Analysis
- max time kernel
150s - max time network
158s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 20:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
25 signatures
150 seconds
General
- Target 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe
- Size 1.7MB
- Sample260930-yrdk2a1w7l
- SHA256 f5165411cbcab99a6469925b20f746bbef853c59e0c5455f6dc8adedd45d5e8b
- MD5 65cea36f547c56fde0de31f0e1a2b126
- SHA1 aeb3c1af47c1825fa1b25208d7705b7a52cae622
- SHA512 e75b9a72a36f0af942a3e00b8d2db4c167300c83d8a98671627e6102ae20c6eadea9e30e5f3bd1cd72a3c1a22413c4e63d6f8fa9033a51f5e5057d923398637d
- SSDEEP 12288:w9ccnNCIvpAtGT8JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHi:w9DNC0AtzdCN/j2GLl3iFSE33b9L
- TLSH T13785F121B8D1C073D567093689B8DF795E2DFCB08F606AC797801EFACA30AD19B35616
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables calling ClearMyTracksByProcess 21 IoCs
resource yara_rule behavioral2/memory/3288-172-0x0000000004E50000-0x0000000004EA8000-memory.dmp INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess behavioral2/memory/3288-173-0x0000000004E50000-0x0000000004EA8000-memory.dmp INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess behavioral2/memory/3288-175-0x0000000004E50000-0x0000000004EA8000-memory.dmp INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess behavioral2/memory/3288-174-0x0000000004E50000-0x0000000004EA8000-memory.dmp INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess behavioral2/memory/3288-181-0x0000000004E50000-0x0000000004EA8000-memory.dmp INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess behavioral2/memory/3288-219-0x0000000004E50000-0x0000000004EA8000-memory.dmp INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess behavioral2/memory/3288-234-0x0000000004E50000-0x0000000004EA8000-memory.dmp INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess behavioral2/memory/3288-232-0x0000000004E50000-0x0000000004EA8000-memory.dmp INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess behavioral2/memory/3288-246-0x0000000004E50000-0x0000000004EA8000-memory.dmp INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess behavioral2/memory/3288-235-0x0000000004E50000-0x0000000004EA8000-memory.dmp INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess behavioral2/memory/2020-379-0x0000000003DB0000-0x0000000003E08000-memory.dmp INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess behavioral2/memory/2020-378-0x0000000003DB0000-0x0000000003E08000-memory.dmp INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess behavioral2/memory/2020-381-0x0000000003DB0000-0x0000000003E08000-memory.dmp INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess behavioral2/memory/2020-380-0x0000000003DB0000-0x0000000003E08000-memory.dmp INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess behavioral2/memory/2020-382-0x0000000003DB0000-0x0000000003E08000-memory.dmp INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess behavioral2/memory/2020-383-0x0000000003DB0000-0x0000000003E08000-memory.dmp INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess behavioral2/memory/2020-389-0x0000000003DB0000-0x0000000003E08000-memory.dmp INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess behavioral2/memory/2020-406-0x0000000003DB0000-0x0000000003E08000-memory.dmp INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess behavioral2/memory/2020-397-0x0000000003DB0000-0x0000000003E08000-memory.dmp INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess behavioral2/memory/2020-391-0x0000000003DB0000-0x0000000003E08000-memory.dmp INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess behavioral2/memory/2020-390-0x0000000003DB0000-0x0000000003E08000-memory.dmp INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess - Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe - Executes dropped EXE 11 IoCs
pid Process 3224 elevation_service.exe 1936 elevation_service.exe 4660 maintenanceservice.exe 3328 OSE.EXE 3584 PerceptionSimulationService.exe 3764 perfhost.exe 4844 ReFsDedupSvc.exe 124 SensorDataService.exe 2092 ssh-agent.exe 5724 AgentService.exe 2744 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 6 114.114.114.114 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe Destination IP 28 114.114.114.114 2020 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateManager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe" 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe Set value (str) \REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateManager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe" 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened (read-only) \??\X: 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened (read-only) \??\Z: 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened (read-only) \??\I: 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened (read-only) \??\J: 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\H: 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened (read-only) \??\Q: 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened (read-only) \??\W: 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened (read-only) \??\M: 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened (read-only) \??