3911a409e0742dcb34dac4abca66b2df6874b8b2472d07c7f1e10a072665dc72

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 15:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Size 1.5MB
Sample260929-slw8astalg
SHA256 3911a409e0742dcb34dac4abca66b2df6874b8b2472d07c7f1e10a072665dc72
MD5 ddc990c7183dce488341b4964889b3b2
SHA1 19c810ea2ad6f3dd015dba44a48d3959baad15f8
SHA512 1e7471ed94a5424950f1fe53f188500f4356e028380cbc0dd1a80b8e90b6ab4761b94a90a1c921247c511ca9c039aa43f77997aec48b87cb571c26b58dd47497
SSDEEP 24576:gIvkr33fJ4yL/tNCJPXUQrPj7eR4MiPP/+XA8GSV7y6ggxbDngv/S2:ur33fJ4klKXnrq0PWj37y63bTgv/S2
TLSH
T15E65237CB5C09472CDB20D3902D4C3725B2C7EB017B951C7E3966AB9AF38792212E65B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery macro spyware stealer upx

Malware Config

Signatures

Suspicious Office macro 4 IoCs

Office document equipped with macros.

macro

resource
behavioral2/files/0x000d00000001c613-424.dat
behavioral2/files/0x000f00000001c453-425.dat
behavioral2/files/0x000f00000001c45c-428.dat
behavioral2/files/0x000e00000001c454-429.dat

Executes dropped EXE 10 IoCs

pid	Process
1704	elevation_service.exe
5964	maintenanceservice.exe
2424	OSE.EXE
5956	PerceptionSimulationService.exe
5712	perfhost.exe
4232	ReFsDedupSvc.exe
3052	SensorDataService.exe
2144	ssh-agent.exe
2976	AgentService.exe
2412	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
	\??\F:\	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ed4c1e7d3a35217a.bin	elevation_service.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5300-0-0x0000000000400000-0x00000000006F1000-memory.dmp	upx
behavioral2/memory/5300-62-0x0000000000400000-0x00000000006F1000-memory.dmp	upx
behavioral2/files/0x000100000000934f-377.dat	upx
behavioral2/files/0x00010000000093de-378.dat	upx
behavioral2/files/0x0001000000009952-379.dat	upx
behavioral2/files/0x000100000001b93c-381.dat	upx
behavioral2/files/0x0001000000009396-391.dat	upx
behavioral2/files/0x000100000000627a-397.dat	upx
behavioral2/files/0x000100000000bd44-396.dat	upx
behavioral2/files/0x0001000000006223-395.dat	upx
behavioral2/files/0x000100000000a319-394.dat	upx
behavioral2/files/0x000100000000a304-393.dat	upx
behavioral2/files/0x000100000000a2c1-392.dat	upx
behavioral2/files/0x000100000000a1d4-390.dat	upx
behavioral2/files/0x000100000000a0ce-389.dat	upx
behavioral2/files/0x000100000000ba34-388.dat	upx
behavioral2/files/0x0001000000006215-386.dat	upx
behavioral2/files/0x0001000000009b92-385.dat	upx
behavioral2/files/0x0001000000009cfe-383.dat	upx
behavioral2/files/0x0001000000009cd6-382.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000076c740272550dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e7a553602550dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007aa152252550dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ab1528272550dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000f6a07b332550dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 59 IoCs

pid	Process
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
1704	elevation_service.exe
1704	elevation_service.exe
1704	elevation_service.exe
1704	elevation_service.exe
1704	elevation_service.exe
1704	elevation_service.exe
1704	elevation_service.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeAssignPrimaryTokenPrivilege	2976	AgentService.exe
Token: SeBackupPrivilege	4232	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4232	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4232	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4232	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4232	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4232	ReFsDedupSvc.exe
Token: 33	2412	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2412	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2412	SearchIndexer.exe
Token: SeBackupPrivilege	4232	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4232	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4232	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4232	ReFsDedupSvc.exe
Token: SeDebugPrivilege	5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	1704	elevation_service.exe
Token: SeDebugPrivilege	5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	5300	2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 768	2412	SearchIndexer.exe	99
PID 2412 wrote to memory of 1336	2412	SearchIndexer.exe	100
PID 2412 wrote to memory of 3664	2412	SearchIndexer.exe	101
PID 2412 wrote to memory of 1084	2412	SearchIndexer.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ddc990c7183dce488341b4964889b3b2_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5300

