eccebd59ad72951c239849726d555b75793bb3d799bc637c611363bf80405392

Analysis

max time kernel
108s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 01:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Size 1.4MB
Sample260709-ccbl8sbw4m
SHA256 eccebd59ad72951c239849726d555b75793bb3d799bc637c611363bf80405392
MD5 b5f261d69f556ad2af458bc4e39a3035
SHA1 d27d37278857a6c327e4f7fb8cf994922ce843c7
SHA512 2b6289a2f56d86646212e2e3403735a74c9be20183d59353ec122b8c1d55825ea1715805def26dd600329f88c6486cf83259778b10a19bc13ff6dcdef1358854
SSDEEP 12288:Js5ExT3KYQJ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilk:Js+xrKHOSnnrFb4PM4MYgLxEVyGLC
TLSH
T11F65F12172E48072E5F32A3249B497A55A3EBC709E35D99F6794086E9E71BC0DD30B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence ransomware spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 11 IoCs

pid	Process
3036	elevation_service.exe
5372	elevation_service.exe
1916	maintenanceservice.exe
4184	OSE.EXE
2508	PerceptionSimulationService.exe
2288	perfhost.exe
3748	ReFsDedupSvc.exe
1536	SensorDataService.exe
6040	ssh-agent.exe
5824	AgentService.exe
3680	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2dcc5c5814575bfe.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118750\javaw.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000759b650e460fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ff85d80e460fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dbb5100e460fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009024a00d460fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a62bc70d460fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3816465931-3623202676-2955785815-1000\{7F815395-2EDA-4A22-813E-96D923B1AEEA}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3816465931-3623202676-2955785815-1000\{D792F325-21C0-41F9-8AC5-DD4C2719B8DB}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
1760	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
1760	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
1760	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
1760	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
1760	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
1760	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
1760	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
1760	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
1760	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
1760	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
1760	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
1760	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
1760	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
1760	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
1760	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
1760	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
1760	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
1760	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
1760	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
1760	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
1760	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
1760	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
1760	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
1760	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
1760	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
1760	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
1760	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
1760	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
6020	explorer.exe
6020	explorer.exe
3036	elevation_service.exe
3036	elevation_service.exe
3036	elevation_service.exe
3036	elevation_service.exe
3036	elevation_service.exe
3036	elevation_service.exe
3036	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 54 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1760	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeAssignPrimaryTokenPrivilege	5824	AgentService.exe
Token: SeBackupPrivilege	3748	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3748	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3748	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3748	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3748	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3748	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3748	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3748	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3748	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3748	ReFsDedupSvc.exe
Token: 33	3680	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3680	SearchIndexer.exe
Token: SeDebugPrivilege	1760	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	1760	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	1760	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	1760	2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeShutdownPrivilege	6020	explorer.exe
Token: SeCreatePagefilePrivilege	6020	explorer.exe
Token: SeShutdownPrivilege	6020	explorer.exe
Token: SeCreatePagefilePrivilege	6020	explorer.exe
Token: SeShutdownPrivilege	6020	explorer.exe
Token: SeCreatePagefilePrivilege	6020	explorer.exe
Token: SeShutdownPrivilege	6020	explorer.exe
Token: SeCreatePagefilePrivilege	6020	explorer.exe
Token: SeShutdownPrivilege	6020	explorer.exe
Token: SeCreatePagefilePrivilege	6020	explorer.exe
Token: SeShutdownPrivilege	6020	explorer.exe
Token: SeCreatePagefilePrivilege	6020	explorer.exe
Token: SeShutdownPrivilege	6020	explorer.exe
Token: SeCreatePagefilePrivilege	6020	explorer.exe
Token: SeShutdownPrivilege	6020	explorer.exe
Token: SeCreatePagefilePrivilege	6020	explorer.exe
Token: SeShutdownPrivilege	6020	explorer.exe
Token: SeCreatePagefilePrivilege	6020	explorer.exe
Token: SeShutdownPrivilege	6020	explorer.exe
Token: SeCreatePagefilePrivilege	6020	explorer.exe
Token: SeShutdownPrivilege	6020	explorer.exe
Token: SeCreatePagefilePrivilege	6020	explorer.exe
Token: SeShutdownPrivilege	6020	explorer.exe
Token: SeCreatePagefilePrivilege	6020	explorer.exe
Token: SeShutdownPrivilege	6020	explorer.exe
Token: SeCreatePagefilePrivilege	6020	explorer.exe
Token: SeShutdownPrivilege	6020	explorer.exe
Token: SeCreatePagefilePrivilege	6020	explorer.exe
Token: SeShutdownPrivilege	6020	explorer.exe
Token: SeCreatePagefilePrivilege	6020	explorer.exe
Token: SeShutdownPrivilege	6020	explorer.exe
Token: SeCreatePagefilePrivilege	6020	explorer.exe
Token: SeShutdownPrivilege	6020	explorer.exe
Token: SeCreatePagefilePrivilege	6020	explorer.exe
Token: SeDebugPrivilege	3036	elevation_service.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
1416	sihost.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe

Suspicious use of SendNotifyMessage 46 IoCs

pid	Process
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe
6020	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2452	StartMenuExperienceHost.exe
2660	SearchHost.exe
6020	explorer.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 3848	3680	SearchIndexer.exe	99
PID 3680 wrote to memory of 1508	3680	SearchIndexer.exe	100
PID 3680 wrote to memory of 3360	3680	SearchIndexer.exe	101
PID 3680 wrote to memory of 3932	3680	SearchIndexer.exe	102
PID 1416 wrote to memory of 6020	1416	sihost.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_b5f261d69f556ad2af458bc4e39a3035_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1760

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3036

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5372

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1916

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4184

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2508

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2288

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3748

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1536

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6040

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5824

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3848
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3816465931-3623202676-2955785815-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3816465931-3623202676-2955785815-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1508
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2892 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3360
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2592 2588 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3932
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:2980
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2892 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4728
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2592 2588 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4344

