3911a409e0742dcb34dac4abca66b2df6874b8b2472d07c7f1e10a072665dc72

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/09/2026, 15:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Size 1.5MB
Sample260929-slw8astalg
SHA256 3911a409e0742dcb34dac4abca66b2df6874b8b2472d07c7f1e10a072665dc72
MD5 ddc990c7183dce488341b4964889b3b2
SHA1 19c810ea2ad6f3dd015dba44a48d3959baad15f8
SHA512 1e7471ed94a5424950f1fe53f188500f4356e028380cbc0dd1a80b8e90b6ab4761b94a90a1c921247c511ca9c039aa43f77997aec48b87cb571c26b58dd47497
SSDEEP 24576:gIvkr33fJ4yL/tNCJPXUQrPj7eR4MiPP/+XA8GSV7y6ggxbDngv/S2:ur33fJ4klKXnrq0PWj37y63bTgv/S2
TLSH
T15E65237CB5C09472CDB20D3902D4C3725B2C7EB017B951C7E3966AB9AF38792212E65B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery macro ransomware spyware stealer upx

Malware Config

Signatures

Suspicious Office macro 4 IoCs

Office document equipped with macros.

macro

resource
behavioral1/files/0x0009000000024148-472.dat
behavioral1/files/0x0009000000024125-473.dat
behavioral1/files/0x000a000000024144-474.dat
behavioral1/files/0x000a000000022aec-475.dat

Executes dropped EXE 19 IoCs

pid	Process
740	fxssvc.exe
1972	elevation_service.exe
2728	maintenanceservice.exe
464	msdtc.exe
2244	OSE.EXE
992	PerceptionSimulationService.exe
1136	perfhost.exe
4704	locator.exe
5104	SensorDataService.exe
4752	snmptrap.exe
2808	spectrum.exe
1696	ssh-agent.exe
4264	TieringEngineService.exe
5112	AgentService.exe
4948	vds.exe
116	vssvc.exe
980	wbengine.exe
1784	WmiApSrv.exe
432	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
\??\F:\	elevation_service.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\43b42147a26b1277.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2124-0-0x0000000000400000-0x00000000006F1000-memory.dmp	upx
behavioral1/memory/2124-65-0x0000000000400000-0x00000000006F1000-memory.dmp	upx
behavioral1/files/0x000100000001704d-480.dat	upx
behavioral1/files/0x000100000001700e-479.dat	upx
behavioral1/files/0x0001000000017bd4-481.dat	upx
behavioral1/files/0x000100000000c534-485.dat	upx
behavioral1/files/0x0001000000023365-484.dat	upx
behavioral1/files/0x0001000000016795-489.dat	upx
behavioral1/files/0x0001000000017039-488.dat	upx
behavioral1/files/0x0001000000017816-487.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009335552a2550dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ba97572a2550dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ef76d4292550dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000845bb6282550dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d85e3d2a2550dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e7d3522a2550dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeAuditPrivilege	740	fxssvc.exe
Token: SeRestorePrivilege	4264	TieringEngineService.exe
Token: SeManageVolumePrivilege	4264	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5112	AgentService.exe
Token: SeBackupPrivilege	116	vssvc.exe
Token: SeRestorePrivilege	116	vssvc.exe
Token: SeAuditPrivilege	116	vssvc.exe
Token: SeBackupPrivilege	980	wbengine.exe
Token: SeRestorePrivilege	980	wbengine.exe
Token: SeSecurityPrivilege	980	wbengine.exe
Token: 33	432	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	432	SearchIndexer.exe
Token: SeDebugPrivilege	2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	2124	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	1972	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 432 wrote to memory of 948	432	SearchIndexer.exe	121
PID 432 wrote to memory of 5104	432	SearchIndexer.exe	122

