d91d86fc1b3ee9e9b976202138f91d7f12e73513c0297e33dc3a0064d6907cb2

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/09/2026, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Size 1.5MB
Sample260929-vm5bea1tev
SHA256 d91d86fc1b3ee9e9b976202138f91d7f12e73513c0297e33dc3a0064d6907cb2
MD5 c3e84c022ab46541615eba67b8d0ee83
SHA1 a9cac6eeb00513c4ee3cd48758ca815e87e1deb5
SHA512 44ec7c86f838bdad279bd642f3eee9a5aca556d744414171882b029361879404254f37300d01f871a3a04a729abcc049d7d7f9cbca6e3e686167df35e4cfb060
SSDEEP 24576:99bkrEMfJ4yL/tNCJPXUQrP2XcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:ArEMfJ4klKXnOMkYej15VHW
TLSH
T11A652369B9C0C1B2C461193806E0D3705B3C7EB03B69A197E7C22EB57F752921B1CB7A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery macro ransomware spyware stealer upx

Malware Config

Signatures

Suspicious Office macro 4 IoCs

Office document equipped with macros.

macro

resource
behavioral1/files/0x00090000000240fb-470.dat
behavioral1/files/0x000b000000024159-471.dat
behavioral1/files/0x000a000000024134-472.dat
behavioral1/files/0x000a000000024132-473.dat

Executes dropped EXE 18 IoCs

pid	Process
5100	elevation_service.exe
2524	maintenanceservice.exe
1240	msdtc.exe
2796	OSE.EXE
4288	PerceptionSimulationService.exe
1516	perfhost.exe
1488	locator.exe
4872	SensorDataService.exe
408	snmptrap.exe
4680	spectrum.exe
2292	ssh-agent.exe
3040	TieringEngineService.exe
940	AgentService.exe
512	vds.exe
3216	vssvc.exe
1460	wbengine.exe
208	WmiApSrv.exe
4244	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
\??\F:\	elevation_service.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\184a9abf250d612b.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2032-0-0x0000000000400000-0x00000000006F1000-memory.dmp	upx
behavioral1/memory/2032-74-0x0000000000400000-0x00000000006F1000-memory.dmp	upx
behavioral1/files/0x000100000001701b-476.dat	upx
behavioral1/files/0x0001000000017815-484.dat	upx
behavioral1/files/0x000100000000c540-482.dat	upx
behavioral1/files/0x00010000000232af-481.dat	upx
behavioral1/files/0x0001000000017430-479.dat	upx
behavioral1/files/0x0001000000017bd3-478.dat	upx
behavioral1/files/0x0001000000017062-477.dat	upx
behavioral1/files/0x0001000000016794-487.dat	upx
behavioral1/files/0x000100000001704b-485.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000c626d123550dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fb8577143550dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cd0bcd0f3550dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000078a770113550dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cb0b19133550dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeRestorePrivilege	3040	TieringEngineService.exe
Token: SeManageVolumePrivilege	3040	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	940	AgentService.exe
Token: SeBackupPrivilege	3216	vssvc.exe
Token: SeRestorePrivilege	3216	vssvc.exe
Token: SeAuditPrivilege	3216	vssvc.exe
Token: SeBackupPrivilege	1460	wbengine.exe
Token: SeRestorePrivilege	1460	wbengine.exe
Token: SeSecurityPrivilege	1460	wbengine.exe
Token: 33	4244	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeDebugPrivilege	2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	2032	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	5100	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 4220	4244	SearchIndexer.exe	118
PID 4244 wrote to memory of 4984	4244	SearchIndexer.exe	119

