569810eaa69b69e322b90069074171d4a1e0e300d03ed2d21c2c6c
SSDEEP 49152:H3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99U:qy5112gYy5azzVvD69nLKnhZtub0kr
TLSH
T129167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 3d53923767d90f3c981e8a96bae66ace1430f3935d65da7061acb2b549838a19
MD5 f3b5d23adc644dcd74ee21fe281288d4
SHA1 cc4a54e152c7049041b4ce6dbc8531fb78b8507e
SHA512 d409610d6cbecb11cb4c61ee7714d0311ad28021f149c9d7dab9e882e9405b724a1312aeafb1bb4c29da2cc2bf4546c62241c4f70b7370fa97da79511fd3088f
SSDEEP 49152:YB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glNub2tkrFs:yu6JmQxd2dNub0kr
TLSH
T168D59D13F1DA01E8D06ED178974A9233EA62BC490B34B6DF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 62fe7134100c2eaf033869fa8c974a4d2337e2781d7ab122b679b524aaa80ab6
MD5 115ac03b21c5c230fe0e0764641f0f98
SHA1 b170586463a4a22b9ed1a4a37fc6716ce95d290e
SHA512 53f9ef5c8665a0abed2f845fe206a688019a3f6b7dd2c54121735c85dc844ec425f104df563e9d55df28c09c710b32c0f1f39b98a485448d956d1b1268e1d665
SSDEEP 49152:F1hpsNoJpF1A6yU44CwH7R4xyub2tkrFs:FmifPVRjub0kr
TLSH
T1DBB5AE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c719224fafc1b18bf4bacced8e2f469b277aada3661651e3e24cb40cdf438e01
MD5 e972f3bd69d94f20be63089a69723322
SHA1 52fa682ada697cbade5eee84223eb935669675f0
SHA512 886eee40c6c3db722a3be90386bba648be46c658bd855b8021215ff11fe549b1e886f6550ae01debf8e71ba52054d4a640508c2fb1b7f25b0e57041f484485dd
SSDEEP 49152:QSuZQIY0Be2KIRVtOnks6NMHqhub2tkrFs:K5dKOi61hub0kr
TLSH
T1CCC5BF03F2E940E8E0BED6748B659236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e189a90d90835cfc395a0861adf5524f19b6cf6ab835b39bde0c3a60d1190729
MD5 b03f783f77aa590b4433dcf2b6c2b213
SHA1 b7e0356586b743adab9c98a980df43177b72ed17
SHA512 155895fcfbdef7dd811d9a0f8c27b47b32520228cd030435449231f9ca7b2d3dff01e890faff5a2a0c87b24addf40f3baa8f029840907dc6bd27f4e777e8dd84
SSDEEP 49152:qhtSn8EApI0figGgiDn0AP5wGub2tkrFs:LX2i/phPub0kr
TLSH
T13D95BE13F2D900E8D05ED174C7568632E962BC160B39AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 f69a0028e3c7cda3cde9c6558467b4706636977dc20f5aa0dbcd243a697d5cc7
MD5 c264371f5dbd063b97ab974247353c47
SHA1 1e574490692b92ebe9059beec8fca0be5b4568c4
SHA512 4eb154b5ac6b386d999448e60e79c0da53ddee8a54d212e20f234dc7492341ac38498b3779746368bd6fca487bf2c8c7117922879fb84178fb848ce028a2e9a0
SSDEEP 12288:d9fugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:d1u6W2qTxi9trwUl7eFsj
TLSH
T15445231BE0AA48A4E76E13F13D64609D484D7C478AC8C40773C3B86798BDDE25DE62DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 cbfdb3eb31fc80dc814acd9d937858cdb6c1aad201b93fa057e8dbf3bc72b139
MD5 9a383093ceb47c5d407dc739e45bc943
SHA1 1258d8fe2fe4574ecc7e4becfdc27b7218ade579
SHA512 dbb093bbd7b99fc577769869875a00afc7c8b800c0c68aab66ef3a8b5a6e7bbfb156541a39101bf8fb2f58747d12bd89c8e1cbf6f72b7663b315a83c553268a7
SSDEEP 12288:kgfugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:kEu6W2qTxi9trwUl7eFsj
TLSH
T1CE45231BE0AA48A4D76E12F13D64609D484D7C478AC8C40773C3B86798BDEF25DE62DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 73bff1145feb5dc2bed1c1de39fb748406c812c0a77bff1f01ec18ade7ef5dc7
MD5 b5bbaf5b7fba8285e12c3b9517ca534c
SHA1 247ac2bb34d57fef78d7e61f0870b0a14c7dd7c9