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2124

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2268

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:740

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:1972

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2728

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:464

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2244

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:992

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1136

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4704

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5104

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4752

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2808

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4584

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4264

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5112

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4948

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:116

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:980

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1784

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:432
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:948
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:5104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 39b1a1d0400d49268f81016eb288b06f1ba9aa1f18b262e279dc7b0038e76f9e
MD5 890d4b8a8d4daac4b23356ed237478ec
SHA1 999f3acda239d3a3f58afc1f03b0728b1cbba39e
SHA512 b0607a69ba0a7c670fa02d32c0623f8fbc048c16778b08ec9034ed1a6434780823ea977eb83818cd0d892b272954fb42ce2ae7ff98625893ce96b5776acf84d3
SSDEEP 49152:1b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnIfJ4klKXn3:L3q6mjBrfJ4k
TLSH
T14DD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 93ca0053f56cd1bd8b992cf1b0ff51f35f384aa6b9c71c87d426f8cb87311418
MD5 7d7d83eeb1113aa28a64385871fa7d6e
SHA1 90471ced85e5e491f69ed7659a508765e2d4bb49
SHA512 1bc9ae7450459d5abfbec4f1a2c0d6e07b3c98463bc73efd2d3ede58544253c5afc8635a0b6008e7c8863b18614545c2d8169725557f10f18b086317093aac06
SSDEEP 12288:T1XLsswWkxy2lRq2czAXfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SN:JXYfDtczAXfJ4yL/tNCJPXUQrP2
TLSH
T11F05F12973D408F9ED67827CC9A1C101EB32BC854764E7DB03A099662F776D81E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 22278d44b6a4708f9967efcbaf0c44d61035fe55a8c30cb2a248c382128df642
MD5 cd88d754bcc18533f32807880a8b411c
SHA1 e7502af63c293e8a412a5e91b5380dc41b65d426
SHA512 e0244e5937ce1ac09eed29b3c5c10d57780c8b7536f4f98ce7da8bdd32ea6c73509a141e9fe19c77f54c34a8df2e2d97b95189c1182682817b49561a4205e5c0
SSDEEP 24576:mXYAbGczAXfJ4yL/tNCJPXUQrP22eR4MiPP/+XA8GSV7y6ggxbDngv/S2:4GcSfJ4klKXnen0PWj37y63bTgv/S2
TLSH
T1CF75126873D018F9DEA7827C8A91C102EB327C8103B4E38B03E599655F777992D7E792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 5144537cb52eeea823a40b2bc74d094753b790709917e69feea6aec023611d7b
MD5 e6c97edff26785977fa477c9dfda7fb2
SHA1 3349c0364aec8ff5858bacaa5c0208034989c990
SHA512 df752e537e9da4081355165c36bd45dc6f01d6303641281fc2a4c6db7c4de678ee9fecbeae80567b8d1c888c06567f6e52641136f478957159bbde07bb53834e
SSDEEP 12288:nmw5HEjsChNEBFgl0WDm+CifJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTf:mwuROWRfJ4yL/tNCJPXUQrPb
TLSH
T18005014A32E41CF9E96782788687D132F7B2BC422A26D71F4760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 3.0MB
SHA256 25597fc9b569d0dce2e97a9b7b12ed2448cd89ff32aeac14a7573485f70b8425
MD5 b3802d821e148ea29ee9ea1b22af442f
SHA1 f44ef9a9a9d3f37e38d64da12d7d3dd2c78562b8
SHA512 1f9529b2ed4d5369e341f4b81333d2a6002c33a4b9b845eb9ddf87c6ba6adab34de1701767611d91b043ad49ca381a362cdefdf14844c788704685fdbe0ad98e
SSDEEP 49152:oB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glX0PWj37y63bTgv/S2:iu6JmTxd2dXrj37n3YS2
TLSH
T142E5AD13F1DA01E8D06AD478974A9233EA62BC490B35B6DF0B9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 9afc453436a9ed4da808ccb07755f9ebbb46bd3e24b6f3a26b72b343cd1df350
MD5 2d85e77bd4af1792022ead8e3efd5f44
SHA1 98738e53c17d22f2403d487635cfa226914bfc45
SHA512 23898aadd56362d91576c837f9105d6d6fd55fe675c0fcb02d250c066f515d0ae70931551bcf62aeacedcb85e4d5d17f20e7d8c38e11bdaa84da0d051783b66f
SSDEEP 49152:EP4m4IpOO6708KyfJ4klKXncD0PWj37y63bTgv/S2:MppOO1EfJ4kHrj37n3YS2
TLSH
T16FB5E02DA7DC0096D0BB817886558A4AFAB1782E1F3286CB1160937C7F77EE54E35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SplitInitialize.docm