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2032

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:5100

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2524

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1240

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2796

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4288

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1516

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1488

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4872

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:408

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4680

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2292

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3616

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:940

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:512

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3216

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1460

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:208

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4220
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 804 808 816 8192 812 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 80fb3fb099bfec20fc269fc89178b8a9fb4ccd653779cb745657bc84324fff9d
MD5 e8292d0057d24ecfeb62ba4648eace2f
SHA1 2f79e454b5ba7adddf4fdaabe9623fd9b24e5bb5
SHA512 52ad193ee6a715c1708926176df78959f2264e5a6ae4dc082ddd388a9fc1dc3dab81d5515030103fae27bb2871af98201c8ddb014f050bf6b9e7a8d7ca0dc9a4
SSDEEP 49152:Rb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnpfJ4klKXn7:X3q6mjBmfJ4k
TLSH
T1B5D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 c354f3c02a9ead7dbbd4ef6ca3637b56a5af2857b9de36f410eab8cb117566ea
MD5 de1234338e06fa2f7f61bbe27326d421
SHA1 65fdc87d7866a81539aa1692ea848330539275d1
SHA512 80d9475542cc83b4307e66bc492a34ed7af964f145aca32edcea2177a6ecd14e87a7cc4dae9172250d55278d0b9827202c20bc4dbb08002ad1a431311235c9c8
SSDEEP 24576:QXYfDtczAifJ4yL/tNCJPXUQrP15cvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:ntcffJ4klKXn9KkYej15VHW
TLSH
T1AD751229B7E449F9ED67827CCDA1C001EB3278854764E29B03E099662F733D81E7DB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 7697e9b0aaa3628f274ca795405a6b4754a161596f0f3ad8e020f9930f3f16a0
MD5 ea890d484bba215e9f767b6af0cc804e
SHA1 94859ee30c4167be24d10f5039f7812b47777d1d
SHA512 a9d47bbe506d0902c12fd59ddad9d29a2cd3716ced419208cb95967f16e032e73e65e1f55f75a55583816576d60a82299356702a351aa4a35fceb6647d23bf22
SSDEEP 24576:NXYLDzczAifJ4yL/tNCJPXUQrP15cvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:IzcffJ4klKXn9KkYej15VHW
TLSH
T178751229B7E449F9ED67827CCDA1C001EB3278854764E39B03E099662F733981E7DB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 e2662d5f6e48a3ae5803f8496cecd2d49f25f020bc321a41444a8dcfc229fc08
MD5 f6e7e66cce1caddd95529903243f5ea3
SHA1 125bdf62d76909172b50385d990814651ac503b2
SHA512 23bd62da9bba4d38132323afbe283fe04bd728f17000d788e8a5dd700dacc84dc543d267577c4fac95dd6238e50b193a4d4969c8640334eaa9e14d4fe8f97402
SSDEEP 12288:Omw5HEjsChNEBFgl0WDm+CPfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTr:HwuROWAfJ4yL/tNCJPXUQrPv
TLSH
T1D405F14A32E41CF9E96782788687D132F7B2BC422A26D71F4760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 3.0MB
SHA256 e0e3fc04e656a3b206a8f1a84e61807b6a9aceb33f7cfa4843040a7801a33145
MD5 1aeaf411cabf71502128c6a6b013767f
SHA1 0e9e60dd9aa0a5724eec0e8b967ba34677e47fcf
SHA512 d460834ac1310b8775f395200c1548b0b1e8961366e67748ee27c52133545d0e76ff92ef3b23adfb4da4648565aa84163ca6dab18202fca0336b27750b1eebff
SSDEEP 49152:pX+taZ3usBWOBr4tEGp0bqx0z+n217aau1glzkYej15VHW:Fu6JmTxd2dzA15V2
TLSH
T1F5E5AE13F5DA01E8D05ED478974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 07975819dd96888db7f46c100eface213d00f7aeb1e03be4937d83c4c8620fd3
MD5 c0768931315588b345b948d0c87e176e
SHA1 573887433a349d2cf4026af2ccc8e440201b551c
SHA512 8b722e60b863c88d4ee9af895226aeffbf14a18567801e1c9d8a74faaa46788ac9d0561284ce265d5de929f45001186f30ba2804f2f4206fc578fd96a8e1355f
SSDEEP 49152:SP4m4IpOO6708K/fJ4klKXn+skYej15VHW:appOO1VfJ4kKA15V2
TLSH
T1C4B5E02DABDC0096D0BA917885658A49FAB1742E2F3286CB1160933D3F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompressOut.docm