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:6020

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2660

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 bdce3487a786b25db59c0adc8b1d9dfb4c22cd4eaba8d1a476c82c472fc28304
MD5 248d8e024c0f423df170727f8543b99b
SHA1 05afbca74625ecd08ee4d245cad8ed38af6b2fba
SHA512 25485603234e87996b44c88a56fb9db638c592b03de5b494c5e484cc60ba6222042748eacd35db83777c0558a2407d60f9ad5c7e1fb1b28f1572ad2771d1da17
SSDEEP 49152:Rb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn5j4MYPVyGLW:X3q6HjBBVC
TLSH
T114D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 79d32918260d3f34f0abac61277c2d8ab8c7713a4de4133f53d1f255085308e7
MD5 00098614eb889599d837d8869aa6f3c3
SHA1 bda42aaf4fea973677577a8e17c2e7f7d77c29ef
SHA512 28eef3129f0369e335905940cf33de253c81ce172dfc26dd82c401215a9384c7489d4f19e6c1f9827af2e135d2eb9456b69b43718aafec149cb5ecaa2525946c
SSDEEP 12288:V1XLsswWkxy2lRq2czAU34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9Z:7XYfDtczAfSnnrFb4PM4MYgLxEVyGLv
TLSH
T1A165F12977E408F9DD6B8278C8A28545E733B8518760F78B03E499662F333C85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 d0e2be9f55b8818abe2bf3a82c080abc95bc696aec1326bdf997bc650a8af1b1
MD5 10c0e5547421cb635d3f21c1a85d4a3b
SHA1 9b545a9cc4ecdbff866f5957ad1290862591a86a
SHA512 f085662affa304f1adbfeffa1da8e350017514d7c40d09becd81065d99d647306ea25d7c231b55a9192665a46839d0616cc8dbd80da6a04125b6d8dd7d23c90f
SSDEEP 24576:00Le5ji0hmxirMmSnnrFb4PM4MYgLxEVyGLt:0Pji0Acqj4MYPVyGLt
TLSH
T18D859E66F6788375D073C0B9C5D2A68EE97130825B308ACB4286D77C3F676E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4a439a3fe542c3a23c2e750b30d4a1ea44620c75e980d48ecf2208360c020692
MD5 4a9c7e63b3c1a30ea845c3bdadc9aeca
SHA1 c0c544fe943f413fb0083ec62915f21df0e3a320
SHA512 94d956875530ceb3a46583d46558e870e083808d27c5bbcc99f6a30944eb8d3d8a45e31b4f2fede63d76385c194db5c678f1190addf8ff9bc97578a73b963455
SSDEEP 24576:wa7/ezSC6vUyD/aqgrvWE6q8wyukSnnrFb4PM4MYgLxEVyGLj:n/ezSC6vUzPvxHjy+j4MYPVyGLj
TLSH
T1A5755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 baa11861153e076a41a7585b8691fe83595b12a4041c47ea1955a630ba0ca6a4
MD5 06bc8c675276490a915a9721f3dc763a
SHA1 20c1625d54b38448f3e36c174a2a63b854d817ec
SHA512 4fc5604d636c114704630441ffc4988fe39e48108580c3954587d89ea2693ea6746e1305cf2274f054ab701346e0d1c810597184056a4a1c15ee1dfa6c6caeb4
SSDEEP 24576:eVbqPb88hv/l+6rSnnrFb4PM4MYgLxEVyGL/:eVO88hXl+lj4MYPVyGL/
TLSH
T15E559E66F5B48331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 321a96f3338d8ceb77904b64422cfbbdbe8bd0f59c456cfb9e06c5c20cfa837f
MD5 bd0d9d0b8c3d0e3f1e61ce8092da2c65
SHA1 c159c3e83236378c903d848fe160f0f5916401ec
SHA512 35ec8f15b11e18b322a2c8a7b477cf8c115e986f3a68b740148f468cf165c98f2dcd55d198bd34aaf3736879a5e0e9e22a642bfc6a10860db24468b8b98bb33f
SSDEEP 12288:kRl34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il9:kRiSnnrFb4PM4MYgLxEVyGLn
TLSH
T1C14523A62BDC10EACFAE15B0D1F96AC8E615BC61F875B10B6750785B3A3F20DD891313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 e1a273fc46c0b597bd6403457fe292120860e214fb770e6f82cc82b35cafcacb
MD5 1adfd0d19227cb898f116ede50e3288e
SHA1 498e26e8e897a2cdefc917a445e5078f58318d9b
SHA512 5077a47c10da29638e818828f9d4163c858d215547990315c7a2cf79e01958ee29537babdcc3447dcdc2803c1057698d7ff1b48c57541e46f4e70b2282518af3
SSDEEP 12288:8eBNUbTVO86Ug34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilv:8JIUzSnnrFb4PM4MYgLxEVyGLJ
TLSH
T1B365D03BEE28FCE2C67E4DB856918740E77278308F62A3CBD164820E9E235D55D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 149bcd8098ce33c2c76aa0d2a816b4840059ea997abc4601cba4096eb6399397
MD5 ca7b8c8271f93dd1b74100210f9fd243
SHA1 961e853b0c45ba2a352157c4da7986e4009eccee
SHA512 00b3c4ee686ffd717e8a4de0929e393ce58047676e98f0cc8d1b38ca08d868ab2b60d8b0b6fea6077d9a795398d4fc9d2231fd5dff543cf14459d78b76f6b2c1
SSDEEP 49152:lQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH:lQvGAdlCEL8c/yRNw5C0V4
TLSH
T163267C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 b781a00cd61dbee0b4f1cfe12045c5aaa6a23a6279cb6148e43a690b373695ed
MD5 eb43ba979b30bfc2f1dacd3c87ad053b
SHA1 2b868f91668f208e95cb84d0b209f612117ee634
SHA512 77e7dd8938c267f6b091234f64497bc9c6ccccaa044ae60e17125a704554eea797f32894e5d60c5fa4dba54c18689883e100ec40ca7a461453c0b8cb08c793ab
SSDEEP 12288:0AwSfxL/2Dc34DLLmt0LDQewsAjS34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAc:JdewsAjhSnnrFb4PM4MYgLxEVyGLf
TLSH
T18C75E031FE74E036C7BF0DB21B36D716542DB9204B612AC3E3A89D9E59342C22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7c658cb386232549f05eb8617217dd1aec2cb9834769c65212d59ff36af225f6
MD5 8ed83343b5a2ce39a55ccfc6a23e3f5c
SHA1 a62e23dcd53d1a198872b05750e1c0a503256472
SHA512 6bc73083123463326d574ff1b717bcbb5cd2ecb19185a75e2824cb6554460dde1c7aa87b2c7407565bed2dd19ecc4e135a040ebee9644c825c80a34203f1d1a8
SSDEEP 196608:GUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH:GUEtQevvqc2W1cpV2EI32
TLSH
T13F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 03a9a4c0895876be924e3a4f3d6afd58229457e9b0a3a45715299c009fb1720c