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1704

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5964

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2424

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5956

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5712

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4232

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3052

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2144

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2976

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:768
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1336
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3664
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2760 2944 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WCChromeNativeMessagingHost.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe
Size 703KB
SHA256 be19250c1a7f5927139a09f031e5ed10ad515a739f2b5c0d380fa19595708cc6
MD5 3cafae41da9c43b783bcca3e51268176
SHA1 a9383d8102446de68262bab47e0cb4ecbedbef9b
SHA512 b2471dbf81e2afc24ea94245baa7c5f2968b792bfc5729cf9eb76f8240b4d7a7d4253a5d8f1044c3ad7fae18e2b7dab27d91a20bcc56821a848dadd1db44852f
SSDEEP 12288:Gk9WbzIlafGfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S7:i8gfGfJ4yL/tNCJPXUQrPs
TLSH
T168E40252F3C7C5B7E55202B00868EB658268FEB81B3251EBF3C57A1B2EB42C31475667
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eula.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe
Size 650KB
SHA256 738e8ec20fdc8f4c709eadffcff0935cff0a1e0b1e59c1f10b02b458b1f71042
MD5 0ebb5536a1d6650d0b2dbac932fbac8c
SHA1 97ff66ee3af97b47a8b980c6a4411b2358e7826f
SHA512 e46608c6acf2b9d95fa5ad2cb4e06c17b40fd1f3a0a44b32871a3b14e066f405b5b4fc37cb95d03133e98f60ba4e85ccc3c1ad6b26b76c812af9f576ced6e443
SSDEEP 12288:ifJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SD:ifJ4yL/tNCJPXUQrPU
TLSH
T131E4129376D0D462CBA203B41E58F352835FFAB55A3AD363BB85274F6EF88460C4C652
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FullTrustNotifier.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
Size 771KB
SHA256 104601e90c53f37358d352b9fc36cdded0c68e6e35bb33db276094d1d839a171
MD5 8c09aee4fb35fd1adae04b08aae53565
SHA1 ef19a3f7255d0a0f406fbea7f6f57cf11d66bdcb
SHA512 3da45bd9127550dda1f765cb72ee96672dfe990de4ea4a4a60708da4eb4752b9959ac12c42c75673b4cb7d06aacc63cbb59090ed7a989e9fbaa9c3b12acffcaa
SSDEEP 12288:exY+FUBVfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SH:eO+qBVfJ4yL/tNCJPXUQrP4
TLSH
T16FF4F0313686C57BEA9301B04CECEABF901DBE890F6951D7F3884B5A2EB05D32E31556
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LogTransport2.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe
Size 904KB
SHA256 465aee18cf8bbc48a2c3ebb0dfafeecc29ce424b7b620f393f19515ea7054a77
MD5 fa79b4603d8ca71b2b6659088dd4dd15
SHA1 edebd3589c92e68ac01fdcc59160569a8ba16ec9
SHA512 86522054715578a9980e239f5871faf0d6b0ded21cfbb8a236d6306e02f5d7ecfb1744e62adbc951bc7afd4c45d4b2c32df6ff7cf65ff05e31ce45d6fbb47e7e
SSDEEP 12288:TqwKoHSDeWTRW8fde6fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sd:pKoyDZTRW8fde6fJ4yL/tNCJPXUQrPK
TLSH
T169150111F786C1B2DD6602714E99A31CC1ADB9A14F3697D3E3D86F0E6EB00D29931BC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arh.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
Size 644KB
SHA256 3efabb6cf5c5a4fb208e711f3fb13eace7e4a66045c1d9a2c1eb86dc291603f7
MD5 4a61dec34def92177e136f9c1ef69d48
SHA1 69daca9f5e6c563e20236def59780d2211f95af0
SHA512 31dd2d4c4cfe7e62d6fdabfa5a468dd0256435040d322f6a86b6caddcc044d7bb623286784c1edfaf27e2c44e3f267fa7b298a5476cd1678b265398f4f158acd
SSDEEP 12288:BYmIjE7rfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sp:77rfJ4yL/tNCJPXUQrPa
TLSH
T1DFE422A731D0D032CC9286B8060CD151CB2E7DB2666AD193FB816A573FF8795D66D323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe
Size 662KB
SHA256 7404771d95516fe65140267ceb0c9218034b1b2217393450328bd0b76cd3b37f
MD5 ee03efd9d13c72b701a09cf730042e2e
SHA1 9de5646a1dc20186c3b958958b5c76915ca0f920
SHA512 c4e0702f2d420edee70fbbc0d5ad9b8c8ef0b7f2701d571dcef3609cb26ca6ce69531a1af63cb5554a44d198141cdb87b180981bff5b514749e1cd9219d67bd9
SSDEEP 12288:f5AXfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SG:fgfJ4yL/tNCJPXUQrPp
TLSH
T12DE41362B0C194B1DA6542B10E5CF34AD118FDB40B3791E3F3C45E6A7EB81C35BB66A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

64BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe
Size 796KB
SHA256 19c72a0047ed91a4e0375488936c5f05273e1aca018a008b2cfad63b3abd8e6d
MD5 bc6e7f0128a7bf575851c893aca8f138
SHA1 60c6973cfd9fd48867421c88c1ae5069dc440660
SHA512 d5629b7cf4dc297ef90297243840d0a3a3fa8a2754f1c98fb73f64e0a7c34194878dcf41346d266ce7ed9d54a8961343deb1905353932db791b0469689cdac4d
SSDEEP 12288:5ZKK9HMYcy5fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SZ:XZ+qfJ4yL/tNCJPXUQrPq
TLSH
T1E705F15A33D88CF5E467C2798A819142E3717C850B35E3CB6750426ABFB7AE06E3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
Size 611KB
SHA256 19a25d5f66a85b04ecf149cd774cdebe9a8d5cd30a62529d916e5fbbaddbba9e
MD5 ed003c6277836aca2215380d475144b7
SHA1 c1d3b9b92a3dc2df506ef1b3fc18208de7971642
SHA512 db57acff8d1a96d0878e721d123b7cbfc86797fa41e66eeeaa81f8cee8a9904f9501bce29385737dd3cd96174eede9bb2345bfb388a29e050a93e9c847cb9c3e
SSDEEP 12288:TFQHfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sv:JQHfJ4yL/tNCJPXUQrPU
TLSH
T1C5D422573682DA53CD5182F40988E360D329FE90AF1B63E39B4264476EFC5C618B936F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wow_helper.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
Size 666KB
SHA256 d77b72887b172446a5edd2e44e3e24e8a856a18fca912641052e733c1351efef
MD5 6380b9805912a03238476fab83e71c5d
SHA1 30e59057f7feecd1f377d433287e38f305eb40ce
SHA512 7699e06d849e72f72fa8310a885468944522ace1695e5917b66b4b2cba7ad92a1e292d399bbcdb8b0edbc3a97d134ff019ad663df8686cffb31114ab2e31cb98
SSDEEP 12288:KpQl8HovfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SN:vhvfJ4yL/tNCJPXUQrPS
TLSH
T1C8E412AB32E530F8E97686B889509100D731BCB91B3693EF4B9051963FBB6914D3DB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
Size 1.7MB
SHA256 7c795fa4e43f51a94e0cd9468c7d4cea36e4a1de1c7fe432a20a2620546f12ca
MD5 9b4801d2bb41db83414f5cc85d8522d6
SHA1 161791d6176b3832b12c3b89bb431215326587c3
SHA512 29bcf924165512921698be85b93b4f73d28d2784eb1ee508ee0dacf8470fd6b5227dd1210fb72e1810c3155b195866e769adc81fd7105e7b7c14a840588cd658
SSDEEP 49152:lSgouvAeFfenxyQHXS7uQ0NItfJ4klKXns:lS1uxaxbS7uufJ4k
TLSH
T142855A0267F94129F1F37B71EEB993645A77BCA1AE3AC10E5280125E0DB4A90DE71733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
Size 973KB
SHA256 67af3ec3e06cc22f514fa2a4bf2a4ee51f3215a1d708b1dab1d1e502874c7a3b
MD5 a2993704d3bf67ad48baa977ad5bb9ec
SHA1 340406a7a9c516458fe2f3f50903eca783b249e4
SHA512 eb47027e338060673f563475019ffe3017329625d71c7d51d93fac61e7ea9c7a2958c8762580212d8eae8e64e6a244e91b749e369d3d2a0c7ee1669b54c7e181
SSDEEP 12288:o6dVWnxlMnn7nFKbltn+Ch/m6XbfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+b:z/TAbD+OmebfJ4yL/tNCJPXUQrP0
TLSH
T13125E01133D0C035F5B319764ABFE324552DBDA11F6982CFE3881A6E5EB06E1AA3471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaureg.exe