Path C:\Users\Admin\Desktop\CompressOut.docm
Size 774KB
SHA256 c033bbdc3ad55752e603f76c89addf40b806ab9345c448558f9cea4d61340b2b
MD5 5b4b7e41c5be93a3b8c7de25288c7993
SHA1 660d2c244126a65449f96293b7f275da8f66b5a1
SHA512 0eb031db62b237c2cc1198685558426823951067c6a7dcd0650500c99342a678317c55a3e52678ef9e71c02475844f9cd2c9953781c7abf9428783d1341be455
SSDEEP 24576:xwa9Qr9liackDfMDal5g1C7d1Lrs3yZMRdpV:xwJPiacUwMq1EHA3yiRdr
TLSH
T1EFF423E80FD850D6F22617304F74900A686A136F1267C6E6BB33B3521FE619DAF15F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnlockMerge.docm

Path C:\Users\Admin\Desktop\UnlockMerge.docm
Size 771KB
SHA256 c9fb8c175f4bd15e98b517755637736ee8d17e290bb4b0df2e8a71af822de5d2
MD5 d4611489b8895243542f0a01a3c7cc6d
SHA1 5fdc0164ab8a56e127edd603b2c36f14c4609907
SHA512 e94851c4cdd273950a4ef0c55512b08800254243f7b3f33565d61b5402845396dc8aec645cc5f78e0b1db3419b4ba7b434833b559721b673bc5813d57c911255
SSDEEP 24576:OOYlg3mWY8qG6o/Zu0o0aUshWzoX3CqXzFAQ:Obp8w+Zxo3hWzg5Xzj
TLSH
T1B4F423685BB340E4F2CD9B7DE4FAC9F741E4F4A34D5B905B90A0232D2E8AE671170E94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlockReset.docm

Path C:\Users\Admin\Documents\BlockReset.docm
Size 778KB
SHA256 fb8fc804a4d8afd5a76cf4b5ca9e932da260ee70436ac19877d531a1ca049f25
MD5 b2e26a2ece8813899ce921ea637431ce
SHA1 ad10fe5fe123188b28e147894a0a62869b17cdee
SHA512 0f74db03818c87a931a32bef3670ff3f52469e80ddd99b559fd8a7076f6d149fc192a714f827b5285bef0bde478e0deb884bf1b373ff1dfe466570e5c616260c
SSDEEP 24576:58a9Qr9liackDfMDal5g1C7d1Lrs3yZMRdpZ:58JPiacUwMq1EHA3yiRdX
TLSH
T17A0523AC0F9860D6F62647345F75810A686A136F1227C6E1BB3373520FEA1D9EF11F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GroupStart.docm