SHA512 c55e8aeb56a2bf8d897754b215934159960ac355406edef03ff7184d169550081aafab0c858ceb1a630e7a78cf8c8baf0941979493a6a502e838a037ef7ac761
SSDEEP 12288:5WfugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:56u6W2qTxi9trwUl7eFsj
TLSH
T1DA45231BE0BA48A4D76E12F23D64609D484D7C478AC8C40773C3B86798BDDE25DE62DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 b53e46f0a4c5f05d8c4c5eef46be65b57a1b51a8f499e7a491fb671a409951d0
MD5 5470f85aff489408656194f89722fe34
SHA1 c129ae39f453da743561bbd47501fb2b92712c2a
SHA512 51225807a820bd0c96f578192146240c15a6b7795c55cd091d97558e4c65cc47faae21ac4cf304a0e40b31c9bdb63bd9d3c5c2722f59a2d1e16a0652f214a3f2
SSDEEP 12288:1VbfugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:zu6W2qTxi9trwUl7eFsj
TLSH
T1A9452317E0BA00E0DA7A93F16D70509DD5AABC42CBA4C64F6382385B0CBDBE05DB5797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 13d90025bd97d2bc4a69257545d0d8988277141e61ccaa9dca90d48578e3eca7
MD5 98cd44677f0090c976395ff7000b82c4
SHA1 89e6e3ac1b996dc94d03f5ac2fd3e8d53bf979dd
SHA512 e71f41c30612166368d73341fe55d101ea743a0c264fd75c90cc92012f2ee1daaf8707e7e77c125146e4a1133d40edeff458a17354fb2437d542645ba8caf2b2
SSDEEP 12288:YTfugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:Ybu6W2qTxi9trwUl7eFsj
TLSH
T1B945231BE0AA4864E76E12F13D64509D484D7C478AC8C40773C3B86798BDEE21DEA2DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 e8eb0d99b9e255b4679b7bdff4454f47b96cf326a2ffc80df2c6837564c1d9e8
MD5 907f6f423e55398db202a1069f271c70
SHA1 b9f242d6c128844229c6e5e1e8cd83bff590c805
SHA512 8ce4ebdc214467170cbf96628be143ceeccb36cc3d0f63378aedda5f9c3a0347c98a1c158f01dce4a8989c5391c165b8f65c4b6c20f579a35724645e52d25a8d
SSDEEP 12288:c0fugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:cYu6W2qTxi9trwUl7eFsj
TLSH
T13445231BE0AA4864D76E12F13D64609D484D7C478AC8C40773C3B86798BDEF25DEA2DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 8dee37bb1589a6882be71d83b1b8d3fd69a83f3da0b22cb80d0a023b9e04538f
MD5 3ff021931f3d3d48239fb0b51f618acf
SHA1 11ac1f9928c3bc1565cd72d3e88e8e481386ad3e
SHA512 35863fdd51aacf7c15173f07f969dfa7434b1f208401fc62ab16e940a80289c638b7687ae7105e78a18ac5ce3d6531894268b0f9a413507042be55b63fd20bc0
SSDEEP 12288:B4fugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:Bcu6W2qTxi9trwUl7eFsj
TLSH
T11745231BE0AA4864D76E12F13D64609D484E7C47CAC8C40773C3B86798BDDB25DE62EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 0cf00d201a1bdd0424f851f1633b48645b7ff689b3e4c29282d2f61538f6d273
MD5 bab02a4c8bc77389770f9f0e389c3e59
SHA1 c7d78b4f5a3773ebe5a4b9627baa819f8771c2ae
SHA512 7e91db3df8b8a33658c5ccd2df408c4827675fadb1c6bf9bce3d605b5f59a448d4613c9c433e4a7167e17f052a347fe66beaf95c971262ff0f4cc26cb5506dcb
SSDEEP 12288:UiZwbNzzFEoS2cPvyAfugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZud2:3ZMJzFVSOku6W2qTxi9trwUl7eFsj
TLSH
T1B0650295F2A008F4ED67827E8D65890AD6B27C1A0B60C60F13E436675F377A11C3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 842576ea6801d8b15ac7357376bb77c78254e0ca458e5e6c7258cdb85fd5578d
MD5 bdb1759a3fbff9bae040f8d66ca77523
SHA1 f6cf5e8f0a2807dac9d6ad6b906ec432688b11c8
SHA512 25b39705e20f98fb955b2b1bcbfd424da2f79023ed177afbf0ae73218d18e7b7c5e7805811987a3dd334325609d82e32583df9721b044856ace62505a27e1456
SSDEEP 12288:ypfugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:yRu6W2qTxi9trwUl7eFsj
TLSH