\N: 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened (read-only) \??\Q: 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened (read-only) \??\W: 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\D: 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened (read-only) \??\L: 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened (read-only) \??\Z: 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\G: 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened (read-only) \??\S: 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe \??\F:\ elevation_service.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\T: 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe \??\F:\ 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened (read-only) \??\H: 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened (read-only) \??\w: SearchIndexer.exe \??\F:\ 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\K: 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened (read-only) \??\O: 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened (read-only) \??\R: 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\M: 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened (read-only) \??\V: 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened (read-only) \??\V: 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\L: 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened (read-only) \??\O: 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\B: 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened (read-only) \??\U: 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened (read-only) \??\L: SearchIndexer.exe - Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 icanhazip.com 3 icanhazip.com 27 icanhazip.com - Drops file in System32 directory 41 IoCs
description ioc Process File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\System32\vds.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\locator.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\dcb3ed5f227843b8.bin elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105656\java.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105656\javaw.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\7-Zip\7z.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\dotnet\dotnet.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe elevation_service.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1184 cmd.exe 1960 cmd.exe 6068 cmd.exe 2948 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname elevation_service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain elevation_service.exe - System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a3c581731651dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000048b9c5741651dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000053d832751651dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fed5cb741651dd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000057e644751651dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4356 schtasks.exe 4776 schtasks.exe 1720 schtasks.exe 1716 schtasks.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 2020 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 812 Process not Found 812 Process not Found - Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe Token: SeDebugPrivilege 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe Token: SeBackupPrivilege 4844 ReFsDedupSvc.exe Token: SeRestorePrivilege 4844 ReFsDedupSvc.exe Token: SeBackupPrivilege 4844 ReFsDedupSvc.exe Token: SeRestorePrivilege 4844 ReFsDedupSvc.exe Token: SeBackupPrivilege 4844 ReFsDedupSvc.exe Token: SeRestorePrivilege 4844 ReFsDedupSvc.exe Token: SeBackupPrivilege 4844 ReFsDedupSvc.exe Token: SeRestorePrivilege 4844 ReFsDedupSvc.exe Token: SeBackupPrivilege 4844 ReFsDedupSvc.exe Token: SeRestorePrivilege 4844 ReFsDedupSvc.exe Token: SeAssignPrimaryTokenPrivilege 5724 AgentService.exe Token: 33 2744 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2744 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2744 SearchIndexer.exe Token: SeDebugPrivilege 2020 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe Token: SeDebugPrivilege 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe Token: SeDebugPrivilege 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe Token: SeDebugPrivilege 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe Token: SeDebugPrivilege 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe Token: SeDebugPrivilege 3224 elevation_service.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 2020 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2744 wrote to memory of 1688 2744 SearchIndexer.exe 100 PID 2744 wrote to memory of 1464 2744 SearchIndexer.exe 101 PID 2744 wrote to memory of 1684 2744 SearchIndexer.exe 102 PID 3288 wrote to memory of 1184 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 103 PID 2744 wrote to memory of 4320 2744 SearchIndexer.exe 105 PID 1184 wrote to memory of 4356 1184 cmd.exe 106 PID 3288 wrote to memory of 1960 3288 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 107 PID 1960 wrote to memory of 4776 1960 cmd.exe 109 PID 2020 wrote to memory of 6068 2020 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 113 PID 6068 wrote to memory of 1720 6068 cmd.exe 115 PID 2020 wrote to memory of 2948 2020 2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe 116 PID 2948 wrote to memory of 1716 2948 cmd.exe 118 PID 2744 wrote to memory of 1616 2744 SearchIndexer.exe 119 PID 2744 wrote to memory of 2796 2744 SearchIndexer.exe 120 PID 2744 wrote to memory of 4228 2744 SearchIndexer.exe 121