Path C:\Users\Admin\Documents\GroupStart.docm
Size 773KB
SHA256 8b0044ac8e9c16b0c1c3a2920fe10ffd33f383414b1f271f82b10d984422603d
MD5 0dd37694ce7b3b9e7805e273eb95cd5c
SHA1 d9ad1d61a1c95b04a25a76fb179a0a664c3367fc
SHA512 b5a86059b3775097930492213f01490b3ecab74a7411291a3be2b56ba4cf13fe6a4b056d7680bd7641b98a77371f4fbb6432065ff48d3eeeb3206af909c06693
SSDEEP 24576:VnO4UTcK+5oM7/Sx6wFR/XnVgUg1NbZ6mgEK:ViYj5oMWx/XfnVWb6m1K
TLSH
T1C8F42311D7A9C5C3FA215AF704C9DDE28854998A81FFC8718093107B85D9DE3AB1B17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 23f92a94ad97c3538303519290b40a200c7299b436f9fc93415e2abf45ebdbb3
MD5 902129caa83293d689efdf961b15e762
SHA1 7821be08b4e876d1b98022c4a7c29aca9cfee866
SHA512 e1f1d5d0cd2e121049700787e3b75bc10ee606aefb4292417882ab612de395ef869739557a924bfac4980b42b386ce24d9d83f926f06b743b9520a9466e2033b
SSDEEP 12288:OZfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S9:OZfJ4yL/tNCJPXUQrPK
TLSH
T1C9D423A761D8D44AEE7687F81648E000D3097ED56B2BA2E7EE42B4853FFC9161D6C313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 2.5MB
SHA256 5ee2aad20ee64b69845af4ecbc43284325c213a4e51076d136e963df3a0ac18b
MD5 e21bbf5a3f0e9f8d41db40bb4307dfd6
SHA1 9d28b9784215ae800316482b26db7b734b2e53e5
SHA512 6412e8781ed4216f8c1d58c53fd9c888643ae9c3f7ad7babfb1ef917cd34cacefc27b19b8af76157cd186e4bb1079e5258cb96924d3879498b320035627a124c
SSDEEP 49152:Ka0h2GEkuAe73q3ppj6zwwQzfJ4klKXn5RkYej15VHW:Ka0hNYGjJwsfJ4kSA15V2
TLSH
T19CC5D01E67EC82B5D0BAD278C9A6814AE7B2B4121B3156CF1191853D3F37EE44E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 b34a12e79b1f3a5bf4548371eca745922983a93d59559db4e89f661401d0b2b5
MD5 6cb68e5052c841d5622fbc195495d75f
SHA1 6a342d23e4d0b6804d407f22e0e7baca309e4813
SHA512 f73ae1e66e207a73cc1c6a1f5f15f00cc5583eda5bae8d0d9029ab3f05190fb069be6ffa7bcee653e59e588a209915c01000f6e86435d756ab50dcdb6fe053f6
SSDEEP 12288:T1fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S4:T1fJ4yL/tNCJPXUQrPv
TLSH
T101C423AB6084948ADE6587F81A48E001D3047FC5272F62F7ED82B4857FFD99B15BC392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 f382746689440231ca0c13c35c34e17b03b82d99220c15d12b0ea0ff37896b83
MD5 00dd8da5ee1cf2e71c093b4735bf2ed7
SHA1 ab07f40c540c7e12b4ff26a705de8e1decb9207d
SHA512 3c9075ef3290b76843c86c0e4f8f822765215c055b2d2cd182df8ad4ff717eaecb03c22c8ac6cfb355974ea4600e560f4d719c10896b5bb6f5128754f7651939
SSDEEP 12288:rObIA4LWOsvAYFTifJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S9:0AL3UTifJ4yL/tNCJPXUQrPS
TLSH
T19425F155F69400F9ED6BC27C89A6D512D372B89D0324E3EF07A88A552F637E24E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 69672832d6d8376a1a65c62e911b408f7ee020189ad8290b1b367067d9458caf
MD5 b49f9cbd04b14407e8066c85b12a8e02
SHA1 965cae0dffe0d63ead41296b2344a63b8ffa53af
SHA512 7007cbdb40a0c3ef08aeda15a72e677ba3dc9a0edf70ad0ae61ecf2722368e9192e310426ccb4649f6639fb374e751d26609450513e176b6fbe0044529852c74
SSDEEP 12288:SpFtvO+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7St:mO+fJ4yL/tNCJPXUQrPe
TLSH
T1AAE4026A32EC10E5D576927C4A85D209D331BCA6172753EF46D080AE2FF7EE82C39761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 59173697530c2933d490d997bb1eaabbf5060c529a44a530e502d63a7aafb0aa
