d91d86fc1b3ee9e9b976202138f91d7f12e73513c0297e33dc3a0064d6907cb2

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Size 1.5MB
Sample260929-vm5bea1tev
SHA256 d91d86fc1b3ee9e9b976202138f91d7f12e73513c0297e33dc3a0064d6907cb2
MD5 c3e84c022ab46541615eba67b8d0ee83
SHA1 a9cac6eeb00513c4ee3cd48758ca815e87e1deb5
SHA512 44ec7c86f838bdad279bd642f3eee9a5aca556d744414171882b029361879404254f37300d01f871a3a04a729abcc049d7d7f9cbca6e3e686167df35e4cfb060
SSDEEP 24576:99bkrEMfJ4yL/tNCJPXUQrP2XcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:ArEMfJ4klKXnOMkYej15VHW
TLSH
T11A652369B9C0C1B2C461193806E0D3705B3C7EB03B69A197E7C22EB57F752921B1CB7A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery macro spyware stealer upx

Malware Config

Signatures

Suspicious Office macro 2 IoCs

Office document equipped with macros.

macro

resource
behavioral2/files/0x000e00000001c4af-432.dat
behavioral2/files/0x000e00000001c1aa-433.dat

Executes dropped EXE 11 IoCs

pid	Process
4168	elevation_service.exe
5844	elevation_service.exe
2692	maintenanceservice.exe
5588	OSE.EXE
4460	PerceptionSimulationService.exe
4524	perfhost.exe
1952	ReFsDedupSvc.exe
4672	SensorDataService.exe
2860	ssh-agent.exe
3720	AgentService.exe
2680	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
	\??\F:\	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d7abb1325f2ba71.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4536-0-0x0000000000400000-0x00000000006F1000-memory.dmp	upx
behavioral2/memory/4536-52-0x0000000000400000-0x00000000006F1000-memory.dmp	upx
behavioral2/files/0x00010000000093e6-377.dat	upx
behavioral2/files/0x000100000000934e-376.dat	upx
behavioral2/files/0x0001000000009953-378.dat	upx
behavioral2/files/0x0001000000009cd7-380.dat	upx
behavioral2/files/0x0001000000009b93-383.dat	upx
behavioral2/files/0x000100000000ba3f-386.dat	upx
behavioral2/files/0x0001000000006223-393.dat	upx
behavioral2/files/0x000100000000627a-395.dat	upx
behavioral2/files/0x000100000000bd4f-394.dat	upx
behavioral2/files/0x000100000000a31a-392.dat	upx
behavioral2/files/0x000100000000a305-391.dat	upx
behavioral2/files/0x000100000000a2c2-390.dat	upx
behavioral2/files/0x0001000000009397-389.dat	upx
behavioral2/files/0x000100000000a1d5-388.dat	upx
behavioral2/files/0x000100000000a0cf-387.dat	upx
behavioral2/files/0x0001000000006215-384.dat	upx
behavioral2/files/0x0001000000009cff-381.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105218\javaws.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105218\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b64cd0213550dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000061529d213550dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000073f17c243550dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005bc2054d3550dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ae80d1273550dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c593d34c3550dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 63 IoCs

pid	Process
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4168	elevation_service.exe
4168	elevation_service.exe
4168	elevation_service.exe
4168	elevation_service.exe
4168	elevation_service.exe
4168	elevation_service.exe
4168	elevation_service.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeAssignPrimaryTokenPrivilege	3720	AgentService.exe
Token: 33	2680	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2680	SearchIndexer.exe
Token: SeBackupPrivilege	1952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1952	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1952	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1952	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	4168	elevation_service.exe
Token: SeDebugPrivilege	4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Token: SeDebugPrivilege	4536	2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 5348	2680	SearchIndexer.exe	101
PID 2680 wrote to memory of 5612	2680	SearchIndexer.exe	102
PID 2680 wrote to memory of 108	2680	SearchIndexer.exe	104
PID 2680 wrote to memory of 1400	2680	SearchIndexer.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_c3e84c022ab46541615eba67b8d0ee83_amadey_elex_luca-stealer_lynx_njrat_smoke-loader.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4536