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe"1⤵
- Creates a file in the Startup directory
- Unexpected DNS network traffic destination
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\WindowsUpdate\ScheduledStart" /tr "C:\Users\Admin\AppData\Local\Temp\2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe" /sc onlogon /ru "SYSTEM" /rl highest /f2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Microsoft\Windows\WindowsUpdate\ScheduledStart" /tr "C:\Users\Admin\AppData\Local\Temp\2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe" /sc onlogon /ru "SYSTEM" /rl highest /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4356
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\WindowsUpdate\PeriodicCheck" /tr "C:\Users\Admin\AppData\Local\Temp\2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe" /sc minute /mo 5 /ru "SYSTEM" /rl highest /f2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Microsoft\Windows\WindowsUpdate\PeriodicCheck" /tr "C:\Users\Admin\AppData\Local\Temp\2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe" /sc minute /mo 5 /ru "SYSTEM" /rl highest /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4776
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:3224
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1936
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4660
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3328
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:3584
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3764
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4844
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:124
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:2092
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5724
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1688
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:1464
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3048 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:1684
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3028 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:4320
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1616
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3048 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:2796
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3028 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:4228
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exeC:\Users\Admin\AppData\Local\Temp\2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe1⤵
- Creates a file in the Startup directory
- Unexpected DNS network traffic destination
- Adds Run key to start application
- Enumerates connected drives
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\WindowsUpdate\ScheduledStart" /tr "C:\Users\Admin\AppData\Local\Temp\2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe" /sc onlogon /ru "SYSTEM" /rl highest /f2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Microsoft\Windows\WindowsUpdate\ScheduledStart" /tr "C:\Users\Admin\AppData\Local\Temp\2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe" /sc onlogon /ru "SYSTEM" /rl highest /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1720
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\WindowsUpdate\PeriodicCheck" /tr "C:\Users\Admin\AppData\Local\Temp\2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe" /sc minute /mo 5 /ru "SYSTEM" /rl highest /f2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Microsoft\Windows\WindowsUpdate\PeriodicCheck" /tr "C:\Users\Admin\AppData\Local\Temp\2026-09-29_65cea36f547c56fde0de31f0e1a2b126_amadey_elex_luca-stealer_lynx_njrat.exe" /sc minute /mo 5 /ru "SYSTEM" /rl highest /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1716
-
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 d18d706e280ad58d33c04d675fa136aee9dfaa52c2096655710433edcbe2854c
- MD5 cd1e7cc8d240a8f096818967792eb732
- SHA1 31eaa01ec4062ce9213e45f0b80fc2e903f744c3
- SHA512 06d28bd7a8126f6ba43eafc3f540d17e247658f21fb58f15ea19ff567f108a4098ac584e85e87f0ddb647ed937dce5f0c67c52e27d14de17b7ee53ffe97cc74d
- SSDEEP 49152:Sb+632BuPkFKRrdE6ohmstBhuXjfS4LWxntN/j2U4FH:03q6HjB6j2jF
- TLSH T1FBD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.8MB
- SHA256 5eea6fa00514ddec39655662fc842c9a52036c45e77c536bf9bd18c4224af55b
- MD5 30088e500b8142a523342c5ca7abda1f
- SHA1 d74c36da92e2f42912e96910cc9c702482215d76
- SHA512 9f9850248327fa3a6a45ad804d0b74083d2571ff7abbed277f5a95479ce2b99bf06e9a7e75827e24bca2a4cffeb7c0bbcd734583403edae625207fbc8667e099
- SSDEEP 12288:J1XLsswWkxy2lRq2czAlJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:HXYfDtczAhdCN/j2GLl3iFSE33b9
- TLSH T1EE85F128B7E409F9EC67827CC9A1C511E632B8948760E7CB03E49A661F337D85D3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 2.0MB
- SHA256 ef1fe9a7a02b0078887e13d30e1ff4d548598b56087c68f1d3425b24df0263bc