MD5 29b344a566e81086ccde4b7a11e4994e
SHA1 37b72bd045ce33b1ddab699ec767d7492e26751e
SHA512 0e719e675edc76518f4e24c2cec7e03a07bc27b14a72359e706bbf5c3111605171abaa5f10964e07aa2ce40388c1bfde35b253e2409888ddf8540db5d945377d
SSDEEP 49152:DCbRquA/m2yL5zQfFiV+XenmE3/z6j4MYPVyGLY:8oqtVjnmYVU
TLSH
T1D8D58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 af8abd33974270bfd02c98b4a02ee663ace7d7583328fada66ee1b859806e615
MD5 3038e4311caf2e1aaa6c60c79b08da45
SHA1 82e62373cdf68eda3b3610a5067b35e01f384daf
SHA512 51d42dac5f5deb5b777ca23e381ec1272d8ee91efc703e4c675056df938b84440e2a5cd580c376513e6aebd5a6d1a778bcb5fada48f29db67cbeadbbed07eb33
SSDEEP 24576:kAhGLJIFoiwtA5l7S53ISnnrFb4PM4MYgLxEVyGLv:kAMyFoiq5rj4MYPVyGLv
TLSH
T15235AD81EBF955D4F5B3AAB899B68170EA76BCA65E31D20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 b31da9441b2e65bb1e50cd979adc9c1dd0a132eb15c61743b9635e27ce148d55
MD5 3b0f3dc734570bc2f4b8630ed641e528
SHA1 322636610a73320b917556fd6932515f78dadf08
SHA512 5b2fc451ff84eb7ca288df4582e886cdc8ef2602dc1a15a3bb5eee3fcae5926eb460dbad91193d0c738558366709b2c9ba4d33e0c2e7fabfb3408cb76b8f3baf
SSDEEP 12288:Dmw5HEjsChNVBFgl0WDm+CL34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqv:CwuoOWFSnnrFb4PM4MYgLxEVyGL1
TLSH
T13A65F04637E81CF9EAA74238C5978535F7B2BC122A21D71F1760C65B6F37311AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 21da2659d00e0c39e04038c08409d23073916aa5628a46fc7fa16426542faa7d
MD5 75f9e20d43bf1b7baeeefea91ba68b68
SHA1 90353cdc825f8ad51d6c93b656e2f812e83b6183
SHA512 3c1418bd84a3ddff8c8ba3e54381c5317cf26e180a08e3f3acdcd892e6fc98367586b72de5d5abdfe3b2ee71085f20c4ed7574a020091a675c74dd9379a91232
SSDEEP 12288:ZBZ1IyC34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilc:3ZuOSnnrFb4PM4MYgLxEVyGLK
TLSH
T18355129A37E820FACAAB4274C4F55688E3327862B77293CF1750655A3F37AC55C35322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 873f0119d1d38021544e784a5fe7f272b8751321f24008c53f5aabe199ad65b7
MD5 f59603d759b662e55e0b20b0a5ea4096
SHA1 1e39ac482b6c6d11bdd7b5a4cd878c58f6eca7cd
SHA512 f5e4ec4b5c82ff8de13cfec86b9270876faa3aa8847e18c79dc95477d229294af9b19512785357e1654ec782d379e5795da699f63659fd2b146c136cded885b0
SSDEEP 49152:+j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U1:NQRQyi36YOcPQLvw2gAf+PN39Vp
TLSH
T12E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 1223be917d29627fc576e7a96ef7cef1bff7d5d18fbc987c7ab3dbf7ecfce831
MD5 1a37ab5ec4d41fe773ebc4a8cb7a76d4
SHA1 631b186b4daec504cd22504d17f1d0eb6efdee27
SHA512 aa8016a5d40120f1083468a4ee4f47430551c4ec43eed34b8fc1a159ba1bd26127083110a26270dbcff6d8df2b5c0b6a513d6aa7fc0aaa16f66a0c87ff770a73
SSDEEP 49152:6j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UB:ZQRQyi36YOcPQLvw2gAf+PN39VN
TLSH
T137667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a5331a62404f8e35162a095a761b1546c202c4fe0795f6eba5217423e60d1151
MD5 1cce642be06fc9178fcf521f59f3c942
SHA1 f89e4b596d7e3a51ed59520d8ec81d95dafb15c9
SHA512 f9fab6ecaa06626c5b51888082f53bd64c9cd8d44baf4cede711ba3ce6ac5c9ae5258ceb1a40f19baa85a94085d453507d8c7fc7b6890b3bcd424449728e3766
SSDEEP 24576:cwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0eSnnrFb4PM4MYgg:i68Qg55nhheWu7PNU3/qj4MYPVyGL7
TLSH
T180B54A33B2F600A9C44DE1769F4A972196D27C71CFE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e6d7a0d9cec3f509e30cfb103537c66cf944c90cf1ff3d9b3b96336eb86a5fe0
MD5 c026c9d50c91d5a91ddeab9d826cc31b
SHA1 e9bd4a80b96fc8e62047319e2d2408bbd3b60a2a
SHA512 eb463f5dc92477314dcd8472908190157f3518dfab937f8cb123fdaeccdeef4e4d49089a6ba242a1f053f9e3d8fb951243dcd06fd5237c0cccac4cee7e7bb32a
SSDEEP 49152:C3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99N:Dy5112gYy5azzVvL69nLKnhZmVz
TLSH
T143167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 60b0291be9cc629631b5964d414c1cae26a01080aeb022b837d93d5ace14038b
MD5 551ff24549505ad88be93942bfd23c68
SHA1 c356033a6f45e6dda09fdbfa952161db60da4087
SHA512 1bcd0bf44b2f6847726cb98420960630f44bd73d5863729dfe752d3fb8113a8459fb961fa076dcdb41bd2d6152c4756a80473991a0a994a60530c017b2b50064
SSDEEP 49152:1B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glIj4MYPVyGLB:7u6JmVxd2d1Vl
TLSH
T11BD59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 57f8a7c7c85db7e86e9b70cbd42cc1558926416458a23165203fd404e0ae32e7
MD5 77ffb1686d8ab6d43d9098bb0817514c
SHA1 cf0dd8e09607cd7e38c6fcd3966ac07cf1666e1c
SHA512 b6cbb1f4bfb23d4bc1524ec627a27e4933d65a9fac04ac760bcdda57ea83cb7c702b22d9a18d280deafbf14e74baa6cd0b471b20d6236ebcf9bc8f92a353f071
SSDEEP 49152:91hpsNoJpF1A6UU44CwH7R4xcj4MYPVyGL0:9mifPbRYVg
TLSH
T165B5BE13F2D900E8D06DD17887569232EA62BC460B34B6DF0A90B7962F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8537747e1b4d5f935c3d966d3d7a2491eec99984153893d46e6a1205227c4bd1
MD5 7a793f9c860a6ee7ffb160945557868d
SHA1 b0ef46970a553d94003eec00563cbd1706998c91
SHA512 06661fb044cda89546f9ffcf06f012bbc3b552bc1ca63f7e23d2155153d268cda5f6add90414c47b4359f39c715cb5aa2750535be73076d34baee3b074bb540a
SSDEEP 49152:6SuZQIY0Be2KRRVtOnks6NMHqpj4MYPVyGLj:k5dKTi61yVX
TLSH