MD5 13cca761775faf234b7f5ae3fd4998e1
SHA1 9da634963653ade0e6d0111a678f8d6dde5824bc
SHA512 7a48f0102b1c47bdf404754fae5f90316744f759ee2d9c562f26dd27d620d6181f2bfafcb3af1d7b6e2a2660d2c2950a7083782a52afa5ebc103af679df1f980
SSDEEP 24576:37NM9YqZqmWMUkPjZM48Mv6bEhsJfJ4yL/tNCJPXUQrPr:37cBWMpPjN8DbEhofJ4klKXnz
TLSH
T1FF65AE2E6BEC81E5D477D13DC9A28205F6B2B4611B318ACB5152833E7F37AE44E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 52dac4ceabea6c905c02801ec10f160e495ca26fcf1bc74273c86f66266bc7b5
MD5 6371c35e880e1c462a9ffb51418c3a44
SHA1 f09a09024e7c842fb0d83dac6a9833f0b6d56c37
SHA512 f6e2b6673632f7df8a9d8e18da0c8d181c0fe3c5e0e448e9d1c853f664b39a57991aaa3b096b34cd36aa5edfd2d613ff28cef31bcace05209fd8323b52b63ee3
SSDEEP 24576:zW6BApg2YuyuNDYTabvcdvNYf8km1nfJ4yL/tNCJPXUQrPJ:zF2YuHNETovAvNYf8kmpfJ4klKXnR
TLSH
T139858E6A27ED80A4E0BBD2BD45B6D146FAB2B8511B3056CF0255862E1F33AF44D3D732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 bdc0072171b879e0e8ce86a9a14f4e71f6b67b09fd83d470af19d00d00aa0768
MD5 fd5d5a8b8d42cf980d1ae608b8bec9ab
SHA1 ae84b74ef218ab9f383bdf8f8978fb6b71b61880
SHA512 f101ee056b90c6f82dce03c09960c27f579a4d19230e21ce29cc7f535601835e8dcdf4ba7c8ca4f1e51a124906dd8ecd0b05aa1c83daf3712ff8ea3563c93828
SSDEEP 24576:IAFs06+Omlf8NXEbToKfJ4yL/tNCJPXUQrPQ:NFs060loXuTfJ4klKXn4
TLSH
T1FC65AF2F62EC00D5D07ED17D8A96C91AF7B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 cfe6cddaad04a7bb56880ac858ce2282506a995d56da727d35a8a70c9de98823
MD5 454f44309eff18c45b35ad80819a59aa
SHA1 8bd972eaa9b2a5555ba722ffeb1686d42869c220
SHA512 92fd9fe54d2ae897e08c09e8b833f7e5308d6b7292fa6958f13eeb39cea0ac45957a24d1e716fadc52b8ebd254c07275a4c5b6fac1349c61acfd683a2a0251a4
SSDEEP 12288:9CJnJ5D3VkrDzxpfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S2:UJnJ5D3WXTfJ4yL/tNCJPXUQrPN
TLSH
T1CA15D02DD2A810E8D4B7C3B482496746FF72386D2F226AC768B4D4353F16EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 842c5ec536679fe59aaa78dea6925760ee531e2a14993863a8eff90c1c2e1532
MD5 05ca9802b8c60cfb0f06989e1a4d8dfd
SHA1 8354d7e353f161c86a9afe58a147ee63eefeea36
SHA512 4cf2e14d5c395264a4dd990acbe7f6bf61c19c9487e4310736a2db30541b0d7cf4190a2efd8424171db77081ae0a2ebbf58f56b1d394a2ca585aba9337816716
SSDEEP 24576:MEPghm6/7IIXdwcXrif7qQncjlP65i3VuAfJ4yL/tNCJPXUQrPp:Tg06DIKdwc+eQnSt65aV9fJ4klKXnh
TLSH
T1FA955C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 850KB
SHA256 3bd276d9ec3ca213bd0fca26bc5878fa9470e5582801c089163dc9cfdefd201a
MD5 16e06f6cde38276e51c96dfd7ad28af0
SHA1 2fb1a3468e28a37729bf465ff5b47b67c1e31efb
SHA512 57062af8e8ec9a523cd6331c3e3d699a453d51a85420fe955db52caa5c00b84a9d43a21ac5c92eda928eb3a5d0f8f09562f7127e10acbb48ff8dbcf1ba00afcf
SSDEEP 24576:CifcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:CiEkYej15VHW
TLSH
T1A605125DAFED91E5D125A07C8A618188D3B0F0607B5167EF16D2867E4E33BE52E38F20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 25036f1eb6fb29b9f1406458b1d56bb71cfff387ecf3b9705e68460d4a0456f1
MD5 09fccd09d3b28ffcce900fa301b4cb65
SHA1 90f8c815e6ec67fc97661b408bab8f8d60d34a28
SHA512 6c6699d412716b87fc500cb6083681d276506a774c4cfb39ceda8430f4adc66821be3cd68864976d1de8a3103720b69e46c2be0c8fe2a5cb7e99855e2e280f47