Path C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe
Size 1.0MB
SHA256 863a0a9a6ece7a15893411d41ecc8cfa565a7cad62f4c6ef4c1214b0db29573c
MD5 bfe204a10c7629d5eb8c34fec1e1bf7d
SHA1 f1c47acf33902563009782892ce3039026a5ffcf
SHA512 017550f53b14b119482ddb5986b76710269ac9a415dbb3669ea54b3195cc106756833ec4158926a74a59ac70aa54dc1391f1568e3fa8689e587757ca279ed682
SSDEEP 24576:hJ7RKDjjg/PzNWyrRfJ4yL/tNCJPXUQrPq:rUjiPDrRfJ4klKXni
TLSH
T1B335F12534A0C072D67312340D59E794A73EFAB04A2745E7B7C4AEBD3F345C1EB286A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
Size 841KB
SHA256 c90d97ad93bc12f7e5e4504851dffc7e867c2373b6fa3dbac598adb98060932e
MD5 599378ad5d5ab1c5b295049323203cfc
SHA1 e0f88ac2163156d288ffedfc4623941cb7c35d85
SHA512 5d16062eaf900aa16536a683b93de938e593762ea05e7b00a1c95a5b6203c4033be5121ec9b6694070c3c8a1852db42728f978f0f1bc93a0f83d9198bbf729cb
SSDEEP 12288:uiZwbDzzFEoS2cPvykfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sc:RZM3zFVSOkfJ4yL/tNCJPXUQrPn
TLSH
T1870501A5B39018F8EC67827D8954D902D3B27C9A0B70C25F07A436676F773A11C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe
Size 841KB
SHA256 869c06d8440a62a535d1fd1c9f1a24ea654de43ca3c7060df30a01b35f1381d7
MD5 5ec1ff8a45977b22be7fe15a145dc410
SHA1 809e6c67cf790a48bebb66ee654ad3740ef897d3
SHA512 92852ce7400459bbc2d8a8f6d48ddac90cf2d604e09458403b277dd4c2dd3effbda554665af5dd87c5e844ddd1bf9ed1c326707a2bc8fcc81a0e837729805c86
SSDEEP 12288:DCd91WYoaLHF3z0z04PDvhCfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTW:uT8aLl3z0zDCfJ4yL/tNCJPXUQrPa
TLSH
T1280501A9B39018F8EC67827ECD549502D3B27C9A0770C25F07A436676F773A11C2DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe
Size 1020KB
SHA256 6b908934324e0e88920ce914a10f827944fd9f0d3dab1d23ee8d0d09bbc71385
MD5 e7d6acd217264e9df0791b6210c92dd5
SHA1 2bae67d2fc2142ee2e593d87a1da027bb92f0bd3
SHA512 b24bedc0c0838c4dc57aded72961663bd55dc9f53471c78fca858ed29540fac61f983199cf05d3d1b605e6ba4e7ce0fe16d8ffc44891b86dad22720d03d494eb
SSDEEP 12288:bi4e7+RdTfgwCHKy7GLbbdIvrfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGV:b3rd9CHKy7GZGfJ4yL/tNCJPXUQrPi
TLSH
T18425CF91F3E410E8F1B7CA758D659502DA767C9A1B31DA8F03A4255A2F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

disabledupdater.exe

Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe
Size 6.2MB
SHA256 6d132e323654d27fb918496dec429f23d1d9ce24a82bc10f220ac2ba4335daff
MD5 f5acb59bff469cc469a5069f617ac6b7
SHA1 e9b252c008d95f3e7c33823bd4e5e9d333114dcc
SHA512 1082c983755bf7087cbf7363703b98cba9b305a8a486c6b09f75d3531e39ce9b524c095f9c12c410ce2ed9e50add9c2dab5f0da42aaa65f615d64f7a72351ba8
SSDEEP 196608:9og1P9fIlOu/6IgF+I3m2MXP6HG8QzyfJ4:9ognqOo6IgF+qbM/6HG8Q2
TLSH
T1A7668C23A4E04035E5F733756D2CA7395A327BA29F3145CB86906C946FB83D3293936B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisabledGoogleUpdate.exe

Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
Size 6.2MB
SHA256 d968c38347eab4d85cfb32db6f06f41335efa05edcf8eac57a1b646d24c4583a
MD5 8a50fec51e8250f6627aa658dcace863
SHA1 9007d6c7f1bc0c793b5cae5b1cb47848b641fdaf
SHA512 4b6633bc4ca35af7b696d60d5d4667ee07f8e9a21489a066c5abe749afdd15e4757a0de77319afd3e60e34e906f270a6ac7fe24b3cd3ac723be9b07e5ec1f935
SSDEEP 196608:aog1P9fIlOu/6IgF+I3m2MXP6HG8QzyfJ4:aognqOo6IgF+qbM/6HG8Q2
TLSH
T10C668C23A4E04035E5F733756D2CA7395A327BA29F3145CB86906C946FB83D3293936B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f71f880a18c7c99dad3b2fae59d78073c737d39de05d8cea1dddfcbb995d0e94
MD5 f417b7e2defec35ca7d74fec5244a1c0
SHA1 94921a7d4f7b5c2a589062c743fe2df4dfe83724
SHA512 1f49c76a132a97381f86a1994ec610d8de63420dcff8be7eef00b94740e03215c95fe2e382fc828039d04b1be48083ee678be910d2116952b69f811ff0747b91
SSDEEP 49152:Fb+632BuPkFKRrdE6ohdstBhuXjfS4LWxn6fJ4klKXnf:b3q6mjB9fJ4k
TLSH
T1DAD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 88ef09de18926a94595f16c92536fe3599c3e524c4316b685936cb306d96b8dc
MD5 62d00be92e64e335d3fd985748e65f57
SHA1 d50de26d29946df5afaddfe471b5e859799e9e43
SHA512 47e5300182a89d559fe93b522544a6d0ea8e26afd611603c587a47e9cf5b1f56d9ad3549bca13a31cd57fdfc7ad0b96d6af0f290d107098dd4b77e743f450cb3
SSDEEP 24576:aXYAbGczA5fJ4yL/tNCJPXUQrPu/eR4MiPP/+XA8GSV7y6ggxbDngv/S2:MGcYfJ4klKXnmG0PWj37y63bTgv/S2
TLSH
T18575126873D018F9DEA7827C8A91C102EB327C8103B4E38B03E599655F777992D7E792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 14f3872f16cdd17aeb10c8c98283b7fedfbbc6b8cbdb1375cbdeb962a03f2779
MD5 27d3befe35661f47692580266cfb7b4c
SHA1 3e3c3e9d8ed1a7ad6c30ba5cf92dde8868c78261
SHA512 ceac4eaeda378d3389edc01a58cf486a1a42241b2bb9017d4e7b95a6f33426c0f0dd21c6b1fdf7cd5a18ae74a14df28d034c00d49d8495b94347ca35ba207092
SSDEEP 12288:z1XLsswWkxy2lRq2czA5fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SF:pXYfDtczA5fJ4yL/tNCJPXUQrPu
TLSH
T10405F12973D008F9ED67827CC9A1C101E732BC954764E7DB03A099662F776D81E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 940d7bbd0636d87867cb57d8e3205b77c0266e6a0c05a16eb684c9eee52651e6
MD5 18dd038b7a5240752238d6817826343b
SHA1 70ea260a8438ea0e998530158f80dc6f37646f28
SHA512 7f85afcefbcc6d421654a1afad8af9ef60221f411031b6ed9b79bce6e877ce51d16221338010d19397a94cd26e361d8e34ca42777b3906fe666b2e424ac9b733
SSDEEP 12288:bmw5HEjsChNEBFgl0WDm+CIfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT0:6wuROWHfJ4yL/tNCJPXUQrPw
TLSH
T13D05F14A32E41CF9E96782788687D132F7B2BC422A26D71F4760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 3.0MB
SHA256 dcd63b0a0ce1f973bd5bb118fe1c44a919d21d9d5355e7b59fadc6e7afb2ee62
MD5 1afb05d6c37fab30a0e65db9e02c11a8
SHA1 ee95fe5094cc9d405cb50cf18f41752cdf215f0d
SHA512 a775a69177455c451038d3540d416bb51d3b963fbc9c50b35c548131d2120d74f4ef93b756aad87559bf6720a06714542deb38c0d62682888b63684b0dbbae96
SSDEEP 49152:oB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glj0PWj37y63bTgv/S2:iu6JmTxd2djrj37n3YS2
TLSH
T1B6E5AD13F1DA01E8D06AD478974A9233EA62BC490B35B6DF0B9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 d63793d276a80a7423b922f61260e91a10a90fd935471e1ac8daa96944aac3a6
MD5 f6bddc9a7908fd4022887c51941084f2
SHA1 434c1c4a49ce84683265602dc49a972de3f5e44e
SHA512 b2f5d9c75f626d90fd1962ecacea797478855218a9c5a52c696ba11c3e9d5327b3b83277f84db545c6703b0308b88ba3baf3d85293541c4c0d63efecb1010fb8
SSDEEP 24576:/Vwvrk9RX6wkyAImfJ4yL/tNCJPXUQrP7seR4MiPP/+XA8GSV7y6ggxbDngv/S2:EMnYImfJ4klKXnD10PWj37y63bTgv/S2
TLSH
T15E85F129EBC808E5D1B7827C99A78206F7B178591B71C2CF029A52AD0F37FD46D39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 4.3MB
SHA256 220c955d799f9a1af6b7acd690078f7d7a5285e13964ef38ac0f934fcb3d1a3a
MD5 a047ea89bdf8011a5ce0a570e9a0a826
SHA1 156481a4acfb12716c909b4004b16200bc01097f
SHA512 18af101c4badb62787eb73f1f1c8a1668f6be015694b6c1c14a5ff0c9107b7f993dd7cccad8f07aed3667d43df0d7997bd13b3c39b8ec3d1d8010237a8338524
SSDEEP 49152:RYqWNpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0ZfJ4klKXnPf0d:4ySzPhfJ4korj37n3YS2
TLSH
T148269E96A1A801D5C1B9C1B98B0BCC17FB7134490335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 d2fd1dc1da87d75767b953e2c1359348fe76403c863983aa4249bcda3cd7f0b7
MD5 4dc2f9ed918232b9763fb8fe05a90961
SHA1 365460723b556c11d236beb81bcce74fda666be0
SHA512 def6cf155ceeecc1c656aceff0cb13aa383880b45a7fb17b40febe3d1d564bb365576ffd7c279c6a1dceadb10642d68a3bba4d2103bfea9b36bfa08b5e3ab55f
SSDEEP 49152:2t7JUQjAirIhCnDHUPfF/pfJ4klKXn290PWj37y63bTgv/S2:cJiglD0PHfJ4kjrj37n3YS2
TLSH
T15BB5D01DA3EC01E5D1BA82788645861AEB71782E1B32C6CF2270827D6F67FD45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 430d14fa81a444c233c5d212a0a84c74d8782c2223178031131f18a500e356a4
MD5 73c4164608c8cf81b93cfd95f4a1a19e
SHA1 764ceff4a15f8114669805facfe2238d07736812
SHA512 32acdd4e13456ca20edb34adf071b5137c69ba9c14ae6eb5591e7ffc1014641e3f26b912b9bd1370de3b3068a37a5905b92e8fd1c512ae47c7b5b2062c69d04e
SSDEEP 12288:ccrOcVBqSg91zF1iw5hiBu2kvTIHsaawRMs1iQVxcT1:cSbVeSB0IHMwRMsYQVxc
TLSH
T1FA5529107626CB4FC66940321E36D2CCAB707D41EE056F1373C98B3F9576A59BAF2291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 990ed3a96677b23147e9a2ad97c59d76c5d00f2b16bd46ac1d5b264efd8cbaa3
MD5 273f9943f671ab55c03486ec89d8f591
SHA1 1c4f7a94a4d3afbe9a2ee847d43e11f903a911ed
SHA512 6f004f85ea1989e4dafc0d66cb80471ee9f7b334e353e334ec645e1358c8dfeb7adda78fae0fed0c1e5f0dc36afe1aa0e278fdc04b4a615924a943918ff1de78
SSDEEP 6144:7QkQx+xW09+NVloEigY6KDeoHw6KDeoHoLC7eGSN5hHjGw:7JsCW09+OoYYgLN5hHj
TLSH
T1F945C741A137A68FD1B76071072A5F8DA764EC07B7496F36738E053ED86BB41A0B83C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertToWait.docm