T13F45231BE0BA4864E76E12F13D64519D484D7C478AC8C40773C3B86798BDDE21DEA2DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 d52c8262e6c6004c1abe8b2bbd137d082fccb3c6dc3b55a34ca24418b31321ef
MD5 ad1d1b5c5fe4fa84e2c6ec0c52ba409e
SHA1 898b5ed5301bda2ca155f5e40f52da7421a8adca
SHA512 68c149c23fc8b338e7be58f07daedd39827cf2eebd346a340aa73078aedefe1685f3101cad60966ead03cfa9855b13e25332c1aa64fc8151124a942cdabd4b6c
SSDEEP 12288:PFfugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:Pdu6W2qTxi9trwUl7eFsj
TLSH
T11745231BE0AA48A4D76E12F13D64609D484D7C47CAC8C40773C3B86798BDDE25DEA2DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 1fa0e5e56dafa5cb68a3b782fc7b98ba57e7edffa9d14b84703a3d51c2104b3d
MD5 15787f94c6bd599c04f5dd6687ff989c
SHA1 b28a9df11c119f3239f5ee35de3ac18a16ecf79f
SHA512 a78e5d0878374ad2ea2c272648739d5b6b85d6c3bba6d6a0df392482be63bf848654475f6e6780ed9a688856386d84f6cb8867edd31067b8e87f5e73fcf954a4
SSDEEP 12288:8yPz5L88fugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:lzygu6W2qTxi9trwUl7eFsj
TLSH
T104551207B2A530F8D17B92748C611A06F776BC324B60CA9F139016771E3B6E19E7EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 96a09267ab3257e66a7628fca33adbc5496eba4d8d8b827db79da1ae5b14cf1e
MD5 e0b695ef4275c5c5fb643298d6f553b2
SHA1 ba10ee1078a4caa60bb73c349327d965e0445f5c
SHA512 cfd63b9fe519b0ee78088dfc5a1397dab8946c58ebb3f5503b50e800124fda524c75390c8303218d203a5a12fab67ca461c626ee9d781f1b9da31fdb7ddb1873
SSDEEP 12288:LpfugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:LRu6W2qTxi9trwUl7eFsj
TLSH
T19A45231BE0AA48A4E76E12F13D64519D484D7C47CAC8C40773C3B86798BDDE21DEA2DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 10989389b40bd852053352581b06137f3580b55f5e2024fab1898c0122805ac5
MD5 eb1b407eae3c83bc41836316e136c7fb
SHA1 38cc9e4b5341296036bf9968ceaf9d365b02d1ce
SHA512 08b5c932f31ab12b95eb986547fe7bc2ae4de52bc1d471354344cbc54d728569de32ddaa3da402c2eb083c2cb1c1700d20e4b480947272cb0da8d780cc3cbdcb
SSDEEP 12288:VpfugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:VRu6W2qTxi9trwUl7eFsj
TLSH
T15445231BE0BA48A4D76E12F13D64619D484D7C478AC8C40773C3B86798BDDE21DEA2DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 ef10300eae1664ee79c5c26b893ff2e2b3fceca1e1644d1a64409b54226c86fc
MD5 75fed7f76da84fb4b65e37e36ddee145
SHA1 918818d0825c57139e7b2c26d6fb520e3097e8e6
SHA512 0cb66071d81d6723c737050beaa5d21a89e008e7b9e37063d5e2bcc6e570c41311f1db8f7ec09683cb6524e2d95219068808d95bc7bb7755ec3ef223b5775e74
SSDEEP 12288:AyPz5L88fugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:xzygu6W2qTxi9trwUl7eFsj
TLSH
T12D551207B2A530F8D17B92748CA11606F776BC324B60CA9F139016771E3B6E19E7EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 35c1dab7598a8d55faf2526a875711e3cb7899ae1904011901f3b656c45a84cd
MD5 0c4586e8f1bdb51ccd7b85f1674c6a1e
SHA1 95bd247879e689f0210243fa68268e43b08cf51a
SHA512 0fc94976806ebba628ca8a9579d60e51dcc5cd954d408dc10a15b1214ad8a36daa7c5d78c364dfd4eb75d385b41d144e7b32ac7c4e82273c35a24f97c86f453f
SSDEEP 12288:CCd9XWYoaLHF3z0z04PDvhmfugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFf:DTuaLl3z0zDKu6W2qTxi9trwUl7eFsj
TLSH
T130650295F29018F8DD67827ECD65890AD6B27C1A0B60C60F13E436675F373A11C3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 bc6eeedef506659a7c443e9e5c72be2e310f0cb8200a2396f8d214a883861421
