7f2a1519f3d11e832b7b15881dc771194b2c9acb9ccacb16cede00e0975cd872

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 19:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
Size 2.0MB
Sample260910-x5whbsfr4x
SHA256 7f2a1519f3d11e832b7b15881dc771194b2c9acb9ccacb16cede00e0975cd872
MD5 1b755409c0adbc3daf3699900f2cbd72
SHA1 540cc18b9d181d87f06aa0586bebd705a29da38c
SHA512 4319b1b6c09f41c10061d0393cfe14fef3c323631b0be58c5f80875e7f371a88ed5b114deb5906a07a5d043f4d04083e066fe35d07addc1313e67f13148329cc
SSDEEP 24576:rGcWem1gXq5L9uSWidgpm6hbpOSRKQxC7iIFhW4wcGn0uy0xYN7PzMuG5MLPWzUf:rTXq5L9uiibpJKQxgYX2ZGP
TLSH
T1BDA56C1DB761502CFDF305FA8AFE23ACA82CB9A0075890D352C416DED725AE57C36663
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Disables taskbar notifications via registry modification
defense_evasion

Executes dropped EXE 5 IoCs

pid	Process
1876	elevation_service.exe
3804	elevation_service.exe
864	maintenanceservice.exe
4336	OSE.EXE
4528	ssh-agent.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Windows security modification 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-1788976790-1541110888-1636651838-1000	elevation_service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-1788976790-1541110888-1636651838-1000\EnableNotifications = "0"	elevation_service.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdgkfajodaliacghnafobjnclblcfmlm\1.0_0\manifest.json	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe

Enumerates connected drives 3 TTPs 42 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\V:	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\U:	elevation_service.exe
File opened (read-only)	\??\E:	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\K:	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\M:	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\R:	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\W:	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\R:	elevation_service.exe
File opened (read-only)	\??\E:	elevation_service.exe
File opened (read-only)	\??\M:	elevation_service.exe
File opened (read-only)	\??\T:	elevation_service.exe
File opened (read-only)	\??\J:	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\L:	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\O:	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\Q:	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\G:	elevation_service.exe
File opened (read-only)	\??\V:	elevation_service.exe
File opened (read-only)	\??\W:	elevation_service.exe
File opened (read-only)	\??\S:	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\L:	elevation_service.exe
File opened (read-only)	\??\N:	elevation_service.exe
File opened (read-only)	\??\Q:	elevation_service.exe
File opened (read-only)	\??\H:	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\P:	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\U:	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\X:	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\Y:	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\Z:	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\I:	elevation_service.exe
File opened (read-only)	\??\Y:	elevation_service.exe
File opened (read-only)	\??\H:	elevation_service.exe
File opened (read-only)	\??\K:	elevation_service.exe
File opened (read-only)	\??\P:	elevation_service.exe
File opened (read-only)	\??\S:	elevation_service.exe
File opened (read-only)	\??\X:	elevation_service.exe
File opened (read-only)	\??\Z:	elevation_service.exe
File opened (read-only)	\??\G:	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\N:	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\T:	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\J:	elevation_service.exe
File opened (read-only)	\??\O:	elevation_service.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	\??\c:\windows\SysWOW64\abnnkcko.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\locator.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\openssh\ssh-agent.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	\??\c:\windows\system32\openssh\fofhihbb.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\Agentservice.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\locator.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\svchost.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\Appvclient.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	\??\c:\windows\system32\klekpdpa.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\vds.exe	elevation_service.exe
File opened for modification	\??\c:\windows\SysWOW64\dllhost.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\diagsvcs\diagnosticshub.standardcollector.service.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\spectrum.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	elevation_service.exe
File opened for modification	\??\c:\windows\SysWOW64\searchindexer.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\lsass.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\perceptionsimulation\perceptionsimulationservice.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\sensordataservice.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\vds.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\vds.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\wbem\wmiApsrv.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\spectrum.exe	elevation_service.exe
File created	\??\c:\windows\system32\ggnblkdn.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\spectrum.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	\??\c:\windows\SysWOW64\perceptionsimulation\perceptionsimulationservice.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\wbengine.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	\??\c:\windows\system32\WindowsPowerShell\v1.0\hhbifhad.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\alg.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	\??\c:\windows\system32\gmccjlfm.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\openssh\ssh-agent.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\vssvc.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	\??\c:\windows\system32\empppfhp.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\WindowsPowerShell\v1.0\powershell.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	\??\c:\windows\SysWOW64\fxssvc.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\sensordataservice.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\snmptrap.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\alg.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\diagsvcs\diagnosticshub.standardcollector.service.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\tieringengineservice.exe	elevation_service.exe
File created	\??\c:\windows\system32\fclobabk.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\alg.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\Appvclient.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\msiexec.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\tieringengineservice.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\perceptionsimulation\perceptionsimulationservice.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\sensordataservice.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\sgrmbroker.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\tieringengineservice.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\cffjjfji.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File created	C:\Program Files\Google\Chrome\Application\llopmkim.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\poeojoof.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\oocjcpii.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\knqknjlo.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File created	C:\Program Files\Internet Explorer\kfefgkli.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\ooqkhhjo.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\dklkkafp.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\bhlnifll.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ghdhglfd.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\kjlepkii.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\gkjggimm.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\nkoillja.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jihehklc.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\program files\windows media player\wmpnetwk.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\program files (x86)\microsoft\edgeupdate\microsoftedgeupdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File created	C:\Program Files\Java\jdk-1.8\bin\dgilkpmn.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\fnkcikpn.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\llhhlfmg.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\phlkpdah.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\phgiobhi.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\ebbgqipl.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\eqiodbdg.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File created	C:\Program Files\Internet Explorer\qfemblig.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\mekilqcj.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\hjbnmekf.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\opekpijn.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ooclgjlk.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\eehkqlfa.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe
1876	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
644	Process not Found
644	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1060	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeTakeOwnershipPrivilege	1876	elevation_service.exe