Path C:\Users\Admin\Desktop\ConvertToWait.docm
Size 778KB
SHA256 5b1adc5c2b44d6b947aa2ab7df08ae5fbd09f6e208c6f9ddd89903f09d3493cc
MD5 4c5ff8d25c9f2938db63718e92ddd22c
SHA1 cc2f44469fb6961475023224d0552545048adb6d
SHA512 1c21231f0356b9c72b715af8c322e67b2e2a8dab15593545315daecc9ada68510cab8fbbe0f548402ab0ac7221fa7126cd1f4c42e98374aa98c2ff7b432db32d
SSDEEP 24576:eSOiP7jn6kPDMDag5gdCpdISrsDyxvXJYHzPA7:eSTj6SMZqdujADyNXJS0
TLSH
T17F0523582E81DDF8EA1507B5B1BE558980EF076719D78AE0E719A3730BF81E74B23123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MountOpen.docm

Path C:\Users\Admin\Desktop\MountOpen.docm
Size 771KB
SHA256 b1bfe986c5b198214a8dc6a6760ccba199afac82c94fa2e1db0f23e2f6b02a91
MD5 ddbdae9a88f3f64b9c59423016798216
SHA1 6927812a5cf9e3df4756b4c423ff8e6abb76dc01
SHA512 9c2466bdb88827e8058e4e952c1c2fabdc58e02097bdf18b16229f86e0c9034ebbda4b97c12b5511e3712fa0f512150ef2ef0604a215422e80b5308b88b2035a
SSDEEP 24576:LJdNubzTpSBago0aY8sUSuQnSCZuPXzUW:LJ8zTpSBVo3YUSuCNgXzz
TLSH
T14DF4238D26CB13F0F9F74F39A8A342E395FC521BA219D652565613C86DDF73D1203A88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OutRepair.docm

Path C:\Users\Admin\Documents\OutRepair.docm
Size 772KB
SHA256 f536571c837c4d830ca58dd6e19245827d1c8272c870aecce8d9757e8317bd01
MD5 0c05f9bc9c2d92d6a9375cc6f54157a3
SHA1 36c59e39c0612e279d82e984602955476dcc9b98
SHA512 d7c85f01096e41bd37e7170eabd2e3dab6166a58f4722c7f9590150c722a7c12cf723b8c7e9e61a4d4188b40aeddbbfabb9892eeb1c9f235ab1dc810106a5eea
SSDEEP 24576:3io6lj5wZvuCMM5j0oXTeBrF3xaZm3GVaOCp0:3io61aZf5IojeVF3L3GEK
TLSH
T18FF43324C9397611D55367798E2E678029BFAB4629B36EF7437C72BC3C6E4E4200CAC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartResume.docm