Path C:\Users\Admin\Desktop\SplitInitialize.docm
Size 772KB
SHA256 ef89dbd3d412f14fd66511a2bcd8b69c75c47733f3a4f64a084ea3b62ce321d2
MD5 1ea54c77050dac30c58b39f0c3c4c51d
SHA1 b659c8a3a6ebbd492e6940655bd37c5703b58082
SHA512 7f22ae78b61871225fc99a0442849ea2183319206ab620cc93217a8164f9e983415be9e65f0e48dab611e167a1f4e8fb26d39cc9423c5387c9d6a534dad6ccd7
SSDEEP 12288:khrEKtZ0x6YJKeIj+ubROq9KLshTyxQHfeXc1jwhkYZu1vmyegFSBtNJ366YRoxi:khrza6YINKubROSKYQ4a2uynSBzJ9n4
TLSH
T1F3F423AD755204A5E71194BB88DF109B3C4B6A462E47C78346D3B810CDDAF2A34FBC6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ImportUse.docm

Path C:\Users\Admin\Documents\ImportUse.docm
Size 778KB
SHA256 3ba5502e85351a3e6497554387a8b9c43d19e8f002dc72563a71fd33b4e1da17
MD5 39de329a8d24634991d85669ae0bdb84
SHA1 39bcce0f50d61d3985eccc487a6aba0d999001c9
SHA512 7353bfa23646730cfde5f5f1a8eb456f0b91443cb42dd8a6382bb1314ad84a93a3fcd1152c26ae8c99d2a1fbf1ce26354788b2911ef32f01c99acc09ec56ce54
SSDEEP 12288:83B7EKtZ0x6YJKeIj+ubROq9KLshTyxQHfeXc1jwhkYZu1vmyegFSBtNJ366YRoM:+B7za6YINKubROSKYQ4a2uynSBzJ9nM
TLSH
T12F0523A97A5504A5D72194B788DE50DB3C4BAA422E47C7C306D3B410CDDAF2A34EBC6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevokeUnblock.docm

Path C:\Users\Admin\Documents\RevokeUnblock.docm
Size 773KB
SHA256 738ff36fe4d7f45c4021a70e819ee6b3538b42d5d418e06602fa9761509b8452
MD5 7cb7cf9bd3a3b5916c3d950694fe63e9
SHA1 c9226bb4d82f4544e1bab2ba54c07f4cbf2edc44
SHA512 1fbbefa821d5dd39a4676fb09cb39db5939c7ada7494ee36b5c6327e763d4539329c4199c7edcedca787ec7f9d39bde678fc90393133f50085bb34354df6bf63
SSDEEP 24576:RA3R5Lya9Qr9liackDfMDal5g1C7d1Lrs3yZMRdpN:RGR5LyJPiacUwMq1EHA3yiRd3
TLSH
T1E8F423980F9D90D6F21A07309F78920B5A5E033F5227D6B6763373824FEA19D9F15B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SaveUnlock.docm