T113C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8000e692c607230d9886d7036443709b0152936bf3ee39eeb3508e1c2a5c5144
MD5 f610ca803a2f495cf9eb916480d633ac
SHA1 f2dbfa8853d2e33acd75e0f8d81ca64eb63af454
SHA512 f16d7e7f94ee7b4d9c58614ccf2f2d7bf74d1c16b1816bd1bd547bb6b9ed2ae3b66961f6ab0f584e79db661426bfb2ee655121bab4c0e00eb8bed435b639144f
SSDEEP 49152:BhtSn8EApI0figngiDn0AP5w4j4MYPVyGLw:QX2iyphcV8
TLSH
T17D95BE13F2D900E8D06ED174C7568632EA62BC160B35B6EF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 ba489518115a2bc54b9dd1a8d809001939c54daa4e9001fa6d8e0b7b8cfa0b79
MD5 39bc633e5a9699af7a343bb6690dcea7
SHA1 da6c2821396df42c790bdd660553e4359725c54c
SHA512 c02b64c9d1570c50603725b89f9acfa9ebed2590b7bfc46009a3c6625430044f52cd5127958ba36c881c89e78d0b1b05510bf65facd37643d5eb83a47bf722b6
SSDEEP 12288:Qt34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilx:QqSnnrFb4PM4MYgLxEVyGLb
TLSH
T1B94523A62EDD10EFCF6D16F0C1A566C8E2097C62F976B20F7B4574173B3B20D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 8a68fa506a60db2ff76bd4ac72a25bdce0715f8bfa8b4531f48439ccbe88379f
MD5 d05299ec893126bef799087c6694c9e0
SHA1 75b439580423e70bf24f934c08fbff49bc4c0982
SHA512 33c5334ac21f918ce35b3d402f373d3a1aa05a2f1c1d0b9cc47a2442425910c73b5e03b64a66a8a16ea0d8ec8b67c0d72496812fa93598d76fb58f875b75086f
SSDEEP 12288:dm34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilZ:ddSnnrFb4PM4MYgLxEVyGLP
TLSH
T10B4523A62EDD10EFCF5D16F0C1A566C8E2097C62F976B20B7B4474073B3B60D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 d67738d3ce65dc593abd0433d117b9bf73da1f492e9d5ad2031ea1f211736e25
MD5 a7ed1c0a51725dad5ad7a6f8e2e67605
SHA1 daa700c83e85ccadb783605efe52aec901f29dfc
SHA512 f3cda9e51d3b4789eeaed40f26f18f1c6e398d40d49f899ae3f479d9b466bef26a77a8a3b13c99fbcbcc13f53ca822a345e9a271d70bfb1efd55c3501c11f7cc
SSDEEP 12288:Ro34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilg:R7SnnrFb4PM4MYgLxEVyGLO
TLSH
T12A4523A62EDD10EFCF5D16F0C1A566C8E2097C63F976B20F7B8574063B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 173080f570efe621ac0fe751b46abf37aab78bd5b6871c1d031d3fe1707e0d57
MD5 783a20c8cd65736e9629e62b596e0e58
SHA1 5a4bd812ec5885418be26ea6203d09bd03c3221c
SHA512 8b57f3e5ed503d1343a1b60ab0b7d13b27a20e0b253b5d7e9dc7d9a0b7675088dca1abfe5bb4f40a9a19c09c3e81f02b380bcbf9e6318fd13f5fa531e6fa3051
SSDEEP 12288:kVn34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il9:3SnnrFb4PM4MYgLxEVyGL/
TLSH
T1F74523662BDD10DACE6A96B0C1B556C8E225BC61FA72B35F6740381B3F37348AC71711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 07188b96ea10e335b81e5ff7819374826c74d9afa4ef653c41b9d36329aacd2e
MD5 62b26055b21d3649a480bee182e5dfb1
SHA1 63bc6a4c6ebf0b4cc67ae7e44382fc55fa7d45f4
SHA512 3957092004d49a92509c05709b35ee6fb1e2ab042c9c5b14b798f8fcb58421fd810f9a1a07259646262c070436faa20722266477c18bdbf771c32e5ee4d367ee
SSDEEP 12288:Hf34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilN:HgSnnrFb4PM4MYgLxEVyGLL
TLSH
T1A84523A62EDD10EFCF5D16F0C1A666C8E2097C63F976B20F7B4574063B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 4351d8ed37f0b0856e721fd1b020efb19e5da63d875143d4981bcc44caded745
MD5 4de5772265fa223f703a03386a8d94d0
SHA1 63a6a097fb1b6f70f6594d8f980cb494c85b3bf6
SHA512 94e9c17eac6ae7381b2b97bc5658120719d1cd4611a9e3980cd756e53f306b0ebfd422539712d5c52579fac1957fafc2e2ff540fa04ca29f20ad219d250c3d42
SSDEEP 12288:j634XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilX:jpSnnrFb4PM4MYgLxEVyGLZ
TLSH
T1AA4523A62EDD10EFCF6D16F0C1A566C8E2097C62F976B20B7B4574073B3B60D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 49938159f872abfd48a63060ca4044dc8ae94ed73358a5f4037f4262cb07c57e
MD5 f40b4880182ecb28f7546597384d32b7
SHA1 7eb507101bd995a53cfc68d4f307a8189883fd4e
SHA512 d4f8bb9a82d7fef749a63e1433dea76c47525612a709f13253bd4e8522cdaa20250356811addf5424c98223dc2c362e330196698d8cff773ede5c3ba13bb4224
SSDEEP 12288:Be34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il7:BVSnnrFb4PM4MYgLxEVyGL9
TLSH
T1464523A62EDD10EFCF6D06F0C1A566C8E2097C62F976B20F7B4574173B3B20D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 16e4494d7f3f519ca805d06fbd8ed9a77250ae88c01257417ad2af9c1e10d9a2
MD5 83670b21059d1049d7827845c5fafe68
SHA1 b00fa0faa4dc5be722efe9a7b7ed61881904b1e2
SHA512 7a52f44a3efab7c6dd879aae384c9122a23ff9ef5119a4e75f5cdf63be8924ea17cb848b42e30cb421a1910196880164b19071263f52ef6899709f5e9a311357
SSDEEP 12288:biZwb6zzFEoS2cPvyG34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2:GZMSzFVSO9SnnrFb4PM4MYgLxEVyGLV
TLSH
T1AA6502A5739018F9DD67823EC9658945E2B27C265B70C61F13E4362B2F333911C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 615f4d2be5d33de7475fe4b6ba5b770d8bcfdf165ee84055b11cfd0f1db6c528
MD5 a669fa99fb1afb1edd08c51c4a71fbb2
SHA1 1c0a012d4ca10b892e5b438910a92a7ed9d07cd3
SHA512 8974baf2c64d5a823868e484f06050fe0b3ed9b602d99680b71b07c922bedf9c31a6604c9c3716bf45b3d83432a8d0b37be75526865a68437c90a911df750668
SSDEEP 12288:Y534XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilC:Y+SnnrFb4PM4MYgLxEVyGLU
TLSH
T1394523A62EDD10EECF6D06F0C1A566C8E2097C63F976B20F7B4574073B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 912d4cf0bc9499ce2f39988b97cf4f8bd3d9e02b3cfd502ec7422b08d708a62a