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4168

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5844

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2692

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5588

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4460

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4524

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1952

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4672

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2860

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3720

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5348
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2251218687-1689653882-3767565116-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2251218687-1689653882-3767565116-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5612
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2876 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:108
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2872 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ADelRCP.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe
Size 695KB
SHA256 c9df1ef924f7145da534e31c03ebaf6fad64291f9e91fcdcee2e243141c62862
MD5 b766b18231782fae0ce4219591ea1c63
SHA1 dc9d309d49c03d4e0ddc392a0ced92bc953a7d46
SHA512 e963a9d2d8039cd16ebbc886d39e6bfacff97378fa6b34f8b5d1c39220dfd0e4e9dc0654f5b5a4cadaf5588ec358bd1a6f14c9399bcd6afb48b531eac83e268a
SSDEEP 12288:lkEZrZLfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S9:qqVfJ4yL/tNCJPXUQrPq
TLSH
T12BE4022277C0D059EA9313723FFCB4D08BF5BD728A6920A7F705955B2ABE6105239327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroRd32Info.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
Size 588KB
SHA256 30e8c075b1f508da4b70c2aff3cb4a9dde7d3b19d7958f14856bfde2c15bb8f2
MD5 306f31f8e88f70a1fdac468a73453fc0
SHA1 762448ff5a53ae59a44d28ecfe5a043bb8f983b5
SHA512 19007e651e5ada71b091825a839acf1ca76733fb93128c726679bd28d4eb8b5750d8cac43333a2ae543a1ea385bbc4e23615a17489a89705a476548ba262a7d8
SSDEEP 12288:7sfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sa:7sfJ4yL/tNCJPXUQrPp
TLSH
T187D423A721C49856CE2687F81A58F001D319BED52A3B52B3DF83B8863FFD91A195C353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroTextExtractor.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
Size 605KB
SHA256 07daffda96d3b9bb0fa33b7ae5d84e6e15f7c97911d19c8a9294d3cf7d4e7ceb
MD5 339be80f8365a05e7120fb292d78d098
SHA1 d42a8a34ca014984d23c52a67a3e739968e8bf4f
SHA512 df417f0396f56b85fc1fa1c11043b3a223a95c7be811cac9cb1d2290d4133d6b7cd2491b0d7af825a84e8982fbaceebfcc9ca4cfe97684fc71d10934a1dc70f8
SSDEEP 12288:nOfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sn:nOfJ4yL/tNCJPXUQrPs
TLSH
T12ED4236321E1C4A6CE5687F81A48F201C3297ED1573B62E3DBC2B8963FFC9561869353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeCollabSync.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
Size 6.2MB
SHA256 9b570f7e6a1a0b1e3e78434fffce4209e4599daffabbd7d509b2bbbc287229ca
MD5 aeb60439494eebd698c99da38b3c84b9
SHA1 4bb73110f3588b3cf4d0d7406d20fbcc77678b4a
SHA512 287a7ca0fa4c33430ec9a1a3d6b7d0a0d542fd39d5c9558946ea65892ff61f9da0c11b64fca42b2b11a2853876b37f362f5d79b0ef0c1483946611be8262964d
SSDEEP 49152:1mlI9H9rY654KYroYJqkhWFUBlNwnFq3kXRsPL6BRY20YZAliDgFL2YmXZjU2P3Y:+iH9MfT3NwMkKuBRr0yAk6qkKvUfJ4k
TLSH
T1F8669D22B902C139E15102B159ECBFE9C49D99348FB105DBBAC41F7E9A613E33931E67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WCChromeNativeMessagingHost.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe
Size 703KB
SHA256 4c2ef9f2c62b3bbea4b4929884bb9321ad864808c7880a954e69aaee31e8dde1
MD5 aba626286b8dc1454200da3d1b3482da
SHA1 b77f6fd876d40753bb0fb0ccbcfcc8af5ca12435
SHA512 b330a5dc2154dc0ee536904a16ba3faaa0c8a13e935d0a4ea8b015a4a77087d1015e065fc644a1fbe98c1bcb86b40c16df329a2becd307344fd5d9e0b3087694
SSDEEP 12288:Sk9WbzIlafRfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S/:G8gfRfJ4yL/tNCJPXUQrPs
TLSH
T1D8E40252F3C7C5B6E55202B00868EB658268FEBC1B3251EBF3C57A1B2EB42C31475667
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eula.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe
Size 650KB
SHA256 96e6e90a8d05d39c693a8fcb42a38d351bfcf56300596ad767353e51e8a43722
MD5 e21c57a6559c3f12d4330b66a4343a3f
SHA1 39b7598c8560c8fc09a4993f1084fac2a3e3279a
SHA512 26ad9df54a21c60fc2845bae60405c4ffe96cbfa572810bbd471291b747927b6e23300492f8f941f1ec51e4f920001bf96558e926058851a3ed59220f26f67fd
SSDEEP 12288:DfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S0:DfJ4yL/tNCJPXUQrPj
TLSH
T15CE4126376D0D4A2CBA203B41E58F352835FFAB55A3AD363BB85274F6EF84460C4C652
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FullTrustNotifier.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
Size 771KB
SHA256 7f86f241df5f6b26700b6de3dc3c2f8d5439ddffd6ff1c0c723dd81c411b9f73
MD5 f35442d0aa9ece9f1761b446ba25e47a
SHA1 489cc634502bcd7359020162d3811291c8670a20
SHA512 41973362cde0d1b2289b9e71a55ea854006d06cbbd0868583aef22c6fe5fe7a33aa2724b93b0b88972d8c46867ca73959702956906bfaa04d4c38be92ee6107d
SSDEEP 12288:8xY+FUBafJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sg:8O+qBafJ4yL/tNCJPXUQrPn
TLSH
T1C3F4F0313686C57BEA9301B04CECEABF901DBE890F6951D7F3884B5A2EB05D32E31556
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LogTransport2.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe
Size 904KB
SHA256 290002c22c556e6698acf0bab3d469cf299a1f8d8172424777da0ec6fdb02b41
MD5 6564afc63f93fb91752d2cc0ad91e9ef
SHA1 2c11f19cacde4674349187294638ab579d0e52dd
SHA512 0690f3d5af5f8b0f2f84a53563b06999df1c6544cce9cc900cec15bce5104f6efb1018606725f0232b595202fbd82443e84080c3cb8da2e044599d4a699e4e38
SSDEEP 12288:+qwKoHSDeWTRW8fdelfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SN:OKoyDZTRW8fdelfJ4yL/tNCJPXUQrPC
TLSH
T158150111F786C1B2DD5602714E99A31CC1ADB9A14F3697D3E3D86F0E6EB00D29932BC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arh.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
Size 644KB
SHA256 3d75581e0c5fd550c984b936bd709cace6c234e7d5dfcb1e74a8c7377606dd25
MD5 8a1d2b6915ea977bf058b6a63389b516
SHA1 2749881995b817d29a81206f644c17e890a5d58a
SHA512 70132459488931cc1cdd172c53d25ff371a7fa6c38288ad7f2a93c16d3e05e8bcfd296f299c8d49834cc9b4654b49090aa3017b1691223048bb1243aa000683f
SSDEEP 12288:WYmIjE7EfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SZ:S7EfJ4yL/tNCJPXUQrPC
TLSH
T151E422A73190D032CC9286B8060CD251CB2E7DB2666AD193FB816A573FF8795D66D313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe
Size 662KB
SHA256 208d1e95acf1ae903437d04d098103700dc9b6bd665d1b49a2f98a649e4c5a2b
MD5 c2f7018c3cd286d433b9c7c032e20399
SHA1 a9d29807f1a0e6cb7da9f4ac374d2f4dcb70da26
SHA512 04883b06e6edb57074aaec3db2be2c5c4f75abaaca09c79f3239baf198c412ffe19252d911ee6b5d16ad9340a2c5a9973882faca0638c1bd6b02fe0754e2b045
SSDEEP 12288:k5AwfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sf:k3fJ4yL/tNCJPXUQrPA
TLSH
T165E41362B0C194B1DA6542B10E5CF34AD118FDB40B3791E3F3C49E697EB81C35BB66A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

64BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe
Size 796KB
SHA256 3e89699e036ab8561e8ea5fe58ac6d9e513fe0bb08895327f712b1273c053dbe
MD5 56425e6d4bbf08f5ad7d74fb2d2080a5
SHA1 15ab4ff17bc110a522774dd0f8c5a7bd48c3e9d6
SHA512 a99c98a4c39010ee442b77b0c4717a748c7691213627a3dde6e43765c99472daa60494a04591548f7099d80f64a3b954820a359eb560e1ea2afcc91382719e9e
SSDEEP 12288:DZKK9HMYcyefJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S7:dZ+1fJ4yL/tNCJPXUQrPE
TLSH
T1F005F15A33D88CE5E467C27D8A819142E3717C850B35E3CB6750426ABFB7AE06E3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
Size 611KB
SHA256 b4e6e2bd42a70944cea176063300580c574308d8ea48f2e2c902c54185aea86d
MD5 7aa87d1d91bd2fba08c98f44abe17694
SHA1 d7ab0955919a86f745634d0c856166864229cc0a
SHA512 f4eee09a84212cbf9293369377ddc92c8db0e6cc62a00647761b32fb2949a600e60c933043715b95013dab16751792425f7c3fc369d62c49f39dc4b26b059bd0
SSDEEP 12288:CFQAfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sr:gQAfJ4yL/tNCJPXUQrPs
TLSH
T122D422573682DA52CD1182F40988E361D329FEE06F1B63E39B42644B6EFC5C6187936F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wow_helper.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
Size 666KB
SHA256 817e91a6e120e8e7bc87317331b4aec459a72d3707fa023105b44e2f439974fa
MD5 6adc1a9ff0db9977261fbe7bd3035477
SHA1 892d66672c75a8809433046ea1e02a627faee980
SHA512 2c7a59f1c4e86d327687613a96d072a889ed2060d979161d5fc0136bfe0b68a425ff7fe3726cbae9bd1b646376f4acc4b9f873f149e6d9708e1bf70833ce79c8
SSDEEP 12288:npQl8HoIfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SI:yhIfJ4yL/tNCJPXUQrP3
TLSH
T1A0E412AB32E530F8E97686B889509100D731BCB91B3693EF4B9051963FBB6914D3DB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
Size 1.7MB
SHA256 eeeacf90c4a30574c393979bb547a417648c9d18321fc251fb7fd935c6c32e30
MD5 177e78c5e2933e7e54e404b91f73c1a1
SHA1 34876b7456db16034cd75841340e2ccd991084c1
SHA512 148d73cc415a94159a8debc054b42ce8f324fff82cfcd03488fb581814d7423083f9afd9b61eb1eda16e3da5f8d218ac958f3ed0623152e73b8b421d22681505
SSDEEP 49152:cSgouvAeFfenxyQHXS7uQ0NISfJ4klKXnj:cS1uxaxbS7u5fJ4k
TLSH
T164855A0267F94129F1F37B71EEB993645A77BCA1AE3AC10E5280125E0DB4A90DE71733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
Size 973KB
SHA256 2d6ff928586b408eadf31bbcc38562e281d42118e78314bd7749287f6c439b3f
MD5 9f86f76a8c7e2f55980033b61ebbf47d
SHA1 afbf0067f00cdbaa70886a9432f6eebcf1059da8
SHA512 4777f08e35b7b54852da6357ffa16404fd3718375abaf191c2873767d6fa8c83fbed2a39b17a7b099634b98be489947d68e60b27c99252f3da5aea258a7d54d1
SSDEEP 12288:K6dVWnxlMnn7nFKbltn+Ch/m6XUfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+I:h/TAbD+OmeUfJ4yL/tNCJPXUQrPn
TLSH
T1CC25E01133D0C035F5B319764ABFE324552DBDA11F6982CFE3881A6E5EB06E1AA3471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaureg.exe

Path C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe
Size 1.0MB
SHA256 452b41e918d8ebdf2c713f80acca88aa72651008406deeebdf06b1bd8f0f268a
MD5 a8455b95794c39633bd81d0b47525fef
SHA1 96bb649376d8f8d0c3ac95825ee60ed3934264b7
SHA512 12bf2a305aae6f1af81dad5d1b9f8e1cf1168504b63e86b3edbef0cdffa34c6763b711e1466a6f399b2dd73d827174306949fa919ea8c71e842d046971f1731e
SSDEEP 24576:VJ7RKDjjg/PzNWyr2fJ4yL/tNCJPXUQrPS:/UjiPDr2fJ4klKXna
TLSH
T15235F12534A0C072D57312350D59E394A73EFAB04A2745E7B7C4AEBD3F345C1EB286A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
Size 841KB
SHA256 e9d7dc4cc43432161ee91ec34f5e1751163fe8d86796dad3021bb3632d628ed7
MD5 a2b088de4e6fa6dbe64d1ce1b770a305
SHA1 77fb7ffe231d96c359670671fdffb92f0ac0d4a8
SHA512 a6f5e88a9c3e8fb874fe6af944e0395d856a00c68736443229b92ef3ebe0de5e726a22164f4906c481579d20b61738a534f0609b57ec32b51214bb5d4edd2696
SSDEEP 12288:yiZwbDzzFEoS2cPvyrfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SA:VZM3zFVSOrfJ4yL/tNCJPXUQrPL
TLSH
T1E40501A5B39018F8EC67827D89549902D3B27C9A0B70C25F07A436676F773A11C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe
Size 841KB
SHA256 980190e0b792a7bdba38a04b77996ef29cbdc127b39728adda92b6a1f49f3a3c
MD5 a777fc503d786bc776c888c807198b8a
SHA1 f65aac65c90ad2b2e6e6e607b88c7520beb1b349
SHA512 7a53dff3cee0bc4b86e014ef9338100c912501c5a2a87cdf650b881517866ed21694f6a58b1ee044a23c06b3a7fa78ed81aa0fdab1469c53c9c43da4bea32cf6
SSDEEP 12288:SCd91WYoaLHF3z0z04PDvhNfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTs:zT8aLl3z0zDNfJ4yL/tNCJPXUQrPI
TLSH
T15B0501A5B39018F8EC67827ECD549502D3B27C9A0770C26F07A436676F773A11C2DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe
Size 1020KB
SHA256 e63215cc934371f5d5a6dc111198e4c814df2ca3907c6d7b366649ad83a46bfb
MD5 4d80e7bd09cebdf1d0adcb7ff66f73a6
SHA1 41948a631e2bd7c6a84617876c3b9474857bfe84
SHA512 da611a66e446b5f2db472f39cf6ac34182b1ebb60ac002f7607b1a38a53c60bdf471a332f0ea07972e221814c10fb7a5ef67269fb7bcf0169a74693e088e5caf
SSDEEP 12288:ji4e7+RdTfgwCHKy7GLbbdIvEfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGr:j3rd9CHKy7GZRfJ4yL/tNCJPXUQrPE
TLSH
T18525CF91F3E410E8F0B7CA758D659502DA767C9A1B31DA8F03A4655A2F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