Path C:\Users\Admin\Documents\SaveUnlock.docm
Size 777KB
SHA256 20f29761ee4d33d49eef6486fcc0afc1a42d158963dcf61b7eb8a1ba413e1281
MD5 926b9374fc2567f0263fe9c6083f5f47
SHA1 10539ba9166b817d0393b6d4d88037281442e713
SHA512 2c8def29b266ff0de08669a8fc2031508a95a57053f162e5c475f5247f02323d6ea7613af6166dc6027de3084d9a731ed2f25623789a9e8d6ae0da5d4895a5db
SSDEEP 24576:mtXXNqmkZcQcFmq2vRckD5zDaT8NUShaBSgXJkHeTOp:mxXNq9czFmDRcUtoXShC3XJTKp
TLSH
T11F05335014A538FEF76D8BB0D4DD66C9B09E2BCD2211B713373A625327065AE438787D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 08cb0015b5babd3535b693f0b40420a30929e0faf04cbd12c7c275d7df63be65
MD5 9b2b9e5bddcc5bc5f8fdc83d3de5a24b
SHA1 e46271280c6c999b1be9a76b3b7af26a2fc4646e
SHA512 13dda33379e5c7c9a1f90de9839d2f74bac586b0558bf149d7ac119f3ce0a12b909cc66a8ab619405925027ae4644619ed3960a944a4056ee0d0588ed4f926fe
SSDEEP 12288:JYfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sd:JYfJ4yL/tNCJPXUQrP+
TLSH
T1A0D423A761D8D44AEE7687F81648E00093097ED56B2BA2E7EE42B4853FFC9161D6C313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 14e311141617b3511d98a66917d2daf91e83dd3b36c38441b876fe51b5e67bb4
MD5 47427d79c596a71eaba669821381427d
SHA1 e47c5f3927b0edb81ef5babb2e4a12b68056304d
SHA512 269213833f0fae079a0f592304524116c7b88dbb341558f254114f4a9897b76d01040bd3ea37e2db00898255f124cd289187e7809ead934ab21a34297503decd
SSDEEP 49152:ca0h2GEkuAe73q3pp46zwwQ2fJ4klKXnd:ca0hNYG4Jw9fJ4k
TLSH
T17F859E1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 0ef4fba6e1db404e65d7d32155573d7e31b237f9012fe45ee89b30184bd4978d
MD5 b1833341ad955c722ea26e493fb943da
SHA1 0dcec52d69ab4f24450ffb832fcf8657c9138e05
SHA512 c2e9b0744b8cd085a3f4de4c11e79b0c3766116d995fd48655cf276deb7eccc6bed19fcfb40154356d20ffa0737e5cec9a4af2817bb97db9c1e13431794a1e9d
SSDEEP 24576:Y3YgnJcRTk4yti+R5dBR/RfJ4yL/tNCJPXUQrPX:YIgnaTk46pBR/RfJ4klKXnP
TLSH
T1CB45B02EF2B910B9D8A6D236450143B5FB71782D1F2196CB0170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 4650e36241dde272e9553c2b2131accc424c33a1b328127395af2c038a9e9306
MD5 67b11d68399ca36c5e4595cc95213658
SHA1 ac6de0e9ac6a7620bbc979d91ab843ba0be71f4c
SHA512 ce8b1de9e6c6d7141f5a91a8a1d7b9090e2c1a49726a2d96cca3a1e1e1c42d2917149cb762f73804db6ecbaeb5b8f8e36c72b2f0cb2db541d85533acf14e946d
SSDEEP 12288:NkfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sx:NkfJ4yL/tNCJPXUQrPq
TLSH
T1BAC423EB6084948ADE6587F81648E001D3047FC5272F63E7AD82B4867FFD99B15BC392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 6d871e5d376426c19c33439d52cb9664118dfb1f477881872f5cdd8c6d10e641
MD5 781c26a365448965987195f50240b616
SHA1 d980c4a30027060d4a7cb7860f0318897ecd4306
SHA512 0056b2f9048010296a4886b664b10dd36fcd6daa4db639dc1055f8a93791252903882c1be519530ddb1def7004bd949e0bba0d46100b9c17053eceb6f1a23846
SSDEEP 12288:gObIA4LWOsvAYFTXfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S6:dAL3UTXfJ4yL/tNCJPXUQrPV
TLSH