- MD5 2c39340e907fd0f58806c59dbf0f441e
- SHA1 7589e883360c7652cc314e950335e44abe21dc12
- SHA512 42d847720d74bfd136de0f9b8cd946573836bb0dad3802332d10f8fef3e84c0bab76e0cbae363392896f1bd251bfed220888d36b838026dabd62563df2d8e3f3
- SSDEEP 24576:y0Le5ji0hmxirMydCN/j2GLl3iFSE33b9:yPji0AcwN/j2U4FH
- TLSH T10AA5AE26F6748335D073C0B9C5D2A69AE93130855B308ACB4286D77C7F67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 1ae2b25d53ac3a0d6287659cb6e7705bf42e98c6467c635f75e5268fe48d86ff
- MD5 30492facecd94d2f45875dbb5aec24f8
- SHA1 2bffb2e6a31debe3de01ac16d77280a9c6731a3f
- SHA512 df15d2365cc7fa1bbad7d927da53337eeb38eda8c1f2942d517db4dc2d325023e777885fd497268862f44c6a05a9372319685d54efa0242777cfa019a2d7ca38
- SSDEEP 24576:Ua7/ezSC6vUyD/aqgrvWE6q8wyuAdCN/j2GLl3iFSE33b9J:D/ezSC6vUzPvxHjy8N/j2U4FH
- TLSH T1CC755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 4d51927be5226f5bc82adb59df1a255598fff6bff7053370afaec55b07911e90
- MD5 e0dcdbae71726f49b09b701d6175e6a2
- SHA1 e178de01f685ea4181ea7c80bcc2984e0f496180
- SHA512 0a70f06af9cd4d892087ff48f922d4d2927753ab79b5c532b0f216cee35dd0666081a2ac5c6af3dfe1590db40f21e3895591271d4bdb7f1f7bdf40fcbf91824a
- SSDEEP 24576:iVbqPb88hv/l+6VdCN/j2GLl3iFSE33b9:iVO88hXl+RN/j2U4FH
- TLSH T155559E65F5B48331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E67BE6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.5MB
- SHA256 5dfb6634786818d7194c6a855b30f162c9645ed8b128eddc73191323a734f28a
- MD5 ff9003588b1232715ef647b199640789
- SHA1 cb005a816cce5fa10241aad2c06c95e582ab84ad
- SHA512 d0e8ec9c4629ddb684165f7ebfad29268fb9334177b4d74cd2d0ad8f6396a621e3cfb83206c06495d367712342abd821b8acaa007f685a68efc05ab9a744e470
- SSDEEP 12288:mRaJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH4:mRmdCN/j2GLl3iFSE33b9d
- TLSH T13E752364DAA5B565F6AF837903ADDE616200FEE8E525884385917BEF117CFE8C033063
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.8MB
- SHA256 394f3aa3d5c77d50ac8b2759b904a397ff2342a19987b70186e863ff4a53a6fa
- MD5 485a99237715905d508b0abd6daf5a35
- SHA1 56ad910b0d4283420301e55adbbd01ceee83f57a
- SHA512 affcdd5a0e4eb0a6dfc6ef11a1fe45975122537f53a6bb46f73f08c1ccc2e977804dfefdfa1227e32a72dd81430c3e671065ae51c7d411cf4594d5b61dc46657
- SSDEEP 12288:JeBNUbTVO86U5JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:JJIUddCN/j2GLl3iFSE33b9
- TLSH T15185CF3BEE28FCE2C27E8DB85791C600D76278708B6293CBD165834E9E235E45D76C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 332a46a9cdc97e74bae304e03c590beb691a13807bf3e0a5901cd1c7273d85c1
- MD5 bd6b41bc0d743a39a4cbcb160ad9c749
- SHA1 82e2b101e99c1f2d09bb505193178b1e4da3b099
- SHA512 bd7030e2f33cd6dacb7385e978dfaaf8e2c40d2329a96b92646d4b8a781ee99e9f49558b5513e0dd858572e1219e97b47dfd39a6ae06df337cedae23b4861d82
- SSDEEP 49152:jQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THz:jQvGAdlCEL8c/yRNw5C1j2jF
- TLSH T151267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.8MB
- SHA256 df638af1d505c2f28b1328feed354c429f359d817c70c8169f63e2b8634d2c62
- MD5 b9bc2b5588e2f5fe55fca267df6fb837
- SHA1 f73c6d6231e6197bcfdaff2dfcd4e56889a87d44
- SHA512 c725da1857a7bbe464b8a6c581f8f8134e5b21489eef6cd5177e11a5798a0ce0d188a7730fe1dc1c3ddb6ed9ccaf75b0d3cb5838ab10f855a51111e1a8dd4140
- SSDEEP 12288:dAwSfxL/2Dc34DLLmt0LDQewsAj7JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9M:OdewsAjjdCN/j2GLl3iFSE33b9M
- TLSH T1AC95E031FE74E436C2BF0DB61B36C716142CBA608B6119C3E3E84E9E59346D26376A17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 6c33c870e6b86fa4c73ccb1558b5a0407d4213f58630dac7b86f4047711dd397
- MD5 b4880c8b9d9abb78cf0ae39789a5a3e0
- SHA1 ae9d5b9a8f745ca67331c61ac811cd1ed06709d9
- SHA512 ec15819e9085fbd1582688f13a84535218344dd9ad89ca38c2f1cf368fbc57bf1d08e7cc479ba442d0d5a26fba5e69f8c90dd049c3530286d7633b1ba9d654c1
- SSDEEP 196608:fUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHk8F:fUEtQevvqc2W1cpV2EI32k
- TLSH T1E2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 dbe2dbffed0f2946d76e79ac4aa6e40c8f7d393f226ee59cbc5a36632f51b12d
- MD5 130a3c3801cfbdd528509d2a09b2bb0b
- SHA1 13b4c0ba991fc362dfd1cd9c19c880754f17de24
- SHA512 6c2855b52966187f4fbef05a15514493f97cfa6691ba4b05757cc98934f99dd3f3648cb022f2b92ca99eb567c30fbf1b6e3acc4042f404a41a1f706192b3a376
- SSDEEP 49152:VCbRquA/m2yL5zQfFiV+XenmE3/zAN/j2U4FH:CoqtVjnmZj2jF
- TLSH T111D58D1976B8C2E4D1F6C37886A2C647F37178154B3197EF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 e23bd0068ba5ab72e33148365a4eeacb8719cc41aa621dc6c3a11f2ea9d68c07
- MD5 b3fd9899d3b5dccc1a7dc7ec45808f10
- SHA1 4f089954861d336f0190aacd5f3bf3b3ebe69139
- SHA512 36da9fbfeb60470ece496d3f7cbee1c24c12e6cf19004286e6b2dc5dcc5e3904457faece5255d3691d6b4144e2cafa1f040ec1eb91d254eb8f7901fef77ca64b
- SSDEEP 24576:BAhGLJIFoiwtA5l7S538dCN/j2GLl3iFSE33b9:BAMyFoiq53N/j2U4FH
- TLSH T18435AD80E7F955D4F5B3AAB899B68571EA72BCA95E31C20F1150D21F0E33E909D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.7MB
- SHA256 fe1e1fc91e9549e90f7eeb6095fa2fa9a98472344847a369c2cb4d6d02c4fcc5
- MD5 05b2fd80fc23464e16b460da546d52de
- SHA1 821a099349fa1d8f51b0900f0f04f1930e532ffa
- SHA512 3febaa0c18c551d74dd39da41a3234be3198d56198a6e6eade57c4e6bc1110cfce96807841a3bebef3c5bcccdba0a4eac7e1edf9b73b662edc73e7ed05165241
- SSDEEP 12288:vmw5HEjsChNVBFgl0WDm+CQJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:OwuoOWPdCN/j2GLl3iFSE33b9