MD5 7d009f862e63611ab75d1987240de1ac
SHA1 52c2c79e9816fce6fd1c7d074ae79303d2225561
SHA512 5ca6851fc615cd9cd5616f4de352cdcb2d3a541023b12184fe6ba17bf3e96517f8eec7b64747075464ab2648cb13528ca15de587a16d4b3dc64c0b84c21e1059
SSDEEP 12288:MV34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilE:MSSnnrFb4PM4MYgLxEVyGLi
TLSH
T1444523A62EDD10EECF6D16F0C1A566C8E209BC63F976B20B7B4574073B3B60D5891722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 f35574d5936c1e0a5bbce1519f50ed5390475531a8b0b58b113f586249ac1bec
MD5 80d5fc5617cdada669c78a56fc72537e
SHA1 8e8d42cee81ae51b39d2e6867dc8444f26d993de
SHA512 baf25c705bbed6bf5f8ef7beabfffd17b45c79c86383c27f5fb0e8348e25092e63c836357607f3c05cf87e28f9a1d79f44b55ba90a28c6f0d201501e63d642b8
SSDEEP 12288:OyPz5L8C34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilA:TzyRSnnrFb4PM4MYgLxEVyGLW
TLSH
T1B455025737A530FDC67A8274C4A21A45F336B8329B309A6F279016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 85c4560a80623c63556077bedb6665fd1aa0cf15c98f4793f9cf6b75956629be
MD5 c5cb76554e5c1a7a5bc8f4bd577b204a
SHA1 23b7e5ed532ccbaf97c6753b09af8adc056266d6
SHA512 ccf03395fecd65f579868b4041eb65d31eba02a0f3cf96d766658e077267547b70c3a0bd0fd0f35aed919191d33cd3857c67b0cfb0a9325caf66148204166e4e
SSDEEP 12288:W534XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il7:W+SnnrFb4PM4MYgLxEVyGLl
TLSH
T1774523A62EDD10EECF6D16F0C1A566CCE2097C63F976B20F7B4574063B3B60D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 de79238d3f28448f52a5605ec292a3de5a33b0d09574a136a829f50ca5f4dbcb
MD5 4a24fa565be6640d7aa61a08f86d8eda
SHA1 1e6eb0e6dc420d273c4a0b99972684753ed65a3f
SHA512 874aca5bdc32ff4a8e853ecad4abcfc3ff7449571bc8c41459b99624d7348b4bd78d6f37a33093b470920752136bee00cde8835d7607311949a1cbf3ab27723e
SSDEEP 12288:w534XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilv:w+SnnrFb4PM4MYgLxEVyGLd
TLSH
T1A54523A63EDD10EECF6D06F0C1A566C8E2097C63F976B20F7B4574063B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 25299a7f4a73d20d38330e9fba05afae7db6ec540708425c24f41e3e39621d60
MD5 9e509f29d44280f9c8b57a564616f195
SHA1 fad3117f9e089d34a0a1a82a3995667a65452667
SHA512 ac325081f1c3b842998abb6f59000bcf41e86488ded1bcaff7f773af4e77c8f121b90001f2fd795c4c66720ff9ed0722599595589ee30a44b76bd9bdc87b3417
SSDEEP 12288:lyPz5L8C34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilJ:szyRSnnrFb4PM4MYgLxEVyGL7
TLSH
T10755025737A530FDC67A8274C4A21A45F336B8329B309A6F279016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 2f3dd2ecd2f30967259075425c73ed02774a73b695976a3834da7903c48faca6
MD5 ed4ac5bf919646d9733bdb5004b789f6
SHA1 7e5bb5f48fa96cfc123cef5368f1e5623592e1e8
SHA512 bae826b0c07f9f60e5d9232f8a1c9d0edcb808c97771fade32779d5ca0354cb1c11e2c6639fcf234284ecece61db7a79a7942ea25dc874839903fa4f5efa47db
SSDEEP 24576:dTHaLl3z0zDLSnnrFb4PM4MYgLxEVyGLW:dT6LljXj4MYPVyGLW
TLSH
T19D6502A5B39018F8DD67827AC9658946D2B27C265B70C71F13E4362B2F333911C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 0b02c76eb5eed34770785d3bb3a59a500b23726a6d8a4027c5639b239ca0ba48
MD5 d20429e23b19714cadb6eb217c02f30f
SHA1 4d650f8177b4d8fa5e882e0719a965892e84bb44
SHA512 cbf65000482981f420156d2be183cb346f81d3adc06d0c9716c02824530eefb4c97b47ec93b4c830fb6f5d5a5ffe04d773a27841b77088059284f9d9d7f6ca9c
SSDEEP 24576:N37d9CHKy7GZHSnnrFb4PM4MYgLxEVyGLg:t7d9CHKyaSj4MYPVyGLg
TLSH
T16675DF90F3E810E8F1B79A35C9765501DA767C6A5B31DA8F03A4251A2F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 b1c0798e7b9e3214fb1a4797ae40d02d2c520606e82327bd815f1495855171c8
MD5 238e64927c8b6cee558a77b14c0e6e94
SHA1 85254280072dba3a01ba4ecc868fbe876357b296
SHA512 1ec910db6a58e2c7fa1714f3ad2e6031a5acb4dce588f266352dc3009f3385e1a74ce05ea4c3de1253727ae1ec46518283b0f873b9a4822bc9cb50c9b09f929d
SSDEEP 12288:YI34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilD:YbSnnrFb4PM4MYgLxEVyGLJ
TLSH
T18A4523A62EDD10EECF5D16F0C1A566C8E2097C63F976B20F7B4574063B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 d8cab0e9fdb095419600c21a8a01ac968b424cc73107ff3d1c4654144102c19c
MD5 5a1d08736660288c501924316be4c93d
SHA1 5124d640e2a00ff53ac5b398d6a79b65aed2f630
SHA512 b7764f57aeb816c418cab5125f52ec8332d5d54a6497e9741c999b875917aaad9a069129d0c43c3acc97b85289ea2f14c374c707937d9474ba75f4a8936cf56e
SSDEEP 12288:5i34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilL:5xSnnrFb4PM4MYgLxEVyGL9
TLSH
T11A4523A62EDC10EFCF6D16F0C1A956C8E2057C62F976B20B7B8574173B3B60D9891722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 6acdfcdaed7d965d8dd819d918b61a9185f630cd41a9d0fa606a101aa2f13ebe
MD5 6099b2c1991af92a5f1db52a23f6cd5b
SHA1 6105f9bfb31c294971d8611d7718e51ccde28820
SHA512 39ab6dd2ecb500091e185eb68d83a06b21637205b809b58b32e33c9ece6dfe99f2fc721dc7ebe1ac17f718ea3922130809c8f4d8041196552a234a6dfda695f4
SSDEEP 12288:gj34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilJ:g8SnnrFb4PM4MYgLxEVyGLD
TLSH
T1654523A63EDD10EECF5D06F0C1A566C8E6097C63F9B6B20F7B8574063B3B60D5891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 80786cf337d2b1f3e0a4ab07d1f6f6ebd0c9e011c780fdba8b0cd0fc5caaacc5