T1EC250155F29400F9ED6BC27C89A6D512D372B89D0324E3EF07A88A552F637E24E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 cad2f3794575bf6889eb6535347089fd781c1ea5e9a3c64e17c8f676cebcf996
MD5 5234faa2f646fdc7ebdec5b7cceb86ca
SHA1 3cc0f9da5728a84839e0850999fa6a1091cf65fb
SHA512 1b379429e42cd18d860fde5f1c57e2c1cec6d1c103fe19560cd1dd7d615b99b2dd46ec1ae6d3c45d25c57da0ee31ebdf3ae067fae275c3ba64275a42bdae9ecc
SSDEEP 12288:KpFtvODfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SW:uODfJ4yL/tNCJPXUQrP5
TLSH
T14AE4026A32DC10E5D576927C4A85D209D331BCA6172753EF46D080AE2FF7EE82C39761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 69c2421b1b5f7effbb217b131de343ffe06e55e309458d1315527b9be96564e6
MD5 b81f87304f4290fd4f7c33b688cda35e
SHA1 f38bf0aad673f6a2d96f15579f47bdc593a3329e
SHA512 f36471901dcce4e658623ca21116c56cbc4d9f89f23d65bb00d92d85601151f8531835b3d83bf9aba794c726aa53c004935efa790a02f9c060878c05c486e8d4
SSDEEP 24576:n7NM9YqZqmWMUkPjZM48Mv6bEhsofJ4yL/tNCJPXUQrPq:n7cBWMpPjN8DbEh5fJ4klKXnC
TLSH
T13B65AE2E6BEC81E5D477D13DC9A28205F6B2B4611B318ACB5152833E7F37AE44E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 23158492f11ffb6c5152c4397928735ac21b1c00ae1a5852dd1cf0d4d5055670
MD5 06f5f13549261a5c5b140c457bc1722d
SHA1 16b8787a8a0b20576843751ff79b54f4dc9cc50c
SHA512 796e956f9e5f946035b9a0b6a24ef04f6ece13849e0f97630d9757970a62cf16ee5473ddad36c7fb066ec63eaf58982deff164d8554014649c6cde845e3390a5
SSDEEP 24576:sW6BApg2YuyuNDYTabvcdvNYf8km1afJ4yL/tNCJPXUQrPT:sF2YuHNETovAvNYf8kmIfJ4klKXn7
TLSH
T1BC858E6A27ED80A4E0BBD2BD45B6D146FAB2B8511B3056CF0255862E1F33AF44D3D732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 abc7ee8b09cf379efc9079df67e4d9bc9f4864cc438df94fda78fe89b1c48987
MD5 f4dd66de886d26b2ad5b56bc25e35c83
SHA1 55cdbd63e43cfde1bafce1c9600e20e9e61ead0d
SHA512 79faae691f11d2ebbbbb00f346b0a228bfb07c5cd50e40a0f705aab159bc8ff32dc3dda561b14d70ddd9c8d3d012483423e3305d814e64ba84253513bfb80b39
SSDEEP 24576:BAFs06+Omlf8NXEbToffJ4yL/tNCJPXUQrPT:WFs060loXuWfJ4klKXn7
TLSH
T1B865AF2F62EC00D5D07ED17D8A96C91AF7B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 9a62a04b280d898b71ae8e4361787ef4deba4d1169a1a6082aad227ed76669dd
MD5 d0908214d7cb2426a0e7c2ca608644ed
SHA1 efb0a016b903a94fb5d96bf63791067a93588f13
SHA512 ab350b9e24e490bcd77bae55e07ed69a5aa9384b116eca0b8a9c5395943579eaaaf85d32f141022ba5c5a9c03ea2cf1eeae51ca9a247ee53440b325d41e94b5f
SSDEEP 12288:wCJnJ5D3VkrDzxIfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S3:FJnJ5D3WXWfJ4yL/tNCJPXUQrPU
TLSH
T1D515D02DD2A810E8D4B7C3B482496746FF72386D2F266AC768B4D4353F12EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 4e3879f571d900793175c2794bfb796b78ad7527e77667f139a607bf3435c5b4
MD5 6aa133bba7723b6a277f2faec719dc81
SHA1 beecb8e463a7d3e66f9fdbbae9f3d2ebe48a6f26
SHA512 4228486e562094840c1bbc9488623445be23efc930361f4f2a8e94d08a3202bce17ae2b4392bb815ad66eb0bac7eddcc7c33ec85236b65e8638a67d3df4ffa32
SSDEEP 24576:JEPghm6/7IIXdwcXrif7qQncjlP65i3VuRfJ4yL/tNCJPXUQrPR:ug06DIKdwc+eQnSt65aVsfJ4klKXnZ