MD5 6afac8eb395ed48c7464961dea9fdff5
SHA1 e64595f9677a5067212403cc86c76e45ed148a5e
SHA512 3361ed3b3f97d3dc6a2b2ef75b3533e4f0711df73f97074a99a251a33b00185127b61530106984a90f1c94519a820d6f2375963db56ba4ca2bce144f453f721d
SSDEEP 24576:r3xd9CHKy7GZOu6W2qTxi9trwUl7eFsj:Lxd9CHKyaIub2tkrFs
TLSH
T1A475CF91F3E814E8F1B79A358D764511DAB67C5A1B60CE8F03A4261A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 bda94d4e538f9c0cb22c8dc1752781ac387c443b7ecc74c4c5de32105a6c4239
MD5 542f337e7ad501b5ef2f6ad60d9a07a9
SHA1 f14aa501bfca5ed72c2354b2a9016c50b369913b
SHA512 a8f48536bd3619d8dc2d56f6e2b30f2f9319f104f023775b973d2677263b8cbab539dc2379c4f4bcda53edbc74d9ec53523a5e13c5ffd67d3134241c3449d66d
SSDEEP 12288:A2fugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:Aau6W2qTxi9trwUl7eFsj
TLSH
T1CF45231BE0BA4864D76E12F13D64619D484E7C478AC8C40773C3B86788ADDF25DEA2DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 5196f16f5175cbe51a753098df7c83463c375e088cb0e9cba6b325b1252301dc
MD5 fb3266449f532e28b2e45baf787b1e95
SHA1 3dbba361ee74e9f879354e9a848a8990829bd151
SHA512 073b6f2f8fbaf8f7ebc32270e5e31d0629320882a8396fdbd4fc414ad99de823b363b7fd4076670eaacc7536cc03e33e593a1eee7982497e56f73621239fafa4
SSDEEP 12288:ecfugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:eAu6W2qTxi9trwUl7eFsj
TLSH
T1D045231BE0BA48B4E76E12F23DA4519D484D7C46CAC8C40773C3B86748BDDA25DE62DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 3c9e59b10b6784bc75d6c966abfa2911c1d915fa4bc77cacbf5dbe920ffd1896
MD5 b8bc09f9c96c7024637f4f9bf94cb8ad
SHA1 fbb1c03362473eb910f8afe21d2f7bcd0252b876
SHA512 5cb281b3b057b52bdaa5695aa3e9d636ea723d249dc91ce898b772a261f319626d9e2563b446576065fd15747ba8573ee5bdd5b5a3c1af83ef6c1efdfe61f2cc
SSDEEP 12288:yHfugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:y/u6W2qTxi9trwUl7eFsj
TLSH
T12D45231BE0BA48A4D76E12F13D64619D484D7C478AC8C40773C3B86798BDDE21DEA2DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 b7f6af87544bfe2a80c97e8ee5fddc9dff4866631120cc8e84dc5b6c13db7514
MD5 c0459d019615f602b57269d7096b62d9
SHA1 f23bf8271c8ee7cfe24b900dd226d787db7e74da
SHA512 495d86529c2718c3c36a0feb9602a8d9c064a235a07d392c9471b65d36d799e8e170f36fae8766b7d1e79bb9c24c5d72603e79d59bdcc40c01ccb884ca4da90d
SSDEEP 12288:opfugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:oRu6W2qTxi9trwUl7eFsj
TLSH
T13945231BE0AA4864D76E12F23D64609D484D7C47CAC8C40773C3B86798BDDE21DEA2DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 cb6de120b80a9e798848b53d6a4bcbad1920e43c940d2906a50949ed84d37c6f
MD5 49a8c72e440009b64d2c0735b1819f0f
SHA1 a751623e3dc86485200d8bdf17372828fd00e52b
SHA512 ed591680b108d68fbdc2ac59d1f42b17e64675b1029deec39744bf6115ce5224491b169d03281d9101e4e273638b1e0dbdb35ccb9a495e3d2be5da811457c4e6
SSDEEP 12288:N2fugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:Nau6W2qTxi9trwUl7eFsj
TLSH
T1D445231BE0AA4864D76E12F23D64619D484D7C478AC8C40773C3B86788BDDF25DE62DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 0f8ff5aafbd5184cb8ba5f56cec9a5b09972c65037560dbff37527b50e915c2e
MD5 52f9d7a1bacafb2df071720755424918
SHA1 871d8bf2ccdcbe14f7d08f311395a537621ead47
SHA512 4b1318de2d89e77a7d7f6d798c69869d3d9e97a452a9e1a4d76d2aeeb6ed535200590dd2706220689a4a2dcf8893dbb7214238f99d5b12a0c375a0cad42ba56a