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	elevation_service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	elevation_service.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Drops Chrome extension
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1060

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1876

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3804

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:864

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4336

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 364dded49d9c5b4b719f14f26b1ea77916529561992d575fb6a3786f1bb355ef
MD5 b458057a417ea13473573141d638d4ba
SHA1 4c2b792e34152a6ab82654b8f0e6d0a223fdc35f
SHA512 e5190aa8bda6d92e7e9d45895f435c3905935c2258333641c954372719a536b12a7b7ce7ecad721397137b5e514bf1464f15d51b55bbe2d6d6f8ca968c268608
SSDEEP 49152:yb+632BuPkFKRrdE6ohcstBhuXjfS4LWxnjUdrd:U3q6ZjBSch
TLSH
T1D0D59D33E29900D5D06ED079C7169123EAA1BC590B25B6DF1780B3622E3BEE86F7D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 842KB
SHA256 4d99a18e5c1776130d882ffdc8beba7c5493ec56901f7a8686eb0d1cefe05e49
MD5 ce24cf98e49b094f0e35fa72d1e69493
SHA1 b901d1f07b3f85c149f6e885292d6f44efc89a69
SHA512 0a3f50603cc64ec0ce38199a96b7888997fe9f6addd729d4416755903f9277856ae032af53a815c7e696e2bf7d90e6b2b30aeb3f594790cfd6dd6a16ef5fa174
SSDEEP 24576:oXYfDtczA4vvlUFuUMfv0bTxDdI7H/gvyGc:/tc1Unddeg
TLSH
T1BC05AEBA860440B3DC6FCC3E8A2698939787F436439485DEE2C007624D3FAF55EB575A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 bcbd02105d67a965d05d8f8856eac5c15d8fb280df298945f2dac31d7f4557dd
MD5 6853ad361ef3197503a5361e6c86bb78
SHA1 3503b884f5a043bbf27ebfa00c05b32efaf3b8b1
SHA512 90c0e640f95308bcc2a8d406b7b9e75de001f04d161ffb18b420e4351d1e67a0c57cf0389a32ebf5650240beb9068a1b55318496d023bfd3ca66dfa4c3f4102f
SSDEEP 24576:v0Le5ji0hmxArMEiuLrtyu7HdDS7G9nA2sV5rMm3RhqBR:vPji0AmjiuVjHdDJnA205rMsRhqB
TLSH
T169357C16F2B88238F073D0B7C8E2A55AD970704217305BC74395FBA83E57AE6D679722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7b5ccce2f8fe78705836c48d3446a10ae8aea2023815373e0b80c481de6c85ee
MD5 e5b923d0d8d53acfe674dae31997ddff
SHA1 8599c5ec9d6b1a539f6c015d30b7382410ce85e9
SHA512 c4da0e09d3e8b602bd7e2ef301969b8ea51f9d0d01ed215c9f296ee1c47ad3f76c3f22f1405c1af577e6fc32617fef98b00730dc95582b5987771d1413ca5c9a
SSDEEP 24576:7a7/ezSC6vUyD/aqgrvWU6q8wyusxhsIUL2HpdlN1VljHav:W/ezSC6vUzPvlHjyjxhQLujlj6
TLSH
T170754A28F5798322D0F3D0B6C5DA7AAAFE3131824770C9DB0247822C2D676D6D6357B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2cfe7b0b9a7049aeb8f1ecb2b237dcb2d40dabdd3ff2ecbea0205e5104eb62ed
MD5 e82ba747f2580cad2be5dc50522e7058
SHA1 7d30a6bdd780d553955f4dbca3e73bc8304eca96
SHA512 3414a6c78f470ce3d4b9b3ad8e652a59dc4d17dccdba2433227b357cbd8f98baa727e7df0c585a15f8140118af9b3e8789da5a767cebb135e6260d43250cb921
SSDEEP 24576:4VbqPb88hv/l+U5ED1968HOrFkjqKb3Ai/vLaklCvn2Rw3:4VO88hXl+QED196rFkB1vY+w
TLSH
T133556BEDF960C324D072E4B9C2E29AD9F9323842C77989C71548967C2F677D28A35723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 856KB