- TLSH T15085F14577E41CF9E96782388697C536F7B2BC512A21CB0F03A0C69B5F37361AD2A720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.6MB
- SHA256 9e2b5d4d74077fd6a3a61dc2bb6d0a483cd6f72b549d6fea345aa9b812c34c22
- MD5 49557ffcb3ca915f6a7778ed4fa0eacb
- SHA1 9325ec7ea860889edbcd81f05d0dff2bbf317b38
- SHA512 db71ac7608fbdade59a9996a858a0772304083269ed152685882a4c3716bd9da030df0f6433c8f0af5bb3508e10a383968d198725b0a5cc9a1449cc913d14765
- SSDEEP 12288:rBZ1IyLJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:FZu6dCN/j2GLl3iFSE33b9
- TLSH T1E475125963E471F9E1A7823C8AF59A05D321B8A5A73243CF026047EA1F36FD59D36332
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 e21a531127ab69ed2ecb40366200e20a689971067d232325f4a6329e6791103e
- MD5 bda177dbf6f7fbbbfa1fdcbf5ab9ae44
- SHA1 ae31d868dff2ec067839252e8ea8f4290fdeefc5
- SHA512 0adf350b8b9a5c22a80384fbe180593448f6a73c398f9663444564e14d7983acb5dbefc7a25a3dcb6b9788172e01c10b9e8977f8313453d9c0384615b9c0d0d0
- SSDEEP 49152:Gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uf:VQRQyi36YOcPQLvw2gAf+PN3mj2jF
- TLSH T12D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 c44a3e4682827dab969f2756a1425d318039930ef3d364f380b709a396ec43ea
- MD5 ffabb6066c83352bdb6c19c5adf3097b
- SHA1 65a8d29ff262c264c5084058ff390d9ccd93c67f
- SHA512 ec59fa5778250fbef6e6f307fb5bf631935a1b373fdc5867717ebf2f70f70f01ada14f43f60a2ce89310307732cdcc072a14af1831b706bdffe08e870b11ffcc
- SSDEEP 49152:Oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uf:9QRQyi36YOcPQLvw2gAf+PN3mj2jF
- TLSH T1A2667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 8309321ecf2abfc6ae41c29df245baf0c0a3370fbad150a88c700d93d8289988
- MD5 3960dd739e38d2805e9a9f02c6057fb4
- SHA1 3d606bed2f2593b208051e8976699038425ef967
- SHA512 179d75432cae81ad01dc7efa74ce78746b16fc87249f062674e88cfa04c56b155b5906dc52602eb1d797bf0fd9e2d09d2408b7c602e3a6b4581286a15f8b3010
- SSDEEP 24576:LwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0KdCN/j2GLl3iFS+:j68Qg55nhheWu7PNU3/wN/j2U4FH
- TLSH T154B54933B2F200A9C44DE1769F4A872196D17C75CFE0E3DB8511725A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 cc62b333e904bd6c7dfbc902b39ee462bd5c481d96748c20f07c83f786fc2dcc
- MD5 fcbe0f4e80b6c169ceb7ed0761820e55
- SHA1 92cc84d49456ed5395e1c1046aec11d3d0fc4d7e
- SHA512 6bd82b907fe53fd2d38ccc1cc25749a292c6f577ed96e91c13f608fc682125c299a3ed7465f3746966c4500149bdc57516464ceac640cec7a914a173d6215355
- SSDEEP 49152:i3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99x:jy5112gYy5azzVvL69nLKnhZnj2jF
- TLSH T1E9168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 2fd22618fdcaba10e1d76f57bc18dbb165e9fb5185d1a3e8a90f10ea9b54ae43
- MD5 72d5335f8fdbd2b1e1f7001f9dd6b67d
- SHA1 2af9317719d57cbbe88d88cce8523769122dd387
- SHA512 f8677ca1d5e324fbbfe9da26c553b5e8729e41d3535f49b68642833605508c715c3ccda6ac3c0c6dd7a1c34a140af1a8396a1bc8e6d8332725f0adc442d2c64a
- SSDEEP 49152:OB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glGN/j2U4FH:cu6JmVxd2d+j2jF
- TLSH T151D59D13F1DA01E8D06ED178974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 7a698b715eb32d6df85b29c413efd4d9cb74dbdddddcf3cdf57ff6c8cbf3a737
- MD5 d7cff140a563c60b313d74013709c1f3
- SHA1 655f1c3d0acbe357e67cc21aa8a1f0a6f079ffc1
- SHA512 1ae577d47d5391efd61cf9f5655f7f0441e9be59b9c16994382c36d937e729fddd18b2cbf214e00e9ae9b4fc8bf62b58fc3736713339113379d2a5f6b17e9b2e
- SSDEEP 49152:S1hpsNoJpF1A6UU44CwH7R4xSN/j2U4FH:SmifPbRZj2jF
- TLSH T193B5BE13F2D901E8D06EC178875A9632EA62BC450B34A6DF0A90B7961F7BFE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 fb752ff1a41ac106f2a8f0c7021b7d754aa7345009030099b232979bd97e5501
- MD5 245ed47243fe5500c573e652b429b527
- SHA1 3da862ab2b5375d8b53b8e59874c0bd1aac38266
- SHA512 b407c1d24f0eab16f32508e78417ebda93c48c0878cdd7475b67f3f5d6652f6822ceac30e1b86175f7fcd41b96c515ed3ef7c6ec37b142e7f38e69c72a9bcb74
- SSDEEP 49152:fSuZQIY0Be2KRRVtOnks6NMHqdN/j2U4FH:l5dKTi61zj2jF
- TLSH T1B5C5BF13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 5fc27651acc8c05487812455044280525a362aa49f04fca9e21d35656d567fa1
- MD5 5f3068ef4813bb9f3fb5d1d767d1e459
- SHA1 b6d91906fe3b60dcdc84840ff5ee378556558d15
- SHA512 04606f3e8720711e828152275f31fb66af79d7719a29ed7e6944e3937323cd832211059ce8aa7de1f4a63aaba051d57bc444f2ffe71800cf6f96255ca3eeee38
- SSDEEP 49152:EhtSn8EApI0figngiDn0AP5w2N/j2U4FH:FX2iyph9j2jF
- TLSH T11295BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.5MB
- SHA256 66329c2d436486233d990904289d0631d1ad8fa2cea02534cc5c0238ae4f62b1
- MD5 5d98e45f64c1c1fa2bcdc449a06e7bdf
- SHA1 24c81785f066c184ee8c2db85374612faeba15b9
- SHA512 9edcabfb7d97819c259f131f51477f0f5973c74b8d0cbaf19c930a063f152fde48b044e911785a154a091083d0b93293e832c89d219904ce80d58b6509f0716f
- SSDEEP 12288:+SJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:+OdCN/j2GLl3iFSE33b9
- TLSH T177752364E9F6B669F15AC37943A9DF515100FEECF6264487868156EB237CFEC80330A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.5MB
- SHA256 e9605f2575baf59d8fe2d6bf16ac376547813652f3e494a4e8ca1a12e60b9c78
- MD5 94d0cd41d6861580f37c55b37dae545a
- SHA1 ba3598c175222820f89a55569d4061f8aaf968ee
- SHA512 a838859ee2b4225e38a8e8c5b60a4ad6c5285a4428587438e60cda14ae1b17a1cad729ad9117c462bbf26530efeac26b482ab66ad6d2bed044660b32266a9401