MD5 9ef647a37f63fd8745adfd2b3cf0e668
SHA1 e025da2de6e07091fa861c2fc126da23acd71546
SHA512 266056b0190f4747b1914775c15f18a1320b8e890503c2755b2fb8d3250202775ed5d821d6da3761fb5cd844a39150197bfdc292456330e56ff48e46f9b83323
SSDEEP 12288:i534XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ila:i+SnnrFb4PM4MYgLxEVyGLI
TLSH
T1A34523A63EDD10EECF6D16F0C1A566C8E2097C63F976B20F7B4574063B3B60D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 2439a55b975018ba923d1143c846b3d2add48596653409f81381f2e57383b417
MD5 9bb69655519b487ed88fbd73731c7d3c
SHA1 9979673f063d2bdfc3dac6c8b1020b36075895a1
SHA512 b4a664ac45bbd2d6b7eca62c3155e1b71b256f149eef6729b72327c1fa037fbdfb8f672375168a74d622b4c283c15fb0d6f42f252bf60f37c0cf0190be1c6221
SSDEEP 12288:eI34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il8:ebSnnrFb4PM4MYgLxEVyGL+
TLSH
T18A4523A62EDD10EFCF5D16F0C1A566C8E2097C63F976B20F7B8574063B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 889d81636a2bfdd625599abbcac81190fa0e3d3774480fe19aabd1fbb65e17f6
MD5 52a255de43b729c496fece62b5d0202d
SHA1 52086792d05ae905fe9cd0c2aa8cf50fa630d977
SHA512 f6c51638c6ce125529f410fe52c7168c6ac7613d589dffcd901c6787e5685cc1db98ea6fe2766697ef0ca8fac3eedd94b37283aac5062770aca3730f63f61050
SSDEEP 12288:5x34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilw:52SnnrFb4PM4MYgLxEVyGLm
TLSH
T1284523A63EDD10EECF5D16F0C1A566C8E6097C62F9B6B20F7B4574073B3B20D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 b476a22775e2140b2e768f09fc39c8f4cd7e0cfcb3818fc7412559bf894b8253
MD5 a1c12ab552f7682856072cde639f49f3
SHA1 88a5e1ff7292c6754371ccc13a143f23afbbe8af
SHA512 5368c2ca4b931d0885691f0e29bd8f2f510d2670827552883859b6578c01c8cf85c4c866d9ef8e40a80652c3fd28a349c139697c3ae55aedbc7893efa66dde18
SSDEEP 12288:Zf34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il5:ZgSnnrFb4PM4MYgLxEVyGLj
TLSH
T1364523A62EDD10EFCF5D16F0C1A566C8E2097C63F976B20F7B8574063B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 45d725b394573938e80775c04606903bd94d88600f9695676a3d1cef11e26375
MD5 85438ce129f4078fef8b7cabaef41a83
SHA1 ecbe4db3d3c2d829253f7ef45eed11d0ece6aa5a
SHA512 66fc9e77b9cf53f0418ce9a3742943d249f47e374be8c51ce5ccf522e7cc970f9598ab0e4f6ef168a78c1fb02cf397b1a11e92e19ec37f9de7e8c55aed4e01b8
SSDEEP 24576:nfwvok9RX6wkyAICSnnrFb4PM4MYgLxEVyGL+:hMnYI9j4MYPVyGL+
TLSH
T14F85D029EBDC04E5E1B7923C89B3460AF2B178695B31C2CF129A536E1E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 80478c4e7135b20f1ebbc22930e89f53869b4b5326c0b817bdf4074fc9adfcca
MD5 de5fed17ffa1a01c7cf67ddea400e25c
SHA1 f18793dde28ed143daabaac132289bc4afb8ab9e
SHA512 4d3b1ce91e1ce6e84cbca1ffe3e3dd3819c23979d925017a8a7fb50d807b623d370ce8f6f1312370921edc420da189a6519ee456d72143036e98f20e5345f8a0
SSDEEP 49152:QYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Yj4MYPVyGLc:+ySzPdVo
TLSH
T1D6066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 76a9160681de0a295967142cd1bc9f0770ff63c5cec80e5cec5b318944819795
MD5 45f88dbf8df865940bb4b398f1efd7e8
SHA1 f518b4eca8dd28e32b24b9e1b843b8fcc2a4f0a3
SHA512 93a6f0acf4325f9abfbd0d2b09b01da8b3ee2d127a4ab860ee20d80c2e9b081bcad974cf68eaef534d714c84bd9fdfc86a2408b0c221bcb8f675dfc4a92f72c3
SSDEEP 24576:j47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYtSnnrFb4PM4MYgLxEVyGL6:j47JUQj1irIhCnDHUPfF/Ij4MYPVyGL6
TLSH
T16865BE1EA3EC01E5E1BA827885154A5AEA71742E5F31CACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 7462409385066fe192ba7d5a9f6648e59a828638f7c6049aade8d3fda9630017
MD5 a15c918dec9541720202af5f9422a293
SHA1 0736ba79c63577421e2a761d5367e10ca3cc8bd0
SHA512 2c32b782c1daa145aa007da9314ea374bbe4a7b51df64ebf962d96863948cd3ec1cb2b73cb54fb0f66ff16628fac9a8019df2b7e5937f0e29096100c446dcfbd
SSDEEP 12288:6NsfJ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilV:zOSnnrFb4PM4MYgLxEVyGL7
TLSH
T1CE55F15AD29801E9C56E6271C3565A84F3237C21A7E1E3CB67C0F43E2F366849DEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 980KB
SHA256 39ed817556b8c20c0331a30da3bda3bfa1db318dbf4e317961ebe1ddfa3f8c34
MD5 7a992de60cce96f603e62bebe91fb588
SHA1 b2dedb788e618d6fa5d2d585d1c094ea12975214
SHA512 7ec605ea14807c5d1724d3de9880f5471e1200cf206f3a3295640b8957e074c3e1b6fc18072740d7ba3dd87cd0fab6fea84deeacb1060e8097d611862457ae89
SSDEEP 6144:HXsBC2naneQ6AlVn7SMotMxWfb5U3ftkGpBUBCvFH4IpnuGRQJaIRZ/NcNxjrfa5:It82U3fnb9uGX4ZVcNdrfaVP/v
TLSH
T1842505007666C75FC6AD40725E32D1CCAB707D42EE44AB0772C98B3FC576658BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 ecd89f03e26d1957ae2cba93f43a1fc61b6ae5173fa267acafac54143b19d3c7
MD5 9a0ae07cf1a70d788963acbf7c150a83
SHA1 65a9b33fdea162c3e7c054aa66fa43c447c543d8
SHA512 18ae290f7ae6502d7a966e90ca1b152d507406fa0cae230d2571da86566aca54e9700d3ebafeb1c0e3a944a8526f54227281f334be6af979d09e30e11058d6b7
SSDEEP 6144:78R2nteiqRPPXMsh0FsQvgi9NSQtMxiSQtMxXksdRl+MU7QXKYYwZqhiJHhq6:C4Jq+VwsYJHk6
TLSH
T1EB65D8405537A38FD6BA6072132A9B4C6774AC47B749AF26B3CC493AD82A71570F83C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 595B
SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