SSDEEP 12288:JjkyYfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sy:JIyYfJ4yL/tNCJPXUQrPp
TLSH
T1C1F4224A23D4A085DAB647BC5A55D140CB34BCA02F2693EF9580F53E7FBABD52C38712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 2c2373c6defabbc5d02e62f3f31a0c4effaccf0d5358069552b69807d0a1bb4a
MD5 42991105d6a5aec3e0e892637c3bcf08
SHA1 1be7bb43dd56fd0fce572f9a59c315a19e7e38db
SHA512 78e11a84c72910e44fb3017e8cc4cc6b7b619d2588300b0b3f21e45f80867993c7153bdc70c18023599a488addc7058886b8c6d71b9829a5d3cc8213fe1a5f29
SSDEEP 12288:FyOfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SA:kOfJ4yL/tNCJPXUQrPf
TLSH
T1C7D423AF2191A08ADE2687F81648E000C3147ED5272B62FB9DC2F4B17FFD99615BC791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 9806664d62c9da75fb08b29af90c49d06a4e276cc79b6b838eb4e3b62b7d2121
MD5 ec3ee462f625269d91a7e8b348539ee8
SHA1 87458bff5dceebdf0d69a021c0e34c05213db143
SHA512 620734544d4b86a89a80113897d858e6ba3c93ab9e518c5b9d133fb20619813519706cb1106fb37b839c64a656cb91c93845b91859de92e9ecfd1ad797eaed7b
SSDEEP 24576:BQ9MxZKdcz9dw3RfJ4yL/tNCJPXUQrPD:BVKZRfJ4klKXnL
TLSH
T15F558D2DABE9058AE177C27595A250C3A633B4311B35D6CF2448D03D4DBBEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 3fadf32a6f4963fb1cf67c5bfd30964ebe6bfec6542c5003a734fb5ef1f3c72b
MD5 1d614d845c0a25cb7370b4e0049cf729
SHA1 400cb0d6dc0ebc7843a6ef43359d2cdc40b760b0
SHA512 23e0ef2f91a550de74a6fbb158cb4aaed09d3527c50c098c01499ff7fe9a5f6ba44f74f37d068dfb183d2103f9ee6fb3272abd00cbeb690a650fc0789f1a533b
SSDEEP 12288:OyoKo2JRple9p0fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Se:OyocDAp0fJ4yL/tNCJPXUQrPV
TLSH
T196F4E05FB7A940A2E176823C8984C205E773B4701B2263DB6681C33D5F77AE97D38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 96bf9c71391c66239860a0bc4b0a0e73a7501805e20f9102db0f7667b2c6fed4
MD5 8e61482b3eb39b04a5e82b87a20bec27
SHA1 758cf58b179042fb93765731b100921323bd1ed7
SHA512 0e97eb05a013139422239d91cbd11d00e3b6b887926f439de16ddd6fb52a5be3c4ccb1893c8c3132256ad0e7201f2d250d35053ee5904fe98a17ff6aec7553e3
SSDEEP 49152:aWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK0fJ4klKXnS:c0zuNIifJ4k
TLSH
T17BA57B3DA2F800A8D9AAC375C5451366EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.5MB
SHA256 b25f6345ff9fff7cefb4a896a414af48bb0b814ba46018361fc8d9a136d9f172
MD5 4f06063df095395bc87cba72a58ec710
SHA1 4a4e2f52b8bada414a27f7b4097423d998a60ef4
SHA512 6f4626f84908979ef9ac6ae7d49c7e2fbbd628a3b61949ef94def9aa0bab3080182409a065e32a95537d7831cd4ae868da16fa77ec838aea496f838da5b1a13d
SSDEEP 49152:ja0h2GEkuAe73q3ppj6zwwQzfJ4klKXn5RkYej15VHW:ja0hNYGjJwsfJ4kSA15V2
TLSH
T1DCC5D01E67EC82B5D0BAD278C9A6814AE7B2B4121B3156CF1191853D3F37EE44E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 6e819619d01bc9797b0184c3ba31cabf6cbb342fe0b0bcee4681117be4ec1fb2
MD5 e9c1754e99e05da253331d9fd24bce59
SHA1 87e15129b98276485dab0af1e00dc4312e7d7226
SHA512 cbe0be2663bfaa4636e5654f6a8b3c5a9f5f224a83499f75bbf9e58d542cd9540ef3e807a898d45326c5f91f8dab135ad60c2947b60ecaf9c6ee3917fef0c5eb
SSDEEP 24576:F1QT7EcpfxR+N5AWAz3ooiYhjMqbacvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:gTDxR+N5YzTTjM6kYej15VHW
TLSH