disabledupdater.exe

Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe
Size 6.2MB
SHA256 4f55d2f8119563acfe192ec17ead13883a7fea1fdb144bb020a75458768e1bfa
MD5 74fc6a917a887471a84a2cf1b788146a
SHA1 32ce3cbc552fd23697f10fdd7414237ad36d2a15
SHA512 816f86771940da569d736356468e21e2688cfb6291dc63becd319ffa2cae5fd9cb963a062cdec251fc6636df3844a412c78dd5f081b96d8d996f4434994d5081
SSDEEP 196608:4og1P9fIlOu/6IgF+I3m2MXP6HG8QzdfJ4:4ognqOo6IgF+qbM/6HG8Qh
TLSH
T151668C23A4E04035E5F733756D2CA7395A327BA29F3145CB86906C946FB83D3293936B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisabledGoogleUpdate.exe

Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
Size 6.2MB
SHA256 a8254953357719b73d01daae24daf542719e6eebf2102607d90f711f53bd584d
MD5 714ab58af6fb4fd6cc2f324905167ead
SHA1 11ed5741a4b01f163f5cdbddad431cbd64a99416
SHA512 d7cdb6f47d30dea642794096d3d06c0eb4eeb4c3cf8c0ff32de1d3d9a75f39b2d6ec4b86d27559f96dae50e7fff2e55540be29c961cd6a145efcb5edb3b67d71
SSDEEP 196608:0og1P9fIlOu/6IgF+I3m2MXP6HG8QzdfJ4:0ognqOo6IgF+qbM/6HG8Qh
TLSH
T102668C23A4E04035E5F733756D2CA7395A327BA29F3145CB86906C946FB83D3293936B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5491affe925f89b3f116509af3f4c511734b511170a9de6a72f7f7bdd2518fa1
MD5 ce52644cad9100ce4c18eeafe33e3992
SHA1 1122684a5d1b21e6a175e9557930987ce63b358b
SHA512 14dae685a76d199da2a327c96063232ba15e7edc126ad1d4201ca10fb215c2b45f5688b72335ee3c4122a10d63da23984c0bb9cd3c5f40b35eaf494002963e5c
SSDEEP 49152:3b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnufJ4klKXnG:l3q6mjBxfJ4k
TLSH
T17CD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 34cd8b6ca5c007b55c537630144c232592c20fd7eaafbe54e947c2ad7a6806cd
MD5 9358f4c6ec98fb92e51e3e203e459b05
SHA1 340aa686355218ddc2106bb338f038fb852b84cb
SHA512 29a1f64ec187cc87d177ce4a1706e3cfd9384eb1d1473be70fb8ee113348e42a6b740f82386dc50ebccdba5748b0ebe67554fa03fee737586a86cc1e6aba8338
SSDEEP 12288:q1XLsswWkxy2lRq2czAlfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sk:gXYfDtczAlfJ4yL/tNCJPXUQrPH
TLSH
T18305F12973D008F9ED67827CC9A1C101E732BC954764E7DB03A099662F776D81E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 4ddc5784ab3df2d34355f9d4cc4645f1afde14b1b1f2517d19f32ea701287abe
MD5 a19ac9a51a09fdec5301ef984e8ea611
SHA1 683e628008d6a7638dd4f1766923d79ed7868513
SHA512 ae86c577e67fe94825cf127f053daa66452d3d5d366b17e5cb4dd41550efb9c67c66162b5fa037dcc56f8ddb09fc6bae6bfb10cbca8d68b38c3d4c1f649648fd
SSDEEP 12288:Vmw5HEjsChNEBFgl0WDm+CgfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTJ:QwuROWXfJ4yL/tNCJPXUQrPd
TLSH
T18F05F14A32E41CF9E96782788687D132F7B2BC422A26D71F4760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 73b3552f8d75ba02b01d8354d4ff80b9edf55c955996b040c422e5c866a1a019
MD5 005afc15a474d62a13e9ad44cc55e11c
SHA1 15a2cb9384c7250fc0bb1cdeb2b727654aad8739
SHA512 b991c39a12e7f81527a81f1cc8d32cd234699612f4f8d219b1038ec2719cde1628e55d6c51f0454cf3e952a160ea6952910a144e1b19853eb7a64dced9ac5ad3
SSDEEP 49152:1B+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl1fJ4klKXn4:7u6JmIxd2d1fJ4k
TLSH
T102D59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 a44260b85234316a5f41b34339a889ec4875cd68b90a2a104b2e31c52d3014f2
MD5 c339678908bfca37aed6fd5cc346ab3c
SHA1 d63ae16afcf4f7a916f1d69a368fb157e35fcae2
SHA512 af8143c137d94176de3831aa41e5aa504c880347a2322fd1653c3329ba31742316ee0cb4d0c418aa084a32a2af4672072f982735be54a2f7803528584702e07c
SSDEEP 24576:nEwvrk9RX6wkyAIyfJ4yL/tNCJPXUQrP92cvQ/asw4NdIeJkmUje1wUEyBUsyJPR:LMnYIyfJ4klKXnV/kYej15VHW
TLSH
T174850129EBDC44E5E1B7927C89A3820AF7B178591B31C2CF029653AD1E37ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 4.3MB
SHA256 9dbcfb9519385ad8c8a929680640de3e663e52ff08bf3b8379a78e9efdd9448b
MD5 d2a1d495d5a8ae9c603d581358fe07a9
SHA1 e885888a22219a8dfbda9b022e530adf4b07d7de
SHA512 e0151dce9032c76d2e16b9192ae3bdb2070690bc206663f195be2af1d837f31299c668e78dea44bd95970340f92ef1bedbf5ecf1687ef73f6f139dd19ff30168
SSDEEP 49152:KYmeNpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0FfJ4klKXnCEkS:tySzPtfJ4kGA15V2
TLSH
T1EF269D96A1A841D5C1B9C1B98F0BCC1BFB7134490335ABEB02E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 36e90c83e58a7f2b38f778f444ed9f9cc1c2cedd3ecbd6fbc21e4175f074b458
MD5 ce6b341709d1da318528232ed32347f7
SHA1 485a2b122a5caabf1dbbceb04a303ccf98e42ea9
SHA512 57aa931be0bc99b13494407a76180b17df23ab1f6a2eddc5fb8b3a6f2bcc4900fadd6f5a0eebbed0a60793df982466f1db63495a7cb8484b6166a98073ef4b91
SSDEEP 49152:Kq7JUQjAirIhCnDHUPfF/1fJ4klKXn1IkYej15VHW:nJiglD0PXfJ4kvA15V2
TLSH
T1D2B5D01EA3EC01E5E1BA92788515865AEA71742D2F31C6CF12B0837D6F63ED44F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 964KB
SHA256 7d1d16be5ab3d091848121d7bdaef0da8da989137dd5089b1aa2f742458175af
MD5 e15f597fd75928f11ca683ea82ca1173
SHA1 e5e4727ed3cd0246aac0e97dba7174a044da773d
SHA512 a429d7136a57c857025eacfe2cc53c39761a2f073bb6476de855b3f5518b3bdca3b7f856e995fcb68479891291e53336601eb596bd8d818b058225a013935917
SSDEEP 12288:mSGfU3fhgpbON/D5vnY/0voqcITFbvxComEWaRM7/es4wRhTpj:mSAUPSlKD5vnY/0voXmbAhEWaRMLa+j
TLSH
T1B525F711766ACB4FC66944321E37D2CCA7703D11EE09AF0773C9873F9576658BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 338KB
SHA256 4863821158c070c3244660b66f8fc8c5ef5b779439f7583e412152738793c593
MD5 67774730865a41b0fa64289f34605473
SHA1 dc65dab9506bfaf1312817bb8e038fc7ae6ef034
SHA512 32c9ba9046b51c36c5b51cba23e3d94db5daa928a41230ead145d3e54dd954dd7329f2548c2627b066fdf83c161c86553573f05666495bb0a396ee10f7ca1eaa
SSDEEP 768:B/T9UlTPBlTz2+EQMR/Tr4jUlTPBlTz2+EQMB/T/oVlPx1oVlP1Te0ZxEF7xxBd4:LZ4Xe7Pk7P1TeOKy2kBwLNz5LaF
TLSH
T18774B815B714E31EC0BA80778871D19A6B39742ADF121B033BCC5B7DDCB610A36B6B99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RepairConvertFrom.docm

Path C:\Users\Admin\Desktop\RepairConvertFrom.docm
Size 776KB
SHA256 e1a9fec1df63c50e718439636d808546af7ac23358bbe6cbc6a123d7ea5342d5
MD5 5d4abc8bac894bd849c0ac60af894ad0
SHA1 2c58b134ef7f8ef4d6de7d672976a8cecc02e984
SHA512 36849527b315bb65e3eb3c375797654f3d46073f57e4a5a5f26921a89e302e84b1efae786dc6a8cbb756b75697e0a0b6d2984d5b7b2fc57982d9aa3540a2a848
SSDEEP 24576:IQnZ8m1CcQfFMq2a7w6UvK5HDleBrF3xaZm3GVaOCpn:IQ+JccFMOxUWHDleVF3L3GEZ
TLSH
T135052318CC316CE8DFA65BB5861F2864A9FF641E366725E3091E75783D1B1BF008BE90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallExpand.docm