SHA256 27807f230842ee324574cbd031c0db495aa10e990630388dcbdaa309b59137fc
MD5 f0d77c95c4f175790e7de2d6de9b3375
SHA1 0bfce89e4d0af40e7e580fac8cffa6ca6169a004
SHA512 bed8c6f400999ea6470e7280d74f131ad0f373aeb2f8c657ff1b816d696b395b2445a2bc1dfca1e08e9caa0c6c67d3a0809d267d4eff03124310e27eda00c629
SSDEEP 12288:oeBNUbTVO86UU8vPRC9INLUf62nuRwXvnFGbM4Glr:oJIUU8vcINL8nuWXvn8bM4Gx
TLSH
T125157C63BE98A8C6C03A96F915B2E501F3DA3610FAA9B3CFE41C83554E334D11E7594E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 44f209df400e2ae55d47b6dc0089190aaa0752f7ba5a80fcd82f32f5a99bfad7
MD5 1ebcc7e45e79a49fdd230d8728e9c1ad
SHA1 ee974426b4dbf4eed8ddc722493cc03b22bc2186
SHA512 668bd7a97920769ad0d7e1f1ec57436619be159f06814e7cf87f9dd4b54cf2d3cf70783554734611e7ab8f69da7daa6c64694e88b3ed331fe49f2b6ce4af42b5
SSDEEP 49152:oQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJk9DN5J8NRV3THu:oQvGAdlCEL8c/kRNw5CLQmYdvS9
TLSH
T10F365A656BF980F5E0B6E1388A76C972FBB678020D31AB5F0251C66F2F336904D29735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 922KB
SHA256 159d21628d1b8c86e303406446c07b91e558c8d2a2b049575cd3da393fe34635
MD5 6e5fc3c33eb72105b1581df8c3838afa
SHA1 eda37c536d3a7edfc06c52d50f479637ebe0be1b
SHA512 d4593aad62120683e1f46529f5ad73670a21343eb086d57604efde245bcf5a975c9bb703832ebdcd26aa60dbed97d31f1e9bb459101083e2cda2188afe8d4ada
SSDEEP 12288:oAwSfxL/2Dc3pDLLmt0LDQewsAjJKQHsXno64QXuXeVDoyuX3jh9y+RokRBmSZWx:N0ewsAjJKQaoHLXosDtoQBmXzNBd5
TLSH
T12A15AF21DB39EC7DCAB68934473A5712A49CA9714BA00CCBD3FC499DC694CC2573B78A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e218dfe9ec03914a5b210fc3a9496390b1295861a69a0606863758557908b83c
MD5 5e0df9281f46798eccb1340b57cc0756
SHA1 c8e5e8ce93ec553fd372fd7fe4950deeeac4942e
SHA512 2f228d4c2d3543a04f2b7f7d9e7d97e1af46b2ebcc9f4a7ccaed0775f27e23f7f910b15285eff7c66375190803628305c4e099e182c23cbc298eb82c51c40afc
SSDEEP 196608:jUEtQeTbvf2zlO12sJTv6Ja1cpVLyeIldPlbuJHln:jUEtQevvqc2W1cpV2eI32l
TLSH
T145474B91BBE843E2E3A6953484B182B6FBB17C0E1F35A73B1139F21E1E376905D19721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1da9e59adb82308b080e8cd6ca017a951f0356e6a3d0675354995a3f2fe27601
MD5 7f67db6cc4223c66c9bc8f6b3df8572f
SHA1 20a12b29f74c971308e4efd71406ee6858abc6b2
SHA512 e019a15dc7c17418df72e654723bea6af7176c9148935134124d81aa374732391109f7677458a7f62627da3454f0d709f0c8019bb00438d5e00f5b21baf10a77
SSDEEP 49152:6CbRquA/m2yL5zxfFiV+XenmE3/zXrAFYSdy:PoqUVjnmKiy
TLSH
T14BD57D1976B881E8C1E7C2788652C643F37178059B35A7FF6265870E1E33AE44A7EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 821KB
SHA256 90e39ea4e5f958aa8769f232fdd58dd2adbdf100ceb905c1095df5530964d209
MD5 d1fa3a2b04478720844968ca9ba222cd
SHA1 38332e8706b3ca65e40a5d77fb4df4b17ba0bad1
SHA512 65e2e06c9df707924774a78a502f46e0babe5354ef931826e960379e48f203548c6dbc5280d25cf02f76248ae92ce6ef307f2fe9887cb7f50fcb0caae5910581
SSDEEP 24576:kwu8OWWZnf+05LT27HlX6afei5j+tYjsv/b:kwrO9y6aWCj+Zr
TLSH
T184058F16C23DD66CEDC60538098F7CA36D7A6912423E8BAF1A99C5E277571307E3B384
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bhlnifll.tmp