Path C:\Users\Admin\Documents\StartResume.docm
Size 778KB
SHA256 e9a84e4662deeabed09f574c20e89dfb64306556bff31ec8322b0035b2ae6d53
MD5 6c7408d04841028f0bde02b24584e632
SHA1 8d1105c412a464f05905ce8b9d7a749f228be2c3
SHA512 2a0b66ad703124bbf4fd7811783639c8566d818e43564be59e22ce47c5a952f2e3ec777fad1d772b43634f030da1bb3633e75b3e5d65868b33168b811617644e
SSDEEP 12288:lVuHZO153NFidpdjiT/7Y6PfmE6ngo0xoZsBjAhsYZu1FnwZN1we4FHNK5xID67y:nuHZOG7jH6nmXngo0aZua22MC5x2Y7H+
TLSH
T1E805233ECB8609E0CE615A3DDC65973BE9E70B27DC85DA6296287B4440C756A3033F4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 1013KB
SHA256 a904b22eb0b5e1badc11ebf8d1637fa02044cd09dc74c309326ad9987da5ecaa
MD5 97b79757dcaf0fbe3f7388352c1a1443
SHA1 9027053b5c7e7e205cd23e842356fdae4e806af5
SHA512 809eeb167981c9259642d1f95cc2bc40a6e1939d5f7564e15f06962ef248eb13b17f1819ede9df34d94df7567d283c9db9555868e1b258c93cf8a36d2c8a4e60
SSDEEP 12288:M85bM3n3xYfj63hgD1ZiKfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sv:+3n3i63i/fJ4yL/tNCJPXUQrPE
TLSH
T1E925BE1273E99135F6F31B31AFB492514A7ABC629D39D20F23C4290D1DB0A90EA75B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 70388615dfaab1340b3164551331556363a3da6b703dfbd32a5e67a0deb01b0d
MD5 6079392e717d1b7eea379421995ac11f
SHA1 4deb11d553e3051879430ce71742790a251803a6
SHA512 3d9b568d838e83f6e1e0dfa6e2baf7e089ddbd8256fb5273c13830a358d879657d56a462081cef7a417c759ad19d5d4c4b4a6ef97265458cb1a6bb0212ea2df9
SSDEEP 12288:lM7CfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sg:eCfJ4yL/tNCJPXUQrPH
TLSH
T1B6D423A751C89846ED7587F8164CE000D309BED51B2BA2E7EE42B4857FFC98A1DBC352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 dc393a0ab94b18b06ee29e796d50ca814ef5ba6fa6f40a5274a406c79d8a0d71
MD5 e1d5cd692b8ccbaa676270e0fed0f4d7
SHA1 ea3473584c06242533a965057dc05cb619e3ae9f
SHA512 ffff01f4adf70c44ec6cbb379ed047c640657df98b2da983095f8342b6706a016ea5021669c3336117ed68370c517d1cb86e17cc2cc70d16acb24563f0f70c9f
SSDEEP 24576:mgb6bmBIi49WNNFpg1rSvFv7bYofJ4yL/tNCJPXUQrPF:mgb4mBIBhGFPfJ4klKXn9
TLSH
T15A65AF1E22EC02F5E0F9D2B89DAA4417D6B278160732D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 828KB
SHA256 bf98d03942aaf19a6b0865eafbf4b515a52d03d417d38625b8dced103a053372
MD5 b037389a4152b0af3febcc5d96ef0de3
SHA1 db3d58a2a1c74439ec1c7c25a75b9fba6b0cfb61
SHA512 eb8d6a6c5b7bc97ee1afa8e0352caf97797b21abd4a1876f22191ea1786bbe4fc5fdf36aa0311a76bfa8a68bb541f523c8da75036061c622bc57b80265cd088a
SSDEEP 12288:0YGQKH6KcgtY7MiSEnP6Ipf8fs+AXspUQhdV71O1PigGYPKtEkbk2niZv/bm+v:hGQeR4MiPP/+XA8GSV7y6ggxbDngv/S2
TLSH
T11805236C61E538E8CBF14E7A229681533BF13A9007A4A5EF03E791B8CF157E171B9D81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 5dfec287c4d57dc00b93645dec5902d7a710da5ce92b0cc5eff49425d7c2a91c
MD5 12d164f04a9cbbab9ac9c8b5acf774c3
SHA1 2319a73800a3d508fb04b4d114a6d35edaf41eb9
SHA512 277b31c182487d48224a607e4ed65b87decd8d3fb668ae402800b87f54d9bd8a5ba6e1034f8320e357c3b03f6a863bda72ac30faa50ad7080f35bc84c5ab6bed
SSDEEP 24576:XG88u8FpJqH1vzria7/m/fJ4yL/tNCJPXUQrPo:W7ZFPqVya7/AfJ4klKXng
TLSH
T10735026676E101F1D47BD1388A868663F771B8150335FBDF0BA88A512F23AD50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 0af1108d006ea7817f1834f7452b0ae39fd83579533c54960732ad7b1d4ce845
MD5 f34c4e91f7186af4bf176f5a61aadff9
SHA1 925b12762cec55592ae9847d47b1c8fb83ee5d52
SHA512 d167dc952385a4e7f573e5d9dce8e9fdf0f76a3702dd36d8fda888c4080a3d699b22333ada9ed573089a9cafc1aa7086edfe9f43a3a732653a54fa83ecae28d0
SSDEEP 49152:IBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjjfJ4klKXnt:jG05lO43b+fJ4k
TLSH
T1FED5CF6E62EC11F9D1BBC17CDAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c0d0efc8df5cfd4186859c560c6c302ac57122c8c65a76653b18d4498a60b2bc
MD5 37f6419026246f2d721c830a0d6b94e5
SHA1 6601ad8eaf99e0411d33dcdb467e105e21cd2b9f
SHA512 5bcd9578a0939de40bf9c561f585026270a19b6d1c104451a9557829ecb635e11a537a2f2dfe6f8f0976ac223e0048bc3488d22c39d347c0290364462c20c634
SSDEEP 24576:2fa5POZ3dpyWVM50JicR2hG0lasx2+47eidnZfJ4yL/tNCJPXUQrPo:ua5POZ3lJt2pasx2+mrfJ4klKXng
TLSH
T1A265BF5EA6FC00D5D579D17CC583861AF5B1346653329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 0a91b6a594dc025c183424d66f4621afbe21d72e29a6a1b1bcc513f0e419e0a8
MD5 dcaf97bde4990026e78c3070a89ad241
SHA1 85270eba63c210770f2fd32bfcd169098c8d0179
SHA512 57987da35664b8239332957c38a69262920ea974b2711a6cbe2fe78e2a1350db3bb685857d2055de6ceafd4ee28410966e56d57c47e5feab7fc810c1437923d1
SSDEEP 24576:vNcwHdjbyQ4nLC18lb/EOjowL7FknfJ4yL/tNCJPXUQrPp:vNc/zEOVHFgfJ4klKXnx
TLSH
T10C858B2623E901E4F5BBE1BE896B9546FA717865133486CF0291811B1F73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 c16abf707a367d1585c0e9a7b6acd2817bd9180ca7ef8bc7495a7dbb8acdd027
MD5 4d920d22394b1c11822c24c49b66c08a
SHA1 2d12395bda443457744ad3f81750c27d2c7d25f6
SHA512 750c4f704afc1bbc4b0bc7169af46ec5ac92c91c81e7eee3da81e3e625a6a3423c4e5c1b207216bb8c7922b8822e52d7a8a358fed1fb86ab427f770d6bf7c946
SSDEEP 24576:r6DIheR4MiPP/+XA8GSV7y6ggxbDngv/S2:r6DIo0PWj37y63bTgv/S2
TLSH
T10725025C63A620F5C2B7903E92834102D6B2B5A087A259CF07D9C5BD8FA3FD9B479E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 928KB