MD5 4454c8e578515db43fadd90604ae7675
SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
TLSH
T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 fd45bf3d0f4bcce3cf233e33024118b2a959679bcc59f9ea3a13fe66b7854735
MD5 062c11978f04836a23c7fb946269a204
SHA1 5ad1754fab11d3949406f2d191bbc4cf3fd0e822
SHA512 ff26ecd7bf014011e0e42e0e2aa1ba6aef60e20d67535c0529da146d29c52a947f3548a58b707ac1338d1d1c3c6eed1526b17e18a25d0f23c8809dcf0cad3fe8
SSDEEP 12288:SM7B34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilT:vGSnnrFb4PM4MYgLxEVyGL1
TLSH
T1E44523722BDC14DADE7D16B080A95698B209BC61FF61F18BB740744A3A3B6CC9CB1717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 2a133e3fd4b070f8497058a9314ef0639babc9d3d19d032af1ab7274a85f4931
MD5 7765b0dd770ea87f403a361b1f1c1aa0
SHA1 4d25236ef0a98ba7165b6b2b2708c533f4f2f59c
SHA512 38ab43068a9360977ccd4df9a069fb2a3af14fa92e6c5abc69a990b014d2de0a16e5614d6f124aa51ae90f39a9d5f326399f978586868f2f80a5b4411cf004e4
SSDEEP 24576:5gb6bmBIi49WNNFpg1rSvFv7bYkSnnrFb4PM4MYgLxEVyGLZ:5gb4mBIBhGFGj4MYPVyGLZ
TLSH
T1A065AE1E22EC02F5E0F9D2B8CDAA4417D6B278165731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 e01ba354f7b46834888f7d27c7fd8d78ea1cfd1f259dacfeca1e2a1878664604
MD5 f14f5662d0d77a4679b5a1f5462df455
SHA1 56c07fa4f725ec77fad8433886a922b17bd0b5af
SHA512 49284b4fd384b00d9557789fdbcce7cb8d625e122cec606a899f0c2af0c1ef05dfd03f1f7b3fee29ef202c7701ce28bffeb8a2dede3886f4f6573a7558a57968
SSDEEP 24576:XG88u8FpJqH1bzria7/m9SnnrFb4PM4MYgLxEVyGL6:W7ZFPqVea7/Pj4MYPVyGL6
TLSH
T16C85016577E001F1D47BD138C98646A3F672B8211364FBDF07A88A522F23AD54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 8c657dd7cdd04aa884948f8693ef6d3f5cfe2734e349f7520e78934a43dde6b2
MD5 0ae01cd83f5fec9596467d487acb904a
SHA1 5c273f11754972947a03474177e5c6b47b374b77
SHA512 338f43e8df79221fe780b83863d5f6a33399c7a7613244ab12ec9461b3726de38d21e73500f1c3db71d98b04414e30b352cb421c73136ce0bcb6a9896409f405
SSDEEP 12288:CHvUrBFrEjwaQq34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilg:CPUr+NQZSnnrFb4PM4MYgLxEVyGL+
TLSH
T1CE65E12F26EC18E5E67AA1788586474DF771B8625712E2CF02D0817E1F27ED8BC39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 57b57f97746340efd4b3867d5a7db08c7bbf2597553940473da28eef4dfd3b67
MD5 44434a0b704910e3d4741685a314d8f7
SHA1 9cd455cd84ffb9d098c0c38b4fbf89b0f560fab2
SHA512 30c27ca4808f3e6860fd965a054a5a5cdb0fc05353c8376cc94c6b2e4c2f5d54c0accff3e840414593b7922d9acf3b9e05cd4b246316207739a47a4ee4926d15
SSDEEP 49152:lBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjij4MYPVyGL+:uG05lO43bOVK
TLSH
T1C7D5CF6A62EC11F9D1BBD17CC9C6460BEBB23815033556CF02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f4d2756df5b169cd4884e8de67377c53840a4ae15288d242bfa6a0a8047d2662
MD5 e04f75b21c16dbee98f2833c01c8a69a
SHA1 7cde469cd6dbc1ae2acc7668297623e8bab01f2d
SHA512 3f6b6e4f0ab0da830597227186e47113f6a400b05b53212a773c4a8c866d835d0904d5e58392f0b44a3314783df900663ce4593915febd4854b25f6c0f8f6266
SSDEEP 24576:Bfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn/SnnrFb4PM4MYgLxEVyGLY:Ba5POZ3+Jt2pasx2+mqj4MYPVyGLY
TLSH
T12B65AF5EA6FC01D5D5B9D17CC583861AF5B1342253329BCB122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 6e190c7fd6602abd64390a7b1bd254f087b498bccb3bb8805c7dad5cab8ad799
MD5 092b22344bff0522bb42d80973be05b0
SHA1 6bcd3546e06c2f8a9f6cc03fe5c1f2a2b5f89ff7
SHA512 a2886d4ef889634d2fcb6edf08aba19b74afedc29cf370442c4c009e31fefeee808ffaa9a05f50e0243b61321e4f983de7493a56424ccd7e7f4c0fecaf248cc7
SSDEEP 24576:TNcwHdjbyQ4nLC18lb/EOjowL7FklSnnrFb4PM4MYgLxEVyGLq:TNc/zEOVHFvj4MYPVyGLq
TLSH
T1BB858B2623E901E4E5BBE1BE89779646FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 14a55c9f307439a54953a467e6025339d8c275d95981ed6af7dd0d7970aff4d5
MD5 2556137aeb78c15bae78514a190bd106
SHA1 b1f34d8f1af3e1b933b980a30ef3ddd93fbd40de
SHA512 50388f0778d5019964c9629c83b03011d0e325de62f6f83d9bbb0c27f92a915ee2ee5489ff8834040dc2fce3f9f0bb29cebdedf2f055844dbf22976d62bc9137
SSDEEP 24576:88kNvNnaFeYhJNtmZBmjSnnrFb4PM4MYgLxEVyGLj:88MwBtOmsj4MYPVyGLj
TLSH
T16E559E6EBAF806E4D1FEC6B4CD238512E6727461173292CB5290C13F1E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 2eed13c3114528d871cc1fb780e8580d99b1f870bb3bd130eafd17ed65385036
MD5 081c57e61553ac6e82e4706a6109de4b
SHA1 dbffa232f33170cef3375608c542abfe44481e2c
SHA512 79d5af5379a1b3d8b1f77da1562a89c87d1ac9a40011ecff889927c01e5e7a30552a4fda8a7e0c7c83c74393f82b86772b8134d2dbcb45719127de10af5e63f5
SSDEEP 24576:LD3FHshBIYQgAKSnnrFb4PM4MYgLxEVyGLl:LDVHeBIAAFj4MYPVyGLl
TLSH
T15175E17EEA9C04E4D57BD1BCC6638A06E77138A9033266CB12D491B61F2BED46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1536-107-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1536-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1536-312-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1536-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1536-101-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1536-296-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1760-508-0x0000000000400000-0x0000000000610000-memory.dmp