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\bhlnifll.tmp
Size 6.6MB
SHA256 ef59ec55865b18823b8283710fbe35d717837af1fd6acdc74a6cc535863c2934
MD5 1275a0720c36aa5a75d2b22139c80561
SHA1 7887f1a4ce545df9913481d0b3c5b3238985652b
SHA512 6f4a1d14bae7cdee593571c439b8b01061b6d2424b8b01b79771d8ccf064976737e9bed56d7dde7ea7ea711818683e27333f330c2f3cd641267ef45e3e5ca7e4
SSDEEP 98304:xQRQyi36YOcPELvw2gAf+PN3Ee4g0lR0:oQyiKaGX+PNnZ0lR
TLSH
T1F5667D83F3A501A8E05ED9B4CF3D52229B757C4A8BB093EF159436E11A72DD47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 cbb9bcb82280c3f96cbbe763309f662d5cac3a3faeabd77125e796d15f66c32b
MD5 c31e669f8465344d4e3b5907582d3f8e
SHA1 e0d3cd388d5f733189af5ecb8bf6927e7ecc22a8
SHA512 b7c3ffef21b8ae392d5a0bdb233d2b079d4d0adbe0132b5b189711d0c07a7efae6c4e0f18f00f288e3ab01b7e10e29bad2c127ca882c05e455f1b18db230da3f
SSDEEP 49152:EB+taZ3usBWOBr4tEGK0bqx0z+n217aau1glEHTUah+X:eu6Jm0xd2dKT
TLSH
T1FDD59D13E5DA01E8D05DD034839A9333EA62BC192B3576EF0A9172965F77EE06B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iexplore.exe