TLSH
T116955C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 850KB
SHA256 2dde4b60c34f4ca6751a15f6d3ae1feb5f17f218e783c4da905bdc3709038099
MD5 7022da228c4e7a2eb6a4562665784775
SHA1 c0b5e73bc3c16a494cc00184756082a39f154df4
SHA512 c4f99177136d4f6af00c8ba1469983254cb4a6cedaacd2ff8608517908fbd93c0a4d782ef545b1bf248cee98e047595a1abecdd6cdb312d5ac0ebbbd66fb74eb
SSDEEP 12288:BEP3RinKH6KcgtY7MiSEnP6Ipf8fs+AXspUQhdV71O1PigGYPKtEkbk2niZv/bm2:yineR4MiPP/+XA8GSV7y6ggxbDngv/S2
TLSH
T1980512AC679C34E9C6B6543D52818242D7B2F06017A267DF13E6C27D8F27BE63C39A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 7155e146d35b033fda680e3a1a2fd8319a564b3609824553ba4fa0d157cfaf82
MD5 f30a2d170e44a7cb5511a8cb90d37276
SHA1 6343ecb5e5e40dc089ddd493916b6dc6789c4d7d
SHA512 523d477de312f199fd5e685175de0db88b5187b1b093e2a247bff51bf7926f5c05b6d4aab1b359e40ef8607b23b116592b2d76d22960172b63a9b26c3354cdce
SSDEEP 12288:ajkyJfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S6:aIyJfJ4yL/tNCJPXUQrP5
TLSH
T128F4224A23D4A085DAB643BC5A55D140CB34BCA06F2693EF9580F53E7FBABD52C38712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 c4dc69a52eef5aa40b3d907ba01e9f80a3b8f531b49a8c384533dbe3fbd4dfd0
MD5 7061f3edc18a10b974e9d3b249c49e7b
SHA1 73a0203dcedded85fb3944bd59d6f7535bb2d64c
SHA512 2259b221586bf96660be90d9bada7f69985f3341bbff10cfe301d7ee015fe2ee6913df01fd8d9042945d3fadc6b8a8aeb7d9328982d441d44ea780a6048033bc
SSDEEP 12288:JyzfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S3:4zfJ4yL/tNCJPXUQrPs
TLSH
T19AD423AF2094A08ADE2687F80648E000C3147ED5272B62FB9DC2F4A17FFD99615BC791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 e10c1afc0f40b01ae0f5155c75f2b75236d3bf2ad7be545e92dc6bf7bf5c5bec
MD5 b5256d09c51b4f8479750989f31b49b3
SHA1 b69279052d398277b3860559d28cdb4dc59d0004
SHA512 23af6c9762f2ce8859035f8275ec7b844595e91214f5fe52b12e7ca3755806e3d5cf0ff5584c1f22d5a1d6c4c90085019b1383fae585c054a110845750bc8817
SSDEEP 24576:PQ9MxZKdcz9dw3wfJ4yL/tNCJPXUQrP6:PVKZwfJ4klKXnS
TLSH
T163558D2DABE9058AE177C27595A250C3A633B4311B35D6CF2448D03D4DBBEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 22d83d51e41db3d93bbbd22796e68cb93f5b1c83e0d0ef5393b644f80e309871
MD5 1f2fc051acf0bda8a137c0110186a603
SHA1 fd1f619b9861217156062cb2e4b42fea10e73ddc
SHA512 bc0e5d025fd70d1e613238904b9e8022a9434079727b4441ee1c5307b71bf2015dde05097e2b9a1999d4b67efa19280cb0421b495a273187a73734422349507f
SSDEEP 12288:9yoKo2JRple9pFfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Se:9yocDApFfJ4yL/tNCJPXUQrPR
TLSH
T183F4E05FB7A940A2E176823C8984C205E773B4701B2263DB6681C33D5F77AE97D38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 4537430b7b9636714b23e23986b827e3257292b953f3855d522e9feafc6189d6
MD5 b18fdbfc58ec9a2a052ca012eca4e811
SHA1 8df640f5ea2992a9aa3208115f32ca2c84141ebc
SHA512 31ff8406868d85ca639119731e23e418515a034a02766b8fa0985306693c1e85c332a821c8e229ea7fa50c1cb46e4594b8b6501fad41ae52b546ef902638b353