SHA256 ce3fdb13f143e294c4a33399e282789b4f9b31ed45ed5478555596e5f0a2aabe
MD5 f14952df3e80b476357b8f1421454d12
SHA1 501261b4049397459208968b111ed717725bc3ab
SHA512 effeed11fbbee69f3e6cc748e7f9e97c64c6f3c7ff3792bf93fbccb7c0a03aa73feb61be9db61589739346618bc1c5fe0cadc582c035e4804e057591f35b4d5b
SSDEEP 24576:LtyqeR4MiPP/+XA8GSV7y6ggxbDngv/S2:Lta0PWj37y63bTgv/S2
TLSH
T1C7152248A3D438E4DBF50A7957A782915F71BC100BB192CF23E2A26D4F36BD1B4B1B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 800KB
SHA256 9a8b176b9f0ca656c749678b70ca7a00e14b65c415e3d04c8502f672649cb4c0
MD5 a5af433a453b7c08d9916b5177418a82
SHA1 700ac97c7edc6261a9a656bef047aece22e75949
SHA512 a50628f14deec9d85e1311f6b8d29d9329f98dea996167adc068d86fc78735c2585c8b7a1cdd94959cb645654d9a829a28db650c290a0290211a6a4889f646b0
SSDEEP 12288:T9JKH6KcgtY7MiSEnP6Ipf8fs+AXspUQhdV71O1PigGYPKtEkbk2niZv/bm+v:pJeR4MiPP/+XA8GSV7y6ggxbDngv/S2
TLSH
T1B80523ACA2853CA5CBF10D7E238A424217F17A9407F595D723EBA1B8CF157D270F6982
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.4MB
SHA256 e9bbaf73f8577affe0214599024858332761eb975ea2b1668eebba18fc2b0ab9
MD5 0953078b2e2873d77b63a48681c3ac24
SHA1 231da3245d16530fc086f0a7af5dda553112fb29
SHA512 ee244be585398617527709408a0b9b038af81019bc093e44e7a1064b57f2a90647f9c2421eead743a7b93eeec321526c3e534d98920632d6ecadbbc13888fb57
SSDEEP 24576:Trgs4oTfaidZSeR4MiPP/+XA8GSV7y6ggxbDngv/S2:PgCTrZL0PWj37y63bTgv/S2
TLSH
T11665AE1D63EA19CAE2B2D639D9621493D633B4311772C6CF2548C03A4DABED8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.1MB
SHA256 d129bd69915cb2181cbfbd72a7b666f6279bc3f8d3a6c32b069085f1c98c3c94
MD5 b7a6c27fb9491e249e0bb104cb7358a1
SHA1 37e04cfe007853f80f38903ad00442b6ac8ebcd1
SHA512 5fde5f597ed0c3acc2b76e1f1cd90aa040ab987df18953e146e8ccdc3f123b714340ef14b451ebeb4632cd38ee045d84de2a94409feffe0283caf08f2a6f5c63
SSDEEP 49152:Zgb4mBIBhGFPfJ4klKXn930PWj37y63bTgv/S2:ZtQfJ4kmrj37n3YS2
TLSH
T1F6A5D01E22EC01F5E1F6D3B89DAA4407D6B278160732D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 373c234f4c0dd36a87a8d12e6a07e890cc8ef8ae9a3505a18120196d118bd08e
MD5 3a2bafa3e650a98e726e6f4897fa4e70
SHA1 628dd23e81a8f3301a9910f787d7bde52a416b1f
SHA512 5fd601bad0a059ffaa766de041375a9992451b0eb0b46803ca57c24a979d6ca2bd8440e22d8d0caa37d01e7e41cb9696caf85bc2af30fbd53ab4376cdd96a631
SSDEEP 24576:NTkNvNnaFeYhJNtmZBm1eR4MiPP/+XA8GSV7y6ggxbDngv/S2:NTMwBtOm00PWj37y63bTgv/S2
TLSH
T1F675C06EB6F815E4D1FACAB58E238512EA727451033293CB5390C13E4E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 86bd406957aaa195b02fa562f962b5aea8134f03a1abdcc3af2505a504671a6e
MD5 a7523a35ea9a3b83908abe486cc57b42
SHA1 8f3caa000fd684eedd4940e99204a259e4ac670e
SHA512 22b24e1a57b2b6422753641f1bb37f24f525a6f7c754eb8a45758a46553ba8fe1741a23d3f4012ae64195249138ac1702c978424c967bf8108778ea65975b26d
SSDEEP 12288:EHvUrBFrEjwaQzfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sl:EPUr+NQzfJ4yL/tNCJPXUQrP2
TLSH
T14905F16F22E818E5E676E17C89858209E771B8A21312D2DF02D1817E5F77EE87D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 8473677680a3373ea0ef374cd01a659dd41039a1cda612aad7eb8fd31b650bb7
MD5 3705140176f62ea3e2f8e611c263e866
SHA1 54917034c114ad6efb8dcf5bb933f2cd418c8eae
SHA512 bca0e346faab7f64302959c277eecbd987224df8b0ed19f86a6d069b59092f7213d5275f4fe798947e8744a5180a2ad13946f733ae82f7740390da35408d250e
SSDEEP 49152:qDVHeBIAAOfJ4klKXn+B0PWj37y63bTgv/S2:xfJ4kfrj37n3YS2
TLSH
T1FE85127DE69814E4D9BAC2BC96538602E77138E9033266CB02D181B95F6BFE43D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\system32\TieringEngineService.exe
Size 1.1MB
SHA256 9fc98e2753b95b5b75380175b6cbb0da1dcaaef073564de86227d6417fe16074
MD5 86482d91660e8e8f7170503f78dcf637
SHA1 42a32e55f6cae2509f7dfa6006c4eebd425fa5db
SHA512 b34c9df3b7c689ebddcd1da09b102542a9ff1ab99017ed98e59b29421b57941763fbc93c32ab5c88fe9a9678c7065edb184e7d0523078d3b2c291ba7a4146bbd
SSDEEP 24576:hJnJPbzB4SreR4MiPP/+XA8GSV7y6ggxbDngv/S2:hJnJv6S60PWj37y63bTgv/S2
TLSH
T18C35E13CD2A820E8D4B7C2B4425A175AFF71386D2B2169C71AB5D5343F12FE0A979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 792KB
SHA256 85641c69c4962089f26885969d044681e01bd3d0aa31086c30c20cb93fc00a5d
MD5 b25b8135ee9bf877012bb40636204736
SHA1 22e5faa14f41e4cf20522e598d0abb27b9495e51
SHA512 092e8ee78beaee4c5d4bda87af8be037e87a9f90e7a76c30b709d4ca9039735f2af8f82c52bbb1f1552dd1d38d3077569e2317ffb1f7330c1ecdbc62d6a97c4f
SSDEEP 12288:U2KH6KcgtY7MiSEnP6Ipf8fs+AXspUQhdV71O1PigGYPKtEkbk2niZv/bm+v:U2eR4MiPP/+XA8GSV7y6ggxbDngv/S2
TLSH
T14605239CE6853CA9CBF10D7A238B82421BE16B8407F595C363AF6188CF197D770F6592
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 936KB
SHA256 e6c41a930b4b462ebc0f4ea55f4b6127ee0e6f53d3e6a3e52cfeaed8ded422cb
MD5 c19db8050b47e405285a129a40f02245
SHA1 df7668f4f6daa8627c940d49f9e90c1d25200620
SHA512 e763850efdd2596936fa1965dcc66fceb094afd6950d6a9080f732bde0f7528d1f41ce8b04cec7496d8673078c78b7411b243ce1060a16d35809221471d25de0
SSDEEP 24576:v6UqjpueR4MiPP/+XA8GSV7y6ggxbDngv/S2:v6U00PWj37y63bTgv/S2
TLSH
T19F15239C62C038F9D6B50A34A696822247B17D6103F595DF33DA92BD8F32BD1A07BF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vssvc.exe