Path C:\Program Files\Internet Explorer\iexplore.exe
Size 1.4MB
SHA256 849fcde760d3eb1b4e267b2617ee74e4cfc8ee0ec09c5fd1f12af8aaa8b1069e
MD5 952262ac307dad5a4a8def0204d4821e
SHA1 1e1dcfe576726b31333b94eb1859e005cd83faa0
SHA512 0c1bbda2627854b6b9c731ab1d2c23ad160f5a2172be29b72d3eac91d22fca1ddd2f8a622e6e914f87bdc14fc2a505b746e3edee1c58c590b6f081d019f1ea7e
SSDEEP 24576:x8f4lGLbMMHMMMvMMZMMMKzb6XmMMMiMMMz8JMMHMMM6MMZMMMeXNMMzMMMUMMV5:xSMMHMMMvMMZMMMlmMMMiMMMYJMMHMMc
TLSH
T11F65BFC2B3C5D454E9B509701E23BAC48B63BD581A74828F3B8AB33D6EB53E11875B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe

Path C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Size 1002KB
SHA256 7abdb28758f4bcb6cd34d8e9f237f75af390882e1ebeeb9f05bff54423a8699b
MD5 5f61df653f1f204a4525feff86356a6b
SHA1 281597c534c64fb72db74fcc779e9a9b416768a6
SHA512 2b51e598b2339eca2a8aa696041052cd6a386ca34ba0ba442598442375381430aea6225e57b9f079d06ad13469d12e5685085e309e30ee212d6e33e09c9a26d1
SSDEEP 24576:ujZwW2KjJ4Td3kJnbsPhnzqhKeCjBNseNzIcTTclDPmj13HS:EbnJ4Td3mbsPhnehKP3zFTr
TLSH
T19E25AE9279CC06E3EED78978A20640A1179BFD6EC1AD2582F4B175F8F1F12B0452D39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 956KB
SHA256 1c9bff95ef02c7df81da1445520c2d969390796ec4f189022507b4406f7da4c0
MD5 ff6267ac935356494bc8595b121014d8
SHA1 8c5376de911fd137266e6bac3aa121a16376be13
SHA512 bfd590c597df568b1b57278bce19056a3474b9ce48d2e047fac95a631d3dd8ae4b4b0f742b5497ba067035216c5b3c8547eaad61eb26e626c11f3669c1b2c343
SSDEEP 12288:BObyA4LWOsvAYFTmeddU6Z4gUA/0St6jl3hI3kCzSzn5U:2aL3UTBv2A/h4aHzOe
TLSH
T16A25AFF77FAA23B6EC724434B711E512DEA3E4504323E7976A06C39AC80355B9D786B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omcahana.tmp