Path C:\Users\Admin\Documents\InstallExpand.docm
Size 777KB
SHA256 4b41c1bd57767ecbd8a40c2b5552994485f9bd72a5b27f5b7b8ffa97593f5d6a
MD5 42a4346b2a1a47b646cdad510c928f1f
SHA1 52a1c69df903f0db6923647a36cfd0d9a70b140f
SHA512 4d04d4a7a3cdc1753532c527388234191da857a0bce63bd1cfc2b5cd683fb20a44e984549175c3a6e9467dfd6eff22b9ed122f9e94ddc26c0dacd787c6404c9f
SSDEEP 24576:cunZim1lcQoFHq2BbjM7+KgHDNo29T05Jr:cuACcLFHFbjMKHDNo2y55
TLSH
T1AF05331EE4AA04D6DF156DF8CCDBA8E67CC2180B3B02968B98B2F51070D555B3857ECE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 1013KB
SHA256 c6f22cd0f5393013f54c8146724117dcf1edbfe375520a18418b1449c27eeb13
MD5 f324f996a904a8025f416e970f654d69
SHA1 e9d0b397b0eeece5cea8bac97ce6e89519e7a447
SHA512 3e113acfeae6c2128fa95dd46e7009d701bcb21a1dc4af2610c470447b6aa924312c4745a01a1e70e98fbb826f72034bfcb2e568eaf769b3a79c0c6e1d9aa768
SSDEEP 12288:p85bM3n3xYfj63hgD1ZiVfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SY:93n3i63i4fJ4yL/tNCJPXUQrPb
TLSH
T1AD25BE1273E99135F6F31B31AFB492515A7ABC629D39D20F23C4290D1DB0A90EA75B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 8d49242dacaafed24abd3ba5e625684c38fdb8b04164fdc9a8a4e2a12187178a
MD5 09716e0acca98483e9f4870e2f50657a
SHA1 5cd20541ab3ea615d67e095961ee43dad3e6f1f6
SHA512 9d8e45e33f27e5e3e797b7fdf5ea5c1b1774211ffa808e6119c63faf8bdb21146a894132d2d67da50ecf929a50f39a63b6d42c8accfbd9f5ecb83f510705badd
SSDEEP 12288:FM72fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sw:+2fJ4yL/tNCJPXUQrP3
TLSH
T1CBD423A751C49846ED7687F8164CE000D309BED55B2BA2E7EE02B4857FFC98A1DBC352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 2.1MB
SHA256 0e4f3a4cda3de82fe0487c6d14113f38667ecc4b85b1da3fa1d14b9dba5aa67f
MD5 1adf46747f333d6943bc9af10556aa0f
SHA1 900cbb3daab7dd9113debdf55ccf89f0103d5546
SHA512 1206841476a315f0b08f39daacd9e366c0eefb964e730b1fc5ff3d6435da30b78d888765a92dce6587e70ac9a7cbf39b458711babc12eaf288a1befef960e726
SSDEEP 24576:Ygb6bmBIi49WNNFpg1rSvFv7bYAfJ4yL/tNCJPXUQrPd/cvQ/asw4NdIeJkmUjeM:Ygb4mBIBhGFffJ4klKXnVkkYej15VHW
TLSH
T1FCA5D01E22EC02F5E0F5E2B8CDAA4417D6B278161732D2DF1251426D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 832KB
SHA256 fa97c2086f8eed17612b0c0b32fd486e2eea3b642024a66daaa5dd4285219e78
MD5 068c76eee0a1b94f8eb156dee52ca59a
SHA1 04e872929b6786cb2966b9c401e63f8152b20c75
SHA512 0bb113aa06b52c54ea181f62e4149ca7da8e36165069379762b73781f68f95b542786f3f37059c9dceab47998789771bff132656c12edab0414d67285b9229c2
SSDEEP 24576:WGtcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:WG+kYej15VHW
TLSH
T12705235CAEFE46E0C17596788931D0A83EB43150B740A0FF09D299B59F727E06BB8E74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 b7bcdb34edcba2f28e2a5b6659c3d1376b779d5ae9317ac62d5408d4d934517b
MD5 db31b092bb415fd6366196e7e54e0c9e
SHA1 6c6ba37ab916222bf687aaafd47dc00ead8f000d
SHA512 d2ea9ade296459035ec7f2c32617897086168a44595232298289aa98f965dde5f528bc9856902cf29ddd5c6fae9d659031d618a4d09449c0e8956c0a4fc697c4
SSDEEP 24576:RG88u8FpJqH1vzria7/mvfJ4yL/tNCJPXUQrP8:07ZFPqVya7/4fJ4klKXnE
TLSH
T1C435026676E101F1D477D1388A868663F771B8150335FBDF0BA88A512F23AE50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 044951db6607474f721c608b4417417418aabdb49c3dd07901d97a1b5d93de1b
MD5 0fba3c3b73552dbcf4026d043a48f53b
SHA1 8af574ed4ee5c9b10c277f5129747dc0a9ed2ea2
SHA512 b349b4b045072186201ee6c1dbdb22617ee1719e88a3563506313fd76593d2559c437030e077b6883cd8542c4453f5ec822aa097721c36b44624905ddce06e73
SSDEEP 49152:mBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjrfJ4klKXn2:JG05lO43bqfJ4k
TLSH
T136D5CF6E62EC11F9D1BBC17CDAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e3bd5b0cd503494c467bcd58d36cbfe8fe336adc5a72652e6db21f02454f7f16
MD5 3328402de1d63e24e8aa3a6a7511c42b
SHA1 76ad210d14d97381733980b1bdb1d3fb3b391f89
SHA512 6cc14781ceeedc9fa8bab522b39a51a6a825025290fe43d88fc64971b737c618073a3e6774f83bee8ce382e5894b1cff899a40c0879c2ecc4099db99fbe14467
SSDEEP 24576:hfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnFfJ4yL/tNCJPXUQrPJ:ha5POZ3lJt2pasx2+mTfJ4klKXnB
TLSH
T1FA65BF5EA6FC00D5D579D17CC583861AF5B1346653329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1febd85ece00effc72094d96f85c7a8803446342d6235de79c958880ef6ca38b
MD5 ca087194da7e33fcf48800ae09070180
SHA1 64647c894db34aa0318ed3dba9d1bbb412c3be38
SHA512 69d2f17a3f2e0e559b9db58e5191bb5f1bec10e2e424c2305a10885478b0f9074a9a0df245aee55b73ae799a447853e913322cf75615d0fe3601a691974d5a9e
SSDEEP 24576:gNcwHdjbyQ4nLC18lb/EOjowL7Fk3fJ4yL/tNCJPXUQrPv:gNc/zEOVHFYfJ4klKXnH
TLSH
T11C858B2623E901E4F5BBE1BE89679546FA717869133486CF0291811B1F73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 948KB
SHA256 d49fc409861465a0d511e7c9a63135f77ed27d6d4dc6f6d909db9100fa8dfdf6
MD5 fe8f90365e3c20ec1b63881026d0eefd
SHA1 2e0ea52e2bb08c4edb2f587f0ae579c416f0e6ab
SHA512 942966de568e7bb35e83f8fa02e9a643bf382d32e97ff64f83272cad2d1fcd22d74d4de564dbe701718e1d105e79296bd967379907b141dfb010dd8b2b2da37c
SSDEEP 24576:A4DIYcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:A4DI9kYej15VHW
TLSH
T19925114C67BA01F5D1A7E03DC6934141E6B1B070975299EF0AD1C9BA4EB3FD8BA38E50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 932KB
SHA256 4d6b0aac4e73814ae49df2a0cdc9094a072b1ef6522a0360cb5654455587b9b1