- SSDEEP 12288:UnJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:UndCN/j2GLl3iFSE33b9
- TLSH T1EE752364E9F6B669F15AC37943A9DF515100FEE8F6224487868156EB637CFEC80330B2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.5MB
- SHA256 26e00430e1b099dc2db2a9c8e7f2b57e5b8d87dcfe7ce73dc70eb5936467f19b
- MD5 91f72183d303f7062480fe83c84cd0a1
- SHA1 875c89ae2b28f42015a46c65800df30e8a4d8a80
- SHA512 23c8962c88dd508747297336132a197925e04edb48296d1523adafe9a0ce9a734a1d2e41bd4dd0b65e2f90dad2a56783f5a2a849fa1ba3d04185bc73ffc2d294
- SSDEEP 12288:4RJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:4ldCN/j2GLl3iFSE33b9
- TLSH T117752364E9F6B669F15AC37943A9DF515100FEE8F626448786C156EB237CFEC80330A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.5MB
- SHA256 7929508c543f5a3bccb1c54ef4a91314538c1294bd554e51417a75455f6c925e
- MD5 cf4f1ad78c8a2aaeefe73a7427d91eed
- SHA1 a5c0987aa2cb4658a12d65aac803ab941165b83f
- SHA512 58310ab5dd0c919aa898c50c6cad0b35773add4590453e280832d1cddcdf957dd1abdd75f7bb000dbe6476324cd34a3858e5a4e47d38585ca61e2960bdea3835
- SSDEEP 12288:JVUJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:odCN/j2GLl3iFSE33b9
- TLSH T193752360A7F561D5E46BC37C83B5DA21E220FDE8E73245CF87400AEB1B75BE89432562
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.5MB
- SHA256 0c364834014e7f7f99d81b823fc56672794c782868bace4b79e483c5a0162acc
- MD5 a0a8581bae32938012581a721749d6c7
- SHA1 a47e730296cd8dae70c0848ee951fcce479b08cf
- SHA512 cb9a6ffd6ee7981d6674c215cdc5518a5fc9e5622207d6c0b13b662c748bfdfebd3d677f6d9ffe4acb7929cd203d7c91c9ca3d8658296dde143f35a999b7e1e8
- SSDEEP 12288:N8JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:N0dCN/j2GLl3iFSE33b9
- TLSH T1BF752364E9F6B659F15AC37943A9DF615100FEE8F6264487868156EB237CFEC80330B2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.5MB
- SHA256 4882c598f8de0af815c0f5786a2b67ed4dcb0e633f99352c1b59ecee2888fe94
- MD5 78f27b4fa55f3e66ae61384829bc5349
- SHA1 7dae788581a6602ffa88258a49adab1ad023362e
- SHA512 18b5a6ed5665003f801545051174df275365d99af3a3a99762ae314fdefd5653eb6ee949ac8ee5385ab9d8a91288d0b109182e360f5342575848e909a79e50ab
- SSDEEP 12288:4zJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:4LdCN/j2GLl3iFSE33b9
- TLSH T1D2752364E9F6B669F11AC37943A9DF515100FEECF6264487868156EB637CFEC80320B2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.5MB
- SHA256 f50ba1171818952a48788b265bdff2cad18b42ef3abc35dbb206b1c1f694ac4f
- MD5 ae193c4e72d5e6c0dd034773bbb7c90f
- SHA1 adadcf43bd4f928802c0b7b6b4b7dfedab59d2ca
- SHA512 f76d30028004def99c279a65b4d549a9ccb32785dd6efeefa65c2882c61d58c1ad2ba736a8b20512662be933ef309e07a0b498d91c59f01926a322c564ed272a
- SSDEEP 12288:OPJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:OfdCN/j2GLl3iFSE33b9
- TLSH T1B9752364E9E6B665F11AC37943A8DF615100FEECF6264487868156EB237CFEC90320B2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.8MB
- SHA256 49726f61df88799081d89c25b176fe5d1837296ae96485c6091b6da9b48c8597
- MD5 3592bb0b5679c7fed54ac451273433e9
- SHA1 82bac08f65a8c9f41558f112235c51a8065976ec
- SHA512 6da48101f4bf43d8df26df0819492ba56c3e207b90e222ddad521425929216de86df33d692aef9562f6680e63450fe0c3760c35d37d5d535ffbc2e3b228328c1
- SSDEEP 12288:giZwb6zzFEoS2cPvyHJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:jZMSzFVSOHdCN/j2GLl3iFSE33b9
- TLSH T12F8502A4B3A018F8EC67823EC9658916D271BC594770C64F03E4366B5F377A05C3EBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.5MB
- SHA256 9da39d70dda89c1f8720156e1539dde58838ebd3cca9882bc59dad9aab8f855e
- MD5 1d4b6024a6473e877aa9e14219624742
- SHA1 47775e315b1c96f1f30968b09a717ef1ee65324c
- SHA512 15ba14cfbd8e9ba77efdbafce59cccfa6d537cc6e75bd0a6f98417b61b8b8e27935861615bc99474de1887e036a8920e665e0c69b7ab8e8e9ad4f40300345dc7
- SSDEEP 12288:DGJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:DqdCN/j2GLl3iFSE33b9
- TLSH T11B752364E9F5B669F15AC37D43A9DF615100FEECF6224487868556EB237CFEC80320A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.5MB
- SHA256 dce355f477eff31a2238b0f6453020543cadffddb81275bd3539e41a547622e9
- MD5 ba80ce49bcf0628bd820ba32f010feb5
- SHA1 463da293f71dcc54488d510f30dc40c0b362842f
- SHA512 a0f585f8dd6298e2cf348cd355d56e18b8975b8e076b8e4f36f42950f8d063fbac9da05a40c65e58c1d9c036a1adc1c2812a4f32a65dd21fc393eb46f22ed046
- SSDEEP 12288:dqJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:dWdCN/j2GLl3iFSE33b9
- TLSH T141752364E9F5B669F11AC37943A9DF515100FEECF6224487868556EB637CFEC80320B2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.7MB
- SHA256 e2e2343fac07a05bfecfa7d813f85ce226a3b4331543bb09f0eab21a31b39aea
- MD5 f38f09297428b2118f3944d92927e834
- SHA1 32168814c4b3cc3ea564a9052b23b52494e52543
- SHA512 cf40e955133d24cf98dd4ff148637ad5c924685468ac639a0ddbf220214b0bedbcbad1ad941a510046383d1a20d0860746fc65eee35c24745297f0821424ff5a
- SSDEEP 12288:ryPz5L8LJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:GzyTdCN/j2GLl3iFSE33b9
- TLSH T194850257B3A130F9D167823889A55A11F331B87597208A9F43A007BB2F377E49D3AB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.5MB
- SHA256 c3dbed7555dbdfb051cb209399f05ada9a3eb0567328ab4fbb47d113847b1992
- MD5 525bbf9d84a355e4cc80d123eb3d8193
- SHA1 8dadbb4f88dc8e55a378082e692be7491d0c14f3
- SHA512 84be1254d296e377c54e6b73e177bead4bb12a9a3ca6b5e6315662686eb0ca89a16fdb93f540a414964ad5ed8d805e9756eedd8e45d069c0907963e745250f02