T17975C02EA7F905E9D1BE85789A23C512FB727821133193CB42A0C17E1E779D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 849KB
SHA256 ca0d3733ef6317037bddae7e1e16544af810ce77b38e2d954e4411fc50271446
MD5 457e16f0c0a5bfcdbf8531095cbbe7cc
SHA1 aa2f1eefad7f3943137cb35ae99d3de5ea5b0955
SHA512 c2ba59c5d9e0777f9b521c415aeaeb804deee9ca552651247f5e5b048ce4fb724cb6fa338bbfd62f35ca3210b4ec022d7e5907f2e7c5988430742f9e2f3986bb
SSDEEP 24576:GhbHjPxcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:GhbHj6kYej15VHW
TLSH
T15805126D5AEC02D5F271A1BC8A618549D770B8252710E3EF23D282BA0F37BE55E74F60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 ca9e5e9415ba2530eaf2ceee55b58766cc79803c64ec8e41941495e04ef2abf6
MD5 7abaa8cfeeb32024a65724fe97e927c0
SHA1 0f8ea5b3007ebd90ede2278cf79da4f17c50fb8c
SHA512 f87f8dbfabc47ecaf391ac14a0dbeeff06bf9fb50d2b1eb08db651e6797b8779ab69cc23fc57eb8d7ab0611d3747efa25598cc3eb7f69b69b9102d35f2f121c0
SSDEEP 24576:TTMdOz0FFS+7mSLbfJ4yL/tNCJPXUQrPy9AcvQ/asw4NdIeJkmUje1wUEyBUsyJJ:R0K+7mSLbfJ4klKXna91kYej15VHW
TLSH
T1AB75127EA7AD04E5E47AC27C9A42C505E77134A10322A6D706D1C0B93FABFE43A7DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.4MB
SHA256 670e86f1421f9577fab7a70ab30818529be1a8b0a3c4ddb8dec9eb267abd11b5
MD5 bf068b7f94507a217f93ce08b05f9b2d
SHA1 00bd3a85baef05dc0442fedf4f1ed6e950e8cef7
SHA512 f0aa19570b61125f16fb22ebbbfacd4ebeff02cd8c4942d1a91e5a70926dc07bedc91f149eb83a9fb5c15f5e589df26f9af6217a44aa86fa636f7ceeee6c97a5
SSDEEP 24576:DsUg4jcRTk4yti+R5dUR/ScvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:Dbg4ITk46pUR/rkYej15VHW
TLSH
T19A65C02DF6B910F9D8A6D136450147B5BB71782D1F209ACB01B0C538AF1AEE89F38F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 1f739f95f8139a3ee1dca1982268497fc50ce8ac3015d1554ad10e2d1a9bfd73
MD5 ee6139a043d4dbd35e5bde7d5d079b5b
SHA1 c34cd26acd6180f2cfac289a260643d5c751e2bf
SHA512 d871bf615e6fcf021c2dceec221df4daad07cc843dc429f19401cf7fb17d429fb1770e09d5e5eb32847267b3a3d540ce0db9122351695390a3ce1010d9273f98
SSDEEP 24576:rifJ4yL/tNCJPXUQrPhPcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:rifJ4klKXnJ0kYej15VHW
TLSH
T15765234DABEC50D1E56192B88B24D0408730BC953325A1FF39C2DCB66FB7BD55AB8B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/208-166-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/208-418-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/408-113-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/408-253-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/512-148-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/512-414-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/940-144-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/940-146-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1240-139-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1240-64-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1460-162-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1460-416-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1488-165-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1488-105-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1516-100-0x0000000000710000-0x0000000000777000-memory.dmp