MD5 be19e041ef028e3816c25d71bd27b91b
SHA1 7d98d3812ed74a02f726eda08556e2a4b2e0c2bb
SHA512 500a007c56b1853c1d0e9e5805ba70af8228edb763d594bb892814062880cf8917dcee464fe220bce395381143517e0716c507192c2eeff5adf510c674624480
SSDEEP 24576:ctyacvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:ct0kYej15VHW
TLSH
T16D1523049BEC46D1E6B516789E72C1A45F34BC10BB5092EF55D2AA7E2F327D0AE70F20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 804KB
SHA256 4616123311cfa5f93ff199fc9218b83b4a3485c8047640a39aeb93019572b281
MD5 782bf37152b3cde6e7e43b34292c1e6d
SHA1 136357e54bba59ff30b09e09110d4549889e78e2
SHA512 66f20c4a2476b210b2067e9e1189ca002eb32e2ca752e50e260bb25221f800fc73077fce10141c57cfc968f68fc136df6f2a9318aa0bccdb6652af4dd21cad79
SSDEEP 24576:lvcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:lUkYej15VHW
TLSH
T10B052348DEFE87E2D14079B84A31D1981A786224BB8090F769D39DB14E727D15FB4F30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.4MB
SHA256 9e3b0a0b2d6cf92589d65d0757b3a4a90ae90588dd8c37109835f998ddd181b0
MD5 be151181f2aac060d97b6bf59cabc58c
SHA1 7fdffbcc9d57235fbd96b4badbaec4dd2337a474
SHA512 027995a15228f55c2ceb23d06db84998d9b83a044101243ebdf0348d141d0143be2cb28678949769da428e22bc6b9afdfbe11f9eef5200115d57cfa0bdbcee82
SSDEEP 24576:5HgE5oTfaidZXcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:BgxTrZMkYej15VHW
TLSH
T1D265AE1DA7EA05CAE2B2D675D8325493D633B4315771C6DF2488C03A4DABED8AE74F20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.1MB
SHA256 3847e173657655726224530b2aba63f5c8ab8ca51f08329b27ae08f4dfa2e991
MD5 a768a5e829c27498a3ffea499f3d8ed5
SHA1 f2bdab792a23faa9d567d6570c43ce6485dac67e
SHA512 b32a01f7bcc1290a9785e27819ae52980c747a98014cdb6d130fa369ea2ecfbcd943f96f63db5ddef036fb1e42c7777a261aa08b7e128474e1ba22e8e671629d
SSDEEP 24576:7gb6bmBIi49WNNFpg1rSvFv7bYAfJ4yL/tNCJPXUQrPd/cvQ/asw4NdIeJkmUjeM:7gb4mBIBhGFffJ4klKXnVkkYej15VHW
TLSH
T102A5D01E22EC02F5E0F5E2B8CDAA4417D6B278161732D2DF1251426D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 203239188f5ed77897d82d4bbcc5340a1dd431273c19d3f1302a9215fcd698f5
MD5 1a418edd3c0df65f7a017f6df878195a
SHA1 2c10daa7a07d0198a1e050af2f55f2714a19920d
SHA512 39c9b4091d283ce6de1f4fababbc276d1e320d5c9b5ebc4a3c3b0edb1330efdcd98b952574f36ad9b2ff1537ff1fe7417e4db63f7155c45ee76a74e1ebf2f050
SSDEEP 24576:bTkNvNnaFeYhJNtmZBmFcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:bTMwBtOmGkYej15VHW
TLSH
T1FD75C06EBAF846E4D1FAC6B4CD238512EA727451173292CB5390C13F0E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 0744d05de65f32fc104400625ffab3381b74b81c90a3168c9eed21255b9cfd1b
MD5 bbe7cd99ea4ff4307d12639cb0502b4d
SHA1 db7587871859d5e5fca52db99d02794a2f8e9fe6
SHA512 30ea440d0d2500303de5984972db7979e8ae4ed8d030d6434fe95ea3d4def347943d1a287bd61d81627ab33adb4a5a0447ba0fc11ec8d46fcac45c39f342492c
SSDEEP 12288:/HvUrBFrEjwaQbfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S0:/PUr+NQbfJ4yL/tNCJPXUQrPX
TLSH
T14E05F16F22E818E5E676E17C89858209E771B8A21312D2DF02D1817E5F77EE87D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 97cff3ee9872a1acea3b595d80ac0ec442e7a702fa5cb2e1e8d7008eb6f8b4f9
MD5 51082185385b0f198798bfb8b565aebe
SHA1 d0602374299229be63bf8fffbe7fa97885799379
SHA512 56c0aad571ec4c2f14313daaf42779c610d719ec03296a44939b5af9874bbc8c460afeba4b9101776007973b075b0721a95144a2d8c683c38796613d725159b1
SSDEEP 24576:jD3FHshBIYQgAafJ4yL/tNCJPXUQrP6ScvQ/asw4NdIeJkmUje1wUEyBUsyJP4jW:jDVHeBIAAafJ4klKXnirkYej15VHW
TLSH
T12B85027EEA9C04E4D57AD2BC8A53C506E77138A9032265DB06D181B62F7BEE42D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\system32\TieringEngineService.exe
Size 1.1MB
SHA256 dc5768f63fdb6d54c4023e3d735f6ec2fc954ed00eaa2723f6e0ceb89dee0984
MD5 f765627a96d5a68c01e7f983e1bd4270
SHA1 442ae2d65d2f4b8c37ee17decf1cd1fe4193997f
SHA512 ac87b960559bc9f01c70f158db374321be6561b39a9cff8e10030ca797e60e7bd2c133538aa55fbdfc72f99b42134cb12a6008895d2b1ac407131a5250980e4a
SSDEEP 24576:zJnJPbzB4SvcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:zJnJv6SUkYej15VHW
TLSH
T1B435E12DD2A810E8E4B7C2B4811A1799FF31346D2F2169D719B4D5353F12FE0AA79F28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 796KB
SHA256 8ad02e3b069d84da40437322984f16ef0d7d710f978b95434082ceb709951a87
MD5 6960db6b707a13dd91f9dfb2076ed7d5
SHA1 16073d338768335337c8001199652eee13b6eeee
SHA512 48000d88a15b58d965794389c46d4e2f720474406b8f9480a0b4bac7312932fb1bc76753caf5d1d7069a7dc9bdc075976366540f91cc86f5590aa40f7bc45d08
SSDEEP 24576:KJcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:KakYej15VHW
TLSH
T141052348DEEE8BD2E24069B89A31D5981E784204BB80D0F369D36D925C727E65FF4F70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 940KB
SHA256 e16f9f2257fefdfdf2f675e3e681e5ee14982fed8744e62e30a7fb0cf8b938db
MD5 eb9f7cdcd57ca5b549208da9733e980f
SHA1 f44bd7e615c455ddb34761584ae7c745b4b6c5bc
SHA512 89025a8bb24b6ad8f04a8d4050fc75714edb015fe8a97224872e9556970ead74c2bf8a620ffb1c563353ad4d1ebb011d21d13a62ad9135cb728464f21a84348b
SSDEEP 24576:a6UqjpNcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:a6UHkYej15VHW
TLSH
T13A25234D9FE845E5E0755274DA31C16846B4B83227A494FF32D19ABA8F32BD09A3DF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vssvc.exe