- SSDEEP 12288:hGJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:hqdCN/j2GLl3iFSE33b9
- TLSH T161752364E9E5B669F15AC37D43A9DF615100FEECF6224487868156EB637CFEC80330A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.5MB
- SHA256 c312cad4455fe7a78dcea404779f35d6d31c0d87d75ab5c28262d17e6d81d93f
- MD5 f17e4f776e53fcd6060152a56c2d32ce
- SHA1 21a11519d4ee01b4de5f2d3a9d2fbb6fdbe96525
- SHA512 92a961ca4c886ba6c32e8a4ff1ad982335d805fcf87087e5980bedbdd7f46dd92d147493271e95e26fdcfc14e46d0019d2a70a24eb2c07b02c28fb0766ea0509
- SSDEEP 12288:kGJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:kqdCN/j2GLl3iFSE33b9
- TLSH T193752364E9E5B669F15AC37D43A9DF615100FEECF6224487868156EB637CFEC80320B2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.7MB
- SHA256 dbd281b7142df1e1f14f75eeee6f8110921d13baf283e40d2740d438a46211b5
- MD5 92e2127ee12bec94111d2aa7449374e9
- SHA1 9878a11d943063b39ddeca533992b5efe7d1756e
- SHA512 e9b393cc9f9623e6d1ecdfcf9afd3dd5c5f5d98c442dadfb4cf3f02d94551543fee50224cf73a07c0deb09e2dca277e3cbda4a38a5f9c7b0b4017d989b4a406b
- SSDEEP 12288:xyPz5L8LJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:gzyTdCN/j2GLl3iFSE33b9
- TLSH T1FD850217B3A130F9D177823889A55A11F331B87597208A9F43A007BB2F377E49D3AB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 1.8MB
- SHA256 0e50f41b2530ff1764b512cb219e2e9f47c8b0f022e738b10fb7e69f0efcd1d1
- MD5 a348a55eee39defcb4d826027c6b1473
- SHA1 47210301c75e6ee457306797af4f9c182b7a7e23
- SHA512 8351b7bb7860b817e568450e2da10f01d7676434674124d441cc60430dafe945b376ad1d6bd9769ae037756052cdf0a37e06954589d157aef5768c14fb899b99
- SSDEEP 12288:DCd9eWYoaLHF3z0z04PDvhBJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:uTHaLl3z0zD1dCN/j2GLl3iFSE33b9
- TLSH T17E8502A4B39018F8EC67823EC9658916D271BC694770C64F03E4366B5F377A05C3EBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 2.0MB
- SHA256 11daf48dd15f5981b0923b823faf668a5ad65acc88db8a6fcda3186f870d0a28
- MD5 0354968808968982feecc4a107a3e0a3
- SHA1 2d5d364571f484a240d9a5a84dd1997f8321e89c
- SHA512 7bc29933fb9146af0830d5d9b21e7203f9fb3ff7d80fbc99a6601ba1bfe665791096c4d53afcd027d085994aab614860f7dd94554964ddec87b81d12045828ba
- SSDEEP 12288:Vi4e7+RdTfgwCHKy7GLbbdIv4JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:V37d9CHKy7GZJdCN/j2GLl3iFSE33b9
- TLSH T1B295CF90F3E414E8F0B7CA3589769511DA767CA95B31CA8F03A4265A1F33BD18D39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 1.5MB
- SHA256 a367ff92595062cb2d143001c1a45b9dfb35f8c2504e13b7e9f7cbac166ee995
- MD5 e048a909b24fb759cbcae0f14e4d22ae
- SHA1 1347de9635afbdd8f87e4b7f9752e1bdf918fe46
- SHA512 bd34f738c3bb7cdf035d29df1b5e867a42a09be4a852d84fd1a94d0cde8682b5d02f1ff71c98f976cc9c4bfb910aac22ae2195eca75534243ebf8c3e20063073
- SSDEEP 12288:YxJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:YFdCN/j2GLl3iFSE33b9
- TLSH T1A9752364E9F6B669F15AC37943A9DF515100FEE8F6264487868156EB237CFEC80330B2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 1.5MB
- SHA256 66aaaea3e728acc3186ab67d49d780a17991340f248bf4859dc59ec33c538cdd
- MD5 81345660015c7628228d222df014f1ff
- SHA1 91bec68ebe40f580ce4abc367905b5fc25966bbe
- SHA512 b8775b21309e75596f5291f9ea528db5176c8e276c87f226c55e3122ba0a5fa87333006a5afee133a36d5e56ef3dd2db455613aa0ae2f99eb6cbdc9b95cfff86
- SSDEEP 12288:nrJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:nzdCN/j2GLl3iFSE33b9
- TLSH T120752364E9F5B669F15EC3B943A9DF515200FEE8F6264487868156EB237CFEC8032072
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 1.5MB
- SHA256 98935930505f6986646d29db43f2160c652244963111883686c2d52457878f2d
- MD5 afbd3658fade9b3c22bde424a6397365
- SHA1 e8347a0488908115caee38fb1927b70e6de8bc10
- SHA512 16ceced4c5b0fce188e0cfc1328b8ef6ef026b758b7289b99285a8417b4e431741a46d752e8775534e81d5ab26b98eacb8822b43b3d80e44f5c0ac141052c20f
- SSDEEP 12288:T4JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:T4dCN/j2GLl3iFSE33b9
- TLSH T145752364E9F5B669F15AC37943A9DF615100FEECF6224487868156EB637CFEC80320A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 1.5MB
- SHA256 25745f83e18d68f75f3300c9962f5bba1038d8266cf5e8a76dca8be8a4b55bee
- MD5 f9e45431386d79d118853ddd2e8dee83
- SHA1 84df625b794f8f0bd3dbeb6d3e3212b602eeba7b
- SHA512 c600092aa963648307ebc2b21c1e2f03c548b6996db0194cae795a5ed4ef17f973e07c85811a4fb02170d73bd6e24b34501ef0154badc075ffa063738fe8a75d
- SSDEEP 12288:zGJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:zqdCN/j2GLl3iFSE33b9
- TLSH T153752364E9E6B669F15AC37D43A9DF515100FEECF6224487868556EB237CFEC80330A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 1.5MB
- SHA256 0b42d8bd0d5e55707d5aed74127a9e867e78355a77236d356ed866792104afa9
- MD5 a61af4ee2ae148a9b153d36f15281b12
- SHA1 9cac08f3f5475024adf50cfeaf3eab6e9bacb12a
- SHA512 320e7e5581e69f3585e0f74341d5abe0f16646d5992560ba1104e1bc47930fb1dd657846a7c7e0f68f24ed9ca4446be1c4d863abbd05212ec9d585b427ee45bb
- SSDEEP 12288:jxJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:jFdCN/j2GLl3iFSE33b9
- TLSH T12D752364E9F6B669F15AC37943A9DF515100FEE8F626448786C156EB237CFEC80330A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 2.0MB
- SHA256 0233b4f8d379260e4b06cf7d71cc86564470d165df57f8da09eb10d7510259cf
- MD5 7beae2d1ec49bfa6cd48f9a9fd73c589
- SHA1 4b81c1b4df32279e87446020fb7c9ee66fdca696