SSDEEP 12288:DhfugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:DJu6W2qTxi9trwUl7eFsj
TLSH
T17A45231BE0AA48A4D76E12F23DA4509D484D7C47CAC8C40773C3B86788BDDE25DE62DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 27df800c3953047d43a6ae0a7bbc2c6a818a387ec33677d3cc360a70b8eaf36e
MD5 fe500172e09b8a35e4c4ab3f478e1a4a
SHA1 7251b729c1bb792cb46244f063dcc054325e8361
SHA512 2077be2a52c55ecb37d76eb123b9e40864edacbe739c704092e51bc1f6c6c924fe1efb9f19ca70d640d871f4d5b752e4246b1cddce3994d68d32d48d7fa4f0d2
SSDEEP 24576:yfwvOk9RX6wkyAINu6W2qTxi9trwUl7eFsj:0MnYINub2tkrFs
TLSH
T1C085D029EADC04E5E177923C9DB3460AF6B178590B31C6CF029A53AE0E37ED45D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 a23b554f4feb06650ff874e512cb6535b5686ddd9127eabfac49af2e6ccc9157
MD5 cedb69422777f2730ea6467353284c5f
SHA1 bb539d2d02981c7fa65b59a4377f3875948206b6
SHA512 c16b4c580374c09a045393c50b9b042339eab172e75aaf68b21f18f1f73cb85dd2a5abccd901e702532a5c37535d919d1b5743291ff2560206130e0ef35a532d
SSDEEP 49152:jYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0mub2tkrFs:dySzPOub0kr
TLSH
T11D066C56A1A801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 748e0b5c242f2652a050d8aa3e852ba0bdf300502504cf35f3267090b3ca0d92
MD5 f0c125736c7cfbc10bb72ddb93c3d5e8
SHA1 c5e55884abf244331e73749ae8e926123fc1116c
SHA512 7ee0b73b7e138ef0d2efed411f929d46611c49c8c35ffe4684f8a73e8fd2b57ef47a97230c9d4a4f9008f2ca77667cbdbe31cc9b8591c4ea80d3470b9f29fe36
SSDEEP 24576:q47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYUu6W2qTxi9trwUl7eFsj:q47JUQjairIhCnDHUPfF/Wub2tkrFs
TLSH
T11465BE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F27ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 dead23a11df4262442524cd593a22b103884a3895f4869659c6523f39b246f54
MD5 83ea0599c3a4110219c2ee394b8c0c04
SHA1 107b3bd84cb52b9860f2d847ed47ba4584e9a5cd
SHA512 df9a55a820d6ab0d5cae7f73cd19c235ef4b4cac5786471c71020423b019505ab5dc3f549f30693d1bb835abfb4bd3deeb2d6e6a4fba73e95b09d184f29eca2f
SSDEEP 12288:Aksf5fugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:Khu6W2qTxi9trwUl7eFsj
TLSH
T16D55F11AD2A801E8C16E62B5DB554645B7277C2587E1C3CB63C0F83E0F7AAD09DEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 30883720d158ecb7918cbcd525cfecfe327724b756b865b9f4c008601d84279c
MD5 d29e5b5df1baa65326197f933d2ab19b
SHA1 8aed4a8f31cb22d25e851de4cac6c1689528e034
SHA512 824f7797d763ecc524a40bb90a8af44e295a2c54a0815f6f3a1637f9c3c996e1e1da243529983de3a5442f0e28d30346ffc804a76c5aa96f286c3ac93a0af6ae
SSDEEP 6144:cNsBC2naWxbehwKX5MKYotMxOM/d4hh6xpZXyCZnIxIxxdP/REAMM/IzARzFsiqa:c6RE7mZL3dP/O1ARz2nu1DO/WVOLErP
TLSH
T161351600766AC74FC6AD44725E37D5CCAB707D42EE05AB0372C94B2FC576658BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 b148c68147cc9d99d5650fb5766f935cd8a05c56137f190e8c81eed20da265c9
MD5 16b9c5cb5039449ce7b6dcc5d7fbe38e
SHA1 f270432adf4df267ea2d83f26243a7983462167b
SHA512 858ef124d2957609f40a37aa661ee03a2306d547711791acc50605c8ed6691aa0d5f5302d81f6a3a756502afd32bb199a69db47ea40245089b560088b6017c33
SSDEEP 6144:KaYEK8wbm/bL/ks+FFxW/kIMMnsVpItVqJrlUeJWQiwae2xrnl6KktMxfKzEZLAV:K0HvH+PxWFoICJrlUe4QkBnl1EvdI6
TLSH
T13D65D7406136A38BD1F760B1032A5F4DAB64EC477749AF2673CC493ED82AB15A0B93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe

Path C:\Users\Admin\AppData\Local\Temp\qq_setup_21445\2026-07-06_e8aa37b5e632aad6e36eac90aa2d1dc7_amadey_elex_luca-stealer_lynx_njrat.exe
Size 1.1MB
SHA256 42fff6c69ca79a94c61270532ff71ea581bba45eb6a888ca8aee6e6229b9cb16
MD5 e8aa37b5e632aad6e36eac90aa2d1dc7
SHA1 1d82d91b44d80f3dcf8bc0f73a3d988dde27caae
SHA512 f7fffa0e60596afa2157d2db73c70f4e7be8cd58b5d8a5a0598830409e86c5f49b25816b05026f801b349a97ba6421b9fe3c9f8a244b2ee576a634900e83a048
SSDEEP 24576:IHv9VDzhVtJdH+MgNPuHHASIbGKiARu6W2qTxi9trwUl7eFsj:I5JR+DPQAScGhARub2tkrFs
TLSH
T12B45E026F412C432E1B112F0697DABA6906DBC354B6449CBB3C45E6A49706E37F32E37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f2c985a92468fd14.bin

Path C:\Users\Admin\AppData\Roaming\f2c985a92468fd14.bin
Size 12KB
SHA256 7130b7d37f020fdcc8777751d51adddfd8435e625ba042c03b99e4fbc82e0249
MD5 23a2a1996b005a8399cac9c5d2bd31fb
SHA1 ae5bee2ceb6c5040b2eaf4c19427931e006ef490
SHA512 a021790fe5bafcc35c05b74fb3157ad7f7de46bea3572a1ed450576f9d5a368bc5d348565bd0df564c3611fd64f82c4b5a11787230b91aa349e24378d8186d0f
SSDEEP 192:2nkCoCleeU8XbAeP4HbHPfO38Xey17Gsbx/jJtIQ1xUNGehsakXQiyNwmPHIFif:2k9ClWabP4Hbv7XD1V/jHIprsgNwmgIf
TLSH
T1F442BF85B159D30010500E2ADDDD207BC896C9C5C6F53D174C5FD25BA1A5E9F337AA2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 dd47222de4f2e0d408da6003bbd85ef5c39c6d1acaee4861dd9fa875c9e1f381
MD5 de2cc75d2676b06b0c47e0504f0cb5fd
SHA1 9b848b7f309fec9f00efb35c4348ce87c3af677a
SHA512 b73d98a07028bd640a6e80ccc004ae56285c9f7382560736ab39bead0632451725547d4827d6495fa0e9d90d1ca9bc4d7d66f67c4e6ea2f931b8a25a3524e84c
SSDEEP 12288:U07xfugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:pZu6W2qTxi9trwUl7eFsj
TLSH
T169452327E0AD4864E67E23F03969902C180EBC458F84C4C7B3827997987DDE19DF679B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 35ddf2013bc667b9462f9331d894577831d3e7d2e8a911625fd483a98baffa38
MD5 c0c7275af4a88b86b14632bc4272d607
SHA1 4e76b6f3fcfaf699b6095ac65acbb4aaf930f676
SHA512 f89be2f1708f5c3411ebabcf1d40545f1e33f645c6495e0cb3e64082263f73e55e04851aa06b6b935147fc25e3525e7053defc33c3b1f26976c241129f6fa712
SSDEEP 24576:4gb6bmBIi49WNNFpg1rSvFv7bYnu6W2qTxi9trwUl7eFsj:4gb4mBIBhGFUub2tkrFs
TLSH
T11265AF1E22EC02F5E0FAD2B89DA64417D6B278160731D2DF1251427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 f4864a95c8f41b3836e67a7c4f60cd8a355a022d093b3276e4f141cc1f018252
MD5 0341550a7e28b9f899fbe66db48fec02
SHA1 f64bec0717429e0cd17d817f14838ed3c3186496
SHA512 18d607151b81f4b1b2d89ebd6955c83f2562ed0c3b4c7c40c93b1477a64847a44fe966acad875e52b354a2ae08b0a195d665c42a2d7efa80359f2cd72f7caaa4
SSDEEP 24576:NG88u8FpJqH1nzria7/mku6W2qTxi9trwUl7eFsj:A7ZFPqV6a7/fub2tkrFs
TLSH
T19E850266B2E101F0D47BD13889864667F6B2B8150364EFDF07D88A521F23AE54B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 c462c85bcf410460ecfa46a1a284a8881d77dc360d8d9808d0970aba5bc89824
MD5 491ef3dae25d4bd32d344b2732a202a4
SHA1 df4c2b3035da2c0812cada62ae1eb6815f7b3e93
SHA512 abdf1924a1b9a824968e7df52fed8fed7ec24851093796c41e8b1c3dba4aa152cc071087fa7a119b6844ca82ff0235bd66e3c01d8fc5e176ba89cc43fd8db038