Path C:\Windows\system32\vssvc.exe
Size 2.2MB
SHA256 fed56951fdf2435bbc2fb44d3bde5683d5076990df79fe8c73f2ffc5eb5f72c7
MD5 32dba00592739753aeb1b6e8a76d9256
SHA1 e617974765eb1a84545455afce753c5dcc147750
SHA512 44d10bc6147f7c07be31e7f1b0d3449e53950177cfba0b04d5eff47d51812c41011c608ae2bdbd6a116b69e2aa8b008199e4dbb5d81e6d8f7ba2e29361dee6d4
SSDEEP 24576:2CLHGL0MoeVtFumTijCmlKQWDkicvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:2CLHGeeV5ijCmlDWDk7kYej15VHW
TLSH
T1C2A57C05E7EB4184F8F3CAF5CA2694169A327C549B34F7EF4A80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\system32\wbem\WmiApSrv.exe
Size 964KB
SHA256 04c47ee30d159baaa83a031e610df6c610638cb8e567b65d61f211666ef45059
MD5 589235e5658e375067e292899bd05cdf
SHA1 b1ba25a3464b5928e7843598cd8fe611da40d154
SHA512 6a30479f0f576a1f4a8fabbb427479d624f6a7a6913b13ef1b4edeaeaf5b92cffbbb1b6a09cf063d326b7f9b0c34064f0bd9718e90d7d787fbb38446a0a918c5
SSDEEP 24576:hrcmRtcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:1cmR+kYej15VHW
TLSH
T16925014EB7AE00E2E1B7917CC9418155E6B270306751A3DF02E2877E4E67AE97E34F60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\system32\wbengine.exe
Size 2.2MB
SHA256 89f65dd458f2475e6c471024a82e859f6d0b8868c8872f4d67883c62649f85fe
MD5 a8184709e3859dd7336c6c1dfbcc1548
SHA1 58e8b357239e81abeee217055d0c0265888f9a3d
SHA512 81c9c86384dcdc57d9be0920b62baa43547493557e4dc11b58b11c6d59ab1b0425ab56e9f285d72b31945e454eea4171ce880f106947e496e7205be4d56804a1
SSDEEP 49152:lDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3/kYej15VHW:m3Upow8sBuA15V2
TLSH
T1A5B59C3DA2E800A8C9AAC379C54213A5EA71742D3F3055DB01B4C5B8BF1BEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1952-118-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1952-111-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1952-112-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1952-339-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1952-373-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1952-371-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2680-191-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2680-359-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2680-185-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2680-184-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2692-54-0x00000000016C0000-0x0000000001720000-memory.dmp