Path C:\Windows\System32\omcahana.tmp
Size 1.3MB
SHA256 4fee99e72c68149cbad5d5b5c820072226d152054c29b310330073f7ac5aa238
MD5 4693aa5550ddd5eb0513d9dd4cbcee96
SHA1 dd3971c33003572fedee653228869e5b86d59a12
SHA512 44c48d794d570f4c7f007efcfc7ce5bb162d7dded848dcb03a42257d5c6ba886d8fd0d7b1d689b58dc944276d7e78781a0164c127a56b9116f3a00e368c3428e
SSDEEP 24576:z1QT7EcpfxR+N5AWAz3ooiYbjMqbxXfsukorfc9m7WbG:uTDxR+N5YzTljMaEsibG
TLSH
T14A557D2E6EE4C7E4D0FE86F8CF12C605E67278120B3196DB6154C17A3E276D51A39F28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path \??\c:\program files\windows media player\wmpnetwk.exe
Size 1.5MB
SHA256 e5b4775bd978a17d42746674457d843aa0f76d2b808eb8653a93f31907f18950
MD5 82fca0a883f7c57470032fccb8352478
SHA1 ea5d1d060ae0f79a6dbe0538e3323cce9b259cae
SHA512 5c0515d5d76380457f3eb27848258c18ed8a9a36223a60f342e103f548a1b0b9424c082345fb39ac83fa73f4600a89e460962f7cc0927b2b2c63f0813428d5c1
SSDEEP 24576:ocP4mcvIjkGOxhKP2l71zNKbrh/8KBDe2PMVedFo5chxnzO:TP4m4IpOO67K8K1e2AkFoaTzO
TLSH
T15C75AD0EA6DC8066D1AAB17D4101DA4EE971742E2F2745DF5120C33D6FB3AD34E3AB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Agentservice.exe