SSDEEP 49152:9WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKFfJ4klKXnM:d0zuNIXfJ4k
TLSH
T16DA57B3DA2F800A8D9AAC375C5451366EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.5MB
SHA256 fe6bfd1a3235861e52532c046c9c7e8013c248e1876c43599c0a353f052b678a
MD5 0253897c0f3db837df455aaa538049c0
SHA1 eb2445138a0abdf357c9d1312e7afb18a2cc5727
SHA512 a5d7c3996bc0f5652f649ada8ae68929eb10c35caa7db7a34f1e2b38ed7cbf67508d9b789ef26783886fd5b6237dbd503035bd64e7c2f09629b496a23c9c1b80
SSDEEP 49152:La0h2GEkuAe73q3ppj6zwwQ2fJ4klKXnde0PWj37y63bTgv/S2:La0hNYGjJw9fJ4knrj37n3YS2
TLSH
T177C5CF1E66DC82B5D0BAD278C9A6814BE7B2B4260B3156CF1151853D3F37EE84D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 858fa38723f0436f1da101c92abf5cf145ef34931078c34e2a7b0ca1f4a1de39
MD5 ac26847b842b6f9d6c3bf30a06bcf517
SHA1 4295b94ee434ce3bc37b807a40abc5b9f00ba09d
SHA512 ba6502bb57a74dac21161a7a11a5df4d7369a0987b3759af982394e4e2b597fdca0a3b13543f1d6c23c945067797ba429c8f0736cac88d4d3805a82a638b4fab
SSDEEP 24576:q1QT7EcpfxR+N5AWAz3ooiYhjMqbCeR4MiPP/+XA8GSV7y6ggxbDngv/S2:XTDxR+N5YzTTjM40PWj37y63bTgv/S2
TLSH
T14175C02EA7E815E9D1BE85799A238502FB727851033193CB43A0C17E0F6B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 848KB
SHA256 709bd6afeb88b5d7ec7468141ea2e5fdb732330f45dfad273776f34494d8b064
MD5 b8df4e1f0224a4541555a324cfc1193e
SHA1 d4c45a789cf411ed0a7f8009bf0747760903fbe6
SHA512 5a944ac7265260acdac1442a3e5c487808149bd63753e1caff296692190c4a88ee491c0747753b5161ed09033847da074c3a3533c0ccd8cdd757ebdb9ba5f508
SSDEEP 24576:ahbHjPkueR4MiPP/+XA8GSV7y6ggxbDngv/S2:ahbHjm0PWj37y63bTgv/S2
TLSH
T1DF0512BC26AC34E8D6B1997D52868202C771BC1507A193DF23D682BD4F27BE52C75B82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 95f46e83b2c2b776826ca96112c4ba813faf20400f4ac55e6f3f4b00a802059a
MD5 579794182f593cb3502e0af3ec9b4245
SHA1 cf2c38e61348ed6f39c427ddc7d081497f2bae7b
SHA512 31755dede081a94ee8494cae72e18acba708e0e8b3a75a6b17e57f0b7fe208e27fc1f676859956754f70220060186c0f4872559395fed89ecde79c24563c374d
SSDEEP 49152:X0K+7mSLefJ4klKXnxc0PWj37y63bTgv/S2:IufJ4khrj37n3YS2
TLSH
T1FB75127EA39D28E5D57AC27C9742C506E77238A10322A6D70791C0B92F9BFE4397DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 dcc1f1dec5f9eb34e070a66137531e641902736062896f65c21d290a859adcde
MD5 f82672501461a60b6aebbd21ec43d584
SHA1 ec5d06fee11cd761c6a0e2be09523d607244f5d0
SHA512 1d46de15ce1c240c5585f0462afda05627876917052ac3a7025f8e6349e1ae0d090ad04e3522038c52419ae6ed916572a96474c9de7513ae6a487ed9ec88a4cb
SSDEEP 24576:UXfJ4yL/tNCJPXUQrPW6eR4MiPP/+XA8GSV7y6ggxbDngv/S2:UXfJ4klKXnuD0PWj37y63bTgv/S2
TLSH
T1A465239C62D438D5CAB24AB81748C1018730BDD513BA62FF37D3D4B98F7AB9660B8752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/116-416-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/116-152-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/432-419-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/432-459-0x000000000F490000-0x000000000F491000-memory.dmp