Path C:\Windows\system32\vssvc.exe
Size 2.1MB
SHA256 28147cd37a58f20691f238cd547aa052365740604d0616830c9ae05c644561f5
MD5 51f110a90c331a28667608a3c37042e8
SHA1 943ac5f502bbf9d3b522ef09a79b87f4c6451c77
SHA512 1c1bce7acb6cb7b5b30e5c72e82bf330b6a73620f9cc9d9329a92c54c5f5a279f545da2e3bce9ca8ec7b895f883ccaa5ed09e195e4429e534781fe9f081962fb
SSDEEP 49152:cCLHGeeV5ijCmlDWDk+0PWj37y63bTgv/S2:nArj37n3YS2
TLSH
T104A57C05E7EB5184E8F3CAF5CA2694169A327C449B34F7DF4A80CA6A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\system32\wbem\WmiApSrv.exe
Size 960KB
SHA256 a17179a6a267aa0bbe510fe46af1da265976f9f38a5c7ef19176c3812b635a05
MD5 dcf2f87ce3a49f09737de5b7a83d5913
SHA1 61d5bb056af5cad5719337fa212ac8fce8984326
SHA512 de02e9454725d9aff3dc11bbfa0d1eb13b03dfa79337eb1326fa06cfc9749c0e95a7a113d53c8d3ee1dedd1b774648656930797f0036dc806807fc22cda8b823
SSDEEP 24576:brcmRFeR4MiPP/+XA8GSV7y6ggxbDngv/S2:XcmRk0PWj37y63bTgv/S2
TLSH
T17125015DB2AE10E5D2B7813C89864242E7B3747013A267CF03A2C77D8F17AEA7935B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\system32\wbengine.exe
Size 2.2MB
SHA256 846843b4c3d6019bea297d98ea90d9048c1339e3b7a65cb2b6379158c7f64140
MD5 29240484baa28bdbeeb6d24d382e1a6e
SHA1 1dc28f1437d9143929df17ba784607187d1e005e
SHA512 2d6dcc8aad09a6b5f5b00c0b8bdbdb3ad6144e8ea71b6e82c5403ea58c22fbff740d170433c722f3e48d94428025a1e7da232fcf701ee2806f1219ceec252042
SSDEEP 49152:6DL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3F0PWj37y63bTgv/S2:73Upow8sB6rj37n3YS2
TLSH
T11DB59D3DA2E810A8C9AAC379C54213A6EA71782D3F3055DB0174C178BF1BEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1704-40-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1704-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1704-41-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1704-110-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1704-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2144-351-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2144-125-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2144-131-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2144-123-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2412-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2412-159-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2412-152-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2412-361-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2424-63-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2424-64-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2424-71-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2424-178-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2424-70-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2976-137-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2976-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2976-145-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2976-147-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2976-143-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3052-347-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3052-118-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3052-112-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3052-352-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3052-354-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3052-111-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4232-99-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4232-346-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4232-366-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4232-364-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4232-98-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4232-105-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5300-62-0x0000000000400000-0x00000000006F1000-memory.dmp

Download

memory/5300-2-0x0000000000D10000-0x0000000000D95000-memory.dmp

Download

memory/5300-13-0x0000000003130000-0x0000000003197000-memory.dmp

Download

memory/5300-20-0x0000000003130000-0x0000000003197000-memory.dmp

Download

memory/5300-0-0x0000000000400000-0x00000000006F1000-memory.dmp

Download

memory/5300-6-0x0000000000D10000-0x0000000000D95000-memory.dmp

Download

memory/5712-332-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5712-89-0x0000000000910000-0x0000000000977000-memory.dmp

Download

memory/5712-94-0x0000000000910000-0x0000000000977000-memory.dmp

Download

memory/5712-88-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5956-75-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5956-77-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/5956-298-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5956-85-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/5964-58-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5964-55-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5964-47-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5964-46-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5964-60-0x0000000140000000-0x00000001400D5000-memory.dmp

Download