Path \??\c:\windows\system32\Agentservice.exe
Size 1.7MB
SHA256 71e1666084c3f4e3c827f2758af8542c2033ec870c666da56ffe082615a67d06
MD5 e7626ee9389b8890d20e4ee4bf513c5f
SHA1 7c6daf4bfaa81320b81ad4106481108fe8cbf29e
SHA512 34ba937c1a38999ee648b979c3bfd1795833e62907f4167de710294ebcf7550d27d363c1d15317d0ae2d22546d120bd62dcfd6739629f67e280d7cd6a09340aa
SSDEEP 24576:GoiQ0h2Hm7EkuAK3xV3tk3tLjN2VMbxR86mHx/YY/izSI2sBF9EzwwXg/bH7n52m:Ga0h2GEkuAe73q3ppT6zwwQX5z/zJ
TLSH
T1AE859E5EA7E8C2E5D87B92B8C9A64146E2B370220F3147CB4255853D3E37EE94D3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path \??\c:\windows\system32\fxssvc.exe
Size 1.2MB
SHA256 62d910e5e1c98d6795618de818b9b00d75b8c46d7049f8edc508c039d76286f0
MD5 3cd6bc18401f8ca93faceb515adc9ebc
SHA1 457c4ee781aea852496f2627fb0a691b91b2131e
SHA512 0f3c37f202e86aad854176b960f16009500262c1dcce359cbf82d00562826909f8be32845ec0bb29e9b3b78a0f849d6eb439c48b2404079e10793a1729179ba7
SSDEEP 24576:R3YgnJcRTk4yti+R5dtR/KE9mrUuAuHUTTcZg0I4s+:RIgnaTk46ptR/KE9OUuAKUTTcZRs+
TLSH
T1D0459D2DE7B521A9FC89C53529510364EEB8783A1F218ADB0270D138AF575F46B7CF0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path \??\c:\windows\system32\msdtc.exe
Size 724KB
SHA256 07b21fe0c3ddc6b1d5b21bf4e4c14fd0ea1e59a5d99315f4a5f00420e256e611
MD5 29321659eb9974db5145e455b08e83bf
SHA1 b43efd0a58ca10eeba9afe081d2141331f20718c
SHA512 1d63ba708bcfd307749834fffc40a46831fdb144f15fcec0f769c461cad8a9b8d9d5591833d493b6dfd675114a6e2a78b35265078cc39aaaba1b0f716048b27a
SSDEEP 12288:vjkykGv/q+hpiEEHr9D5L1EkqgGMyOUcABVaIy231Puko+zxLwHCHEq+PqlO5SMc:vIy0Ejf4FvTkoqko83nXJf61P
TLSH
T10FF47C49FF18118CD0B4C5346D8C13D0BE6C38694EA47BE7C0BDA6C6D5EC6EA26607B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path \??\c:\windows\system32\msiexec.exe
Size 647KB
SHA256 8279479b5226e2aba3e9c40bb9ff9577d40942d10d59f264d070e782e083da2e
MD5 8d53268bf7d34ae8cbd44466a35d0f4a
SHA1 6ae859d0caf2e479e6a64fe7b1f9dede54a1bfff
SHA512 e37bb10fca0b586820e28b60fd0c0c23b2a2ac262399c6507ed064d07c09ebf4f88e90883d5212ff3b5a3d9548e8beb0c816c2492ae9fb77564f8a9578f9c6b3
SSDEEP 12288:J4F7M7D/+LcWg+p7xpsCyXwZcjPeGg7zw5K:G7UocjMvsCygiPEEs
TLSH
T13FE47B0B25A9A0B1FBE74332013F43636BDDE209435652AB7257F197D2DAE1B08136F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path \??\c:\windows\system32\snmptrap.exe
Size 596KB
SHA256 225b1955998256e39411a6353ad9476ef26ca54000c5c841f93fab31bc3b0d43
MD5 5e2267d443bbcb04341daa828bace0b6
SHA1 457fdb5ac5934dd7b83ee61c6cab76690ea19c98
SHA512 8dce7492ebf1ad49bf3d3218bb5c97a9f7a00f4611b3c84cfba2e78f5021b536520b9cd07779784935cb0b7609e2d2ad9d4e0cf8a820d98ed7d9c7025e3abbd2
SSDEEP 12288:+g66/SZ92PHIwAHYzBjZlGl84q8kAKmD:x66/SZCHIhHYzBjTi84qxRmD
TLSH
T129D46A625E8D5EF4DD324A3439BF8F40203EA1B43367966BD216852AE51BFC821D2F4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path \??\c:\windows\system32\wbengine.exe
Size 2.1MB
SHA256 23d2a64e0f149424933749fcd18b335f39be9ceb6a0b959d9a904e31ca93dc12
MD5 35752c4ad32638524c370ee816a9ec42
SHA1 4f9e53561f5636966f0580d30222075d70ddaa99
SHA512 ca16972ccb353393c31eb5109a9395cfc5e8431f0694f57fe918472095ee258cf947299e564a05cbc95588fa78a2c191913b0efb1af849d5bc8f2448a51b943b
SSDEEP 49152:xWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKdIKvfIXZ3Z:p0zuNIOfSt
TLSH
T1EDA55A3DA2E800A9DBDA8274C1061F65EA71782E3F6075D70860C57CBF1AEF19638F65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/864-28-0x0000000140000000-0x00000001402CA000-memory.dmp

Download

memory/864-47-0x0000000140000000-0x00000001402CA000-memory.dmp

Download

memory/1060-0-0x0000000000400000-0x000000000085D000-memory.dmp

Download

memory/1060-1-0x0000000000400000-0x000000000085D000-memory.dmp

Download

memory/1876-93-0x0000000140000000-0x00000001404DE000-memory.dmp

Download

memory/1876-16-0x0000000140000000-0x00000001404DE000-memory.dmp

Download

memory/3804-106-0x0000000140000000-0x00000001404C8000-memory.dmp

Download

memory/3804-22-0x0000000140000000-0x00000001404C8000-memory.dmp

Download

memory/4336-48-0x0000000140000000-0x00000001402C4000-memory.dmp

Download

memory/4336-124-0x0000000140000000-0x00000001402C4000-memory.dmp

Download

memory/4528-59-0x0000000140000000-0x00000001402F7000-memory.dmp

Download

memory/4528-129-0x0000000140000000-0x00000001402F7000-memory.dmp

Download