Download

memory/1516-101-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1516-161-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1516-95-0x0000000000710000-0x0000000000777000-memory.dmp

Download

memory/2032-13-0x00000000030D0000-0x0000000003137000-memory.dmp

Download

memory/2032-7-0x0000000000D00000-0x0000000000D85000-memory.dmp

Download

memory/2032-20-0x00000000030D0000-0x0000000003137000-memory.dmp

Download

memory/2032-1-0x0000000000D00000-0x0000000000D85000-memory.dmp

Download

memory/2032-74-0x0000000000400000-0x00000000006F1000-memory.dmp

Download

memory/2032-0-0x0000000000400000-0x00000000006F1000-memory.dmp

Download

memory/2292-129-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/2292-383-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/2292-135-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/2292-128-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/2524-57-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2524-55-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2524-49-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2524-60-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2524-62-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2796-77-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2796-143-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2796-79-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2796-68-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3040-140-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/3040-400-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/3216-415-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3216-158-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4244-419-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4244-474-0x000000000DCE0000-0x000000000DCE8000-memory.dmp

Download

memory/4244-236-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/4244-196-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/4244-215-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/4244-177-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4288-157-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4288-91-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4288-89-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/4288-83-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/4680-319-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4680-116-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4680-123-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4680-117-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4872-176-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4872-109-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4872-417-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4984-447-0x00000150ECA50000-0x00000150ECA60000-memory.dmp

Download

memory/4984-459-0x00000150ECA50000-0x00000150ECA60000-memory.dmp

Download

memory/4984-430-0x00000150ECA50000-0x00000150ECA60000-memory.dmp

Download

memory/4984-429-0x00000150ECA50000-0x00000150ECA60000-memory.dmp

Download

memory/4984-428-0x00000150ECA50000-0x00000150ECA60000-memory.dmp

Download

memory/4984-438-0x00000150EC660000-0x00000150EC86C000-memory.dmp

Download

memory/4984-432-0x00000150ECA50000-0x00000150ECA60000-memory.dmp

Download

memory/4984-448-0x00000150ECA50000-0x00000150ECA60000-memory.dmp

Download

memory/4984-449-0x00000150ECA50000-0x00000150ECA60000-memory.dmp

Download

memory/4984-451-0x00000150ECA50000-0x00000150ECA60000-memory.dmp

Download

memory/4984-453-0x00000150ECA50000-0x00000150ECA60000-memory.dmp

Download

memory/4984-454-0x00000150ECA50000-0x00000150ECA60000-memory.dmp

Download

memory/4984-455-0x00000150ECA50000-0x00000150ECA60000-memory.dmp

Download

memory/4984-458-0x00000150ECA50000-0x00000150ECA60000-memory.dmp

Download

memory/4984-461-0x00000150ECA50000-0x00000150ECA60000-memory.dmp

Download

memory/4984-462-0x00000150ECA50000-0x00000150ECA60000-memory.dmp

Download

memory/4984-464-0x00000150ECA50000-0x00000150ECA60000-memory.dmp

Download

memory/4984-463-0x00000150ECA50000-0x00000150ECA60000-memory.dmp

Download

memory/4984-460-0x00000150ECA50000-0x00000150ECA60000-memory.dmp

Download

memory/4984-431-0x00000150ECA50000-0x00000150ECA60000-memory.dmp

Download

memory/4984-457-0x00000150ECA50000-0x00000150ECA60000-memory.dmp

Download

memory/4984-456-0x00000150ECA50000-0x00000150ECA60000-memory.dmp

Download

memory/4984-433-0x00000150ECA50000-0x00000150ECA60000-memory.dmp

Download

memory/4984-434-0x00000150ECA50000-0x00000150ECA60000-memory.dmp

Download

memory/4984-435-0x00000150ECA50000-0x00000150ECA60000-memory.dmp

Download

memory/4984-437-0x00000150ECA50000-0x00000150ECA60000-memory.dmp

Download

memory/4984-436-0x00000150ECA50000-0x00000150ECA60000-memory.dmp

Download

memory/4984-425-0x00000150ECA50000-0x00000150ECA60000-memory.dmp

Download

memory/4984-426-0x00000150ECA50000-0x00000150ECA60000-memory.dmp

Download

memory/4984-427-0x00000150ECA50000-0x00000150ECA60000-memory.dmp

Download

memory/4984-424-0x00000150ECA50000-0x00000150ECA60000-memory.dmp

Download

memory/4984-423-0x00000150ECA50000-0x00000150ECA60000-memory.dmp

Download

memory/4984-422-0x00000150ECA50000-0x00000150ECA60000-memory.dmp

Download

memory/4984-486-0x00000150EC660000-0x00000150EC86C000-memory.dmp

Download

memory/5100-36-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5100-44-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5100-108-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5100-45-0x0000000000890000-0x00000000008F0000-memory.dmp

Download