Download

memory/1760-76-0x0000000000400000-0x0000000000610000-memory.dmp

Download

memory/1760-7-0x0000000000C10000-0x0000000000C77000-memory.dmp

Download

memory/1760-0-0x0000000000400000-0x0000000000610000-memory.dmp

Download

memory/1760-1-0x0000000000C10000-0x0000000000C77000-memory.dmp

Download

memory/1760-6-0x0000000000C10000-0x0000000000C77000-memory.dmp

Download

memory/1916-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1916-45-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/1916-61-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1916-39-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/1916-51-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/2288-77-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2288-83-0x0000000000A40000-0x0000000000AA7000-memory.dmp

Download

memory/2288-78-0x0000000000A40000-0x0000000000AA7000-memory.dmp

Download

memory/2288-269-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2508-66-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/2508-233-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2508-72-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/2508-64-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2660-356-0x0000026A03A10000-0x0000026A03A30000-memory.dmp

Download

memory/2660-354-0x0000026A03E30000-0x0000026A03F30000-memory.dmp

Download

memory/2660-379-0x0000026A04200000-0x0000026A04220000-memory.dmp

Download

memory/2660-343-0x0000026A001E0000-0x0000026A002E0000-memory.dmp

Download

memory/2660-353-0x0000026A03B70000-0x0000026A03B90000-memory.dmp

Download

memory/2660-345-0x0000026A001E0000-0x0000026A002E0000-memory.dmp

Download

memory/2660-344-0x0000026A001E0000-0x0000026A002E0000-memory.dmp

Download

memory/3036-21-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3036-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3036-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3036-14-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3036-20-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3680-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3680-149-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3680-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3680-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3748-94-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3748-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3748-327-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3748-88-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3748-281-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3748-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3848-577-0x00007FFEEA470000-0x00007FFEEAB66000-memory.dmp

Download

memory/3848-572-0x00007FFED81B0000-0x00007FFED8274000-memory.dmp

Download

memory/3848-575-0x00007FFEE1C20000-0x00007FFEE1D88000-memory.dmp

Download

memory/3848-574-0x00007FFEC9C40000-0x00007FFEC9CEE000-memory.dmp

Download

memory/3848-573-0x00007FFEE7E60000-0x00007FFEE7EB9000-memory.dmp

Download

memory/3848-576-0x00007FFEE81D0000-0x00007FFEE81F9000-memory.dmp

Download

memory/4184-200-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4184-50-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4184-59-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4184-53-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5372-124-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5372-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5372-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5372-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5372-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5824-132-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/5824-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5824-126-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/5824-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5824-138-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/6040-120-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/6040-114-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/6040-112-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/6040-311-0x0000000140000000-0x000000014027D000-memory.dmp

Download