Download

memory/2692-53-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2692-62-0x00000000016C0000-0x0000000001720000-memory.dmp

Download

memory/2692-76-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2692-74-0x00000000016C0000-0x0000000001720000-memory.dmp

Download

memory/2860-149-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2860-355-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2860-153-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/2860-156-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3720-178-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3720-175-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3720-168-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3720-181-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4168-34-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/4168-28-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/4168-135-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4168-27-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4168-35-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/4460-89-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4460-321-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4460-91-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/4460-97-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/4524-324-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4524-106-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4524-107-0x0000000000890000-0x00000000008F7000-memory.dmp

Download

memory/4524-101-0x0000000000890000-0x00000000008F7000-memory.dmp

Download

memory/4536-52-0x0000000000400000-0x00000000006F1000-memory.dmp

Download

memory/4536-7-0x0000000000E50000-0x0000000000ED5000-memory.dmp

Download

memory/4536-6-0x0000000000E50000-0x0000000000ED5000-memory.dmp

Download

memory/4536-14-0x00000000030D0000-0x0000000003137000-memory.dmp

Download

memory/4536-4-0x0000000000E50000-0x0000000000ED5000-memory.dmp

Download

memory/4536-20-0x00000000030D0000-0x0000000003137000-memory.dmp

Download

memory/4536-0-0x0000000000400000-0x00000000006F1000-memory.dmp

Download

memory/4672-137-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4672-143-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4672-358-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4672-356-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4672-136-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4672-350-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5588-85-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5588-78-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5588-79-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5588-278-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5844-41-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5844-40-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5844-49-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5844-167-0x0000000140000000-0x00000001402D4000-memory.dmp

Download