SSDEEP 12288:0HvUrBFrEjwaQkfugHW2eL0+xAP9UUVoCPRQSAEz4lUk6NyZafmOXFZRZudSj:0PUr+NQIu6W2qTxi9trwUl7eFsj
TLSH
T1A765E12F61EC18E4E67AA17D8982860DE771B8520711D2CF02D1917F4E67EE8BD3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 cc199a93b639cec14e970389f0d2bc1c4f7c6c9925cc871ced1c1eb066b7e43d
MD5 dcfc9e11440c5af95c1802128b9f0d20
SHA1 63faeb8c7958746218a5d09f12ec1d897253d484
SHA512 86c84724f077478e1b6b88131f14c0d71aba7f7e938716ebbfc3b64f5129bcb0c24cc78d90e2f0a1cd746f57e71b982c617629949561b81f2f2bc83abbbb9928
SSDEEP 49152:mBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjYub2tkrFs:JG05lO43blub0kr
TLSH
T158D5CF6E62EC11F8D1BBD17CDAC6460BEBB23815032556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d20e3ac921234a9a386ecd277f10967e15b3df43ab5ea139b4db879ed847327b
MD5 cfb7376fd314bc51a768c96b48152096
SHA1 33c8807fd88d229c11bdb514b633e68361f150da
SHA512 5ba010962c57de65bb27565976c8f83048caa376608e9ef8e94062c4835170dcda35e90e861f7f6d409aa41df32aa6623583878f83b409e732b25c783cd6ac75
SSDEEP 24576:cfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnmu6W2qTxi9trwUl7eFsj:Ea5POZ3hJt2pasx2+mAub2tkrFs
TLSH
T19965BF5EA6FC00D5D5B9D17DC583461AE5B1342253319BCF122182BE3F2BEE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d393eb65c06c9cea66e6b7b4a415f9b14182ed62c6e021b6aee6eb01965f6856
MD5 6d706c7e55ea6aa29e4a320aabc771c0
SHA1 3ae78e1cfcc05edcef55b6cb7f2c46be085af337
SHA512 4e0be143824bb4bbad42fd96bd6a67055d26dec4e57204bd93bf47f9f0b6446622592d0ac5bf334c4c7b4cf734b7a797d50a8f757875c8af6b34c61bcdb726ef
SSDEEP 24576:PNcwHdjbyQ4nLC18lb/EOjowL7Fksu6W2qTxi9trwUl7eFsj:PNc/zEOVHF/ub2tkrFs
TLSH
T1C1858C2662E901E4F1BBE1BE89779546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 600be125172ac1d4d35f16c7a62a811f1326bdf9abd375518eaeb4bdba59bb20
MD5 0e243db4a7bc4f8cb0297b6ac9527091
SHA1 fc70a55ca511d36c4eb97b17f28b366f778c26bd
SHA512 c06b04aa9de77cee41e18b28d18ca1e47bef3f3eb51e38d9235143122460a0cfde55c89817b437ce0203b94134c857801170945b3864e9ae926cddaf4d50f3fc
SSDEEP 24576:b3kNvNnaFeYhJNtmZBmBu6W2qTxi9trwUl7eFsj:b3MwBtOmBub2tkrFs
TLSH
T1C855AF2EB6B845E4D1FEC6B48D238516EA727861073293CB5390C13F0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 f5ec0e5c9cf749d58a10f4fd5a290ff76f0a513cdb4043582503ecb308a70ad0
MD5 1c452c27551c6016992873615df05457
SHA1 f81ff29d3f48fe4553af992645bbf37927753684
SHA512 5f592d90a80be4c56720cf9969652a59452cf4b64bfc0a780671a84860c8b828514ec7be8e43cd15b3d9b7f9a45d4eeaca9c951ad617119b77ab6ca932e69a19
SSDEEP 24576:rD3FHshBIYQgAVu6W2qTxi9trwUl7eFsj:rDVHeBIAAVub2tkrFs
TLSH
T13275E13EE69C04E4E57BD2BC9A638606E77138A9032155CB02D0D1BA1F6BEE47D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/992-51-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/992-62-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/992-58-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/992-64-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/992-52-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/1920-407-0x000001BD81910000-0x000001BD81930000-memory.dmp