Download

memory/432-206-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/432-174-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/432-477-0x0000000000560000-0x0000000000561000-memory.dmp

Download

memory/432-422-0x000000000CE00000-0x000000000CE08000-memory.dmp

Download

memory/432-476-0x0000000000570000-0x0000000000578000-memory.dmp

Download

memory/432-456-0x000000000CEC0000-0x000000000CEC8000-memory.dmp

Download

memory/432-458-0x000000000F4A0000-0x000000000F4A8000-memory.dmp

Download

memory/432-165-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/432-190-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/464-142-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/464-68-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/740-33-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/740-32-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/980-156-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/980-417-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/992-151-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/992-83-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/992-89-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/992-92-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1136-95-0x0000000000520000-0x0000000000587000-memory.dmp

Download

memory/1136-155-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1136-102-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1136-100-0x0000000000520000-0x0000000000587000-memory.dmp

Download

memory/1696-128-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/1696-134-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/1696-136-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1696-323-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1784-418-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1784-160-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1972-112-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1972-44-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1972-45-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1972-36-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2124-65-0x0000000000400000-0x00000000006F1000-memory.dmp

Download

memory/2124-2-0x0000000000980000-0x0000000000A05000-memory.dmp

Download

memory/2124-0-0x0000000000400000-0x00000000006F1000-memory.dmp

Download

memory/2124-18-0x0000000003390000-0x00000000033F7000-memory.dmp

Download

memory/2124-7-0x0000000000980000-0x0000000000A05000-memory.dmp

Download

memory/2124-13-0x0000000003390000-0x00000000033F7000-memory.dmp

Download

memory/2244-147-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2244-70-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2244-76-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2244-78-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2728-49-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/2728-62-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2728-63-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/2728-59-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2728-55-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/2808-116-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2808-270-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2808-122-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2808-124-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4264-139-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4264-346-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4704-105-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4704-159-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4752-214-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4752-113-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4948-148-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4948-414-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5104-434-0x0000019177BD0000-0x0000019177BE0000-memory.dmp

Download

memory/5104-432-0x0000019177BD0000-0x0000019177BE0000-memory.dmp

Download

memory/5104-430-0x0000019177BD0000-0x0000019177BE0000-memory.dmp

Download

memory/5104-440-0x0000019177BD0000-0x0000019177BE0000-memory.dmp

Download

memory/5104-441-0x0000019177BD0000-0x0000019177BE0000-memory.dmp

Download

memory/5104-442-0x0000019177BD0000-0x0000019177BE0000-memory.dmp

Download

memory/5104-445-0x0000019177BD0000-0x0000019177BE0000-memory.dmp

Download

memory/5104-444-0x0000019177BD0000-0x0000019177BE0000-memory.dmp

Download

memory/5104-443-0x0000019177BD0000-0x0000019177BE0000-memory.dmp

Download

memory/5104-448-0x0000019177BD0000-0x0000019177BE0000-memory.dmp

Download

memory/5104-453-0x0000019177BD0000-0x0000019177BE0000-memory.dmp

Download

memory/5104-454-0x0000019177BD0000-0x0000019177BE0000-memory.dmp

Download

memory/5104-455-0x0000019177BD0000-0x0000019177BE0000-memory.dmp

Download

memory/5104-452-0x0000019177BD0000-0x0000019177BE0000-memory.dmp

Download

memory/5104-451-0x0000019177BD0000-0x0000019177BE0000-memory.dmp

Download

memory/5104-449-0x0000019177BD0000-0x0000019177BE0000-memory.dmp

Download

memory/5104-450-0x0000019177BD0000-0x0000019177BE0000-memory.dmp

Download

memory/5104-447-0x0000019177BD0000-0x0000019177BE0000-memory.dmp

Download

memory/5104-446-0x0000019177BD0000-0x0000019177BE0000-memory.dmp

Download

memory/5104-431-0x0000019177BD0000-0x0000019177BE0000-memory.dmp

Download

memory/5104-433-0x0000019177BD0000-0x0000019177BE0000-memory.dmp

Download

memory/5104-108-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5104-436-0x0000019177BD0000-0x0000019177BE0000-memory.dmp

Download

memory/5104-437-0x0000019177BD0000-0x0000019177BE0000-memory.dmp

Download

memory/5104-438-0x0000019177BD0000-0x0000019177BE0000-memory.dmp

Download

memory/5104-439-0x0000019177BD0000-0x0000019177BE0000-memory.dmp

Download

memory/5104-435-0x0000019177BD0000-0x0000019177BE0000-memory.dmp

Download

memory/5104-427-0x0000019177BD0000-0x0000019177BE0000-memory.dmp

Download

memory/5104-428-0x0000019177BD0000-0x0000019177BE0000-memory.dmp

Download

memory/5104-429-0x0000019177BD0000-0x0000019177BE0000-memory.dmp

Download

memory/5104-426-0x0000019177BD0000-0x0000019177BE0000-memory.dmp

Download

memory/5104-425-0x0000019177BD0000-0x0000019177BE0000-memory.dmp

Download

memory/5104-424-0x0000019177BD0000-0x0000019177BE0000-memory.dmp

Download

memory/5104-415-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5104-164-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5112-143-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5112-145-0x0000000140000000-0x00000001401C0000-memory.dmp

Download