Download

memory/1920-448-0x000001BD94700000-0x000001BD94720000-memory.dmp

Download

memory/1920-391-0x000001BD801E0000-0x000001BD802E0000-memory.dmp

Download

memory/1920-434-0x000001BD81C70000-0x000001BD81C90000-memory.dmp

Download

memory/1920-408-0x000001BD81E30000-0x000001BD81F30000-memory.dmp

Download

memory/2484-40-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2484-47-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2484-41-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2484-130-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2644-85-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2644-77-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2644-79-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2644-259-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2728-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2728-322-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2728-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2728-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2764-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2764-132-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2764-138-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2764-143-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2764-145-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2912-375-0x000002255AC50000-0x000002255AE1A000-memory.dmp

Download

memory/2912-598-0x000002255AA00000-0x000002255AC48000-memory.dmp

Download

memory/2912-599-0x000002255AC50000-0x000002255AE1A000-memory.dmp

Download

memory/2912-374-0x000002255AA00000-0x000002255AC48000-memory.dmp

Download

memory/2932-281-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2932-90-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3320-192-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3320-73-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3320-67-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3320-66-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3584-106-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3584-108-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3584-113-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3584-303-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3584-319-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3584-321-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3716-288-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3716-93-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3716-102-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3716-100-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3716-528-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3716-526-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4288-23-0x0000000000AB0000-0x0000000000B17000-memory.dmp

Download

memory/4288-325-0x0000000000400000-0x0000000000524000-memory.dmp

Download

memory/4288-16-0x0000000000AB0000-0x0000000000B17000-memory.dmp

Download

memory/4288-89-0x0000000000400000-0x0000000000524000-memory.dmp

Download

memory/4288-22-0x0000000000AB0000-0x0000000000B17000-memory.dmp

Download

memory/4712-118-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4712-307-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4712-120-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/4712-126-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5516-36-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5516-28-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5516-25-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5516-34-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5516-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5560-567-0x000000000D510000-0x000000000DD8B000-memory.dmp

Download

memory/5664-0-0x0000000000400000-0x0000000000524000-memory.dmp

Download

memory/5664-7-0x0000000002420000-0x0000000002487000-memory.dmp

Download

memory/5664-15-0x0000000000400000-0x0000000000524000-memory.dmp

Download

memory/5664-2-0x0000000002420000-0x0000000002487000-memory.dmp

Download

memory/5664-6-0x0000000002420000-0x0000000002487000-memory.dmp

Download