- SHA512 cbbb9e8cbf0bd80c38a1cc5135bb5ca490dffe3bb6dd047c7ccec459e735090ac2db8270b9605be081e970f5ab5c30a358f03f71fb5bdfd62f1bcd3183adbcba
- SSDEEP 24576:Mfwvok9RX6wkyAIGdCN/j2GLl3iFSE33b9:sMnYIJN/j2U4FH
- TLSH T1E4A5D029EBDC44E5E177923C89B7460AF2B178685B31C6CF029A53AE0E37ED45D39720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 29cf96241293f4c1489170f1e38999e45c8844e858ad23aeb08aac0c26749842
- MD5 a80cd78b7a4106823ea34b4c26a10803
- SHA1 4bad4e23cf12c30001c75ea45596bd05f5dac81b
- SHA512 43032863716e6ddc610894fd5e931a3459899f503c4a2e14bbcfe22ac79b029309659c11d8ab50fa5bcf9578a4930015104e3804135b85abaeff165069341599
- SSDEEP 49152:hYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0WN/j2U4FH:JySzPGj2jF
- TLSH T107067C96A1A801D5C1B9C1B98B1BCC1BFB7134490335ABEB03E556935F6BAF09E3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 ee8f29802381e3d2d68e49d3da0fa367a0df5f4adf49be1947407119402d1673
- MD5 20f3b31b73da2ab184e3ef3d5126d847
- SHA1 ba6c2cc774405b72ef958902c9840f8fcce488d7
- SHA512 5f39517a26caed6a5847f1cb2d303418d9cc3168dfa96f70ac6f13b41a3aff6a776a6fdc5b25aaddeb9b7adb743ce7746ace827371660a38730acfd51550a1f3
- SSDEEP 24576:i47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY3dCN/j2GLl3iFSE33b9:i47JUQj1irIhCnDHUPfF/GN/j2U4FH
- TLSH T19965AE1DA3EC01E5E1BA827885158A5AEA71782D5F31CACF1270437D6F23ED49F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.6MB
- SHA256 3a636fc6a7205ff02eaebbdfa7caa9596b314ee40453069aeaefeefa1898dbac
- MD5 adaa78b73827808337af0a0d11ee58ba
- SHA1 1fd6608079eb2c614b60bedfda99c13e1e811efd
- SHA512 13f2a15eaec4f383ec1582be7f1a26ae23db6ea8a9d0469355e2ad12a954e3733d5a5601a7eaead39cac5fbff7b1e7fc3bc7e40f06bd6f00eab60d51f9e6d039
- SSDEEP 12288:lNsf2JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:66dCN/j2GLl3iFSE33b9
- TLSH T10E850119D2A412E8D06E9279C7558A41B3237CA493E1C3CB43C0F5BE1F7AAD49DFA613
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.1MB
- SHA256 f5a3ef009f672247dbba17556e0e8a76cffed2a80ec24d907dc33bb4e8b7326a
- MD5 4905655a236af323aa014db310bb90f5
- SHA1 78104af97e325abefa9ba5e99420c5abb081a2db
- SHA512 c5d93e3a8ecf4792e4191e43c2aecd5de21afc8b779333f336ff063c86a2640d70dd142cbb2078c5f704f4b322cc51550c0f84764523f83ea5cb85f8fa8e9b9e
- SSDEEP 12288:9L+KQiWU3fEz88/igU/L9cOQOWBv5/IS6YemuioJK:9L+KUUPeRqNuOQTv5/IIem5oU
- TLSH T18B4506007626DA8FC6A940325E36D6CCA7707D41EE046F1773C9873FD47665ABAF2282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.2MB
- SHA256 3872635619ec864afcbdec41c7db46c5d39a2c20dd9d9c9a5e7da400c75df03f
- MD5 27b2678da17988d07e9444a50931ba44
- SHA1 917be8187768950815ea7ee19aca54bb06f60ec8
- SHA512 0a7d2e7b3e097893ad9655bb88dc8a49cf2d55a772849c948ec51bdd41b55df9bd5aba0517ba1a937dc2c87e353a924a362ddc8b5632ef33ff8c556667afa406
- SSDEEP 12288:ZTSEqRHPGTBAIf4p9SxQgOFed2YUVQjPdeVf17JGRDNHJTKWD:ZTSLudzQ3LYUVQjM8JHJuWD
- TLSH T16E450700A5A7EB4FC96E9037063286CD7BB86C03F7452B057345893D946BA6FB5E22D2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\SystemLog.txt
- Size 427B
- SHA256 b237f0becd4c5b503ee8244cbf2aeb0aa72292017d013ac1d2da344dbf39ff44
- MD5 b001ff50ef82aa43e1f391f8bfb55b79
- SHA1 4fd47b712b80eaa59b3ffcd409eeff4a3b20e882
- SHA512 62484b12d5bac2fd7237c8bbb5b10d096f7edaa11b7b211ef59afbd1a96ed716b85e71f0d6efce51b5502c96c47c875a4e3fa2deccf3d8aa08bfae094928a331
- TLSH T1CAE030916A3E19E653C32449FA1D2B8E60A5339C9954DE1E77A5800062D18CE291AFB5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\SystemLog.txt
- Size 2KB
- SHA256 ec0c17e5be08da0f5bcb03b3664d4a7065b4afe7115ee742680962d802dfc7c0
- MD5 2aa1fc88ead2cd04499a6e180fac718e
- SHA1 56d3596c7b5e27f6fbebecb45347b3f70bad3eda
- SHA512 cc7f8406fc2c5ee8a9d8ebd9ea9ffcb04dbbda1c0e1fc9581cf646656662a1a34d1748080724cfa25616a42f7efe0d64dfba455e37a7da868b460734f84ec18c
- TLSH T160418B42A63D8AE39397241EF95E2F8F25A47389F540DF0DA7E5400076C2E8D59397F1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk
- Size 1KB
- SHA256 8273086403a6481d74a20a7875ad5a7f73d21819814f9094aeac4d0a4da4b3f0
- MD5 0e82db25419c0c4e71959383b28add2e
- SHA1 91c897453ccc5fc85df405f64dadc92417c2ab75
- SHA512 c795da1fb9e739c4cde159b2aa0b0ed86db2a0a5b1e8a3b32b84ca9330d37d8f488ecaf6c4cd4e292cb425f1669ed7aac66efa11865ea9dc170d94f858dafa97
- TLSH T1F921D20D1ADA1B26D17AD63AA8F76356B970B8C1F2525F0C11A0134C0452BC1BE0DE5E
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.5MB
- SHA256 1b2db44d5499f7fab75b196f7c12961dccb25bdbe084ced766f97277227dff8a
- MD5 8a69f26407bc0edccdf1b661e07682d1
- SHA1 6e272593cd6632bc27414142e27fd9ec6d71e3fa
- SHA512 5010fa6159545d449ccc1abb7e700d8669c228b6c166e90d35007f74baefd20f3809395fb0b9bf0a3d4eb9b33f0141488228c88f85184a2f0ab2c0413d000511
- SSDEEP 12288:QM7eJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHn:RSdCN/j2GLl3iFSE33b9y
- TLSH T18B752360D7E9BA55F47A837803ADDA216200FEF8DB1184C7C54167EB6279FD8C832563
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 391f72139dc9760a28fad996c85cfc7af0d982314f48a844b448c1ff224aff07
- MD5 58b096cd8e6c826716a0f95e60d2d65d
- SHA1 9702aa0e4da3851ad8bb975c2dff59a25ae8bf55
- SHA512 9791b6a007ed1920c81e62758c996b07ec67a934eb784c999cdf1a36ee0203ab5d38fe523710d7eef36b88e279f799c174fbcfedd13dc97638a3a57e010b0cb0
- SSDEEP 24576:xgb6bmBIi49WNNFpg1rSvFv7bYAdCN/j2GLl3iFSE33b9:xgb4mBIBhGFkN/j2U4FH
- TLSH T13F65AE1E22EC02F5E0FAD2B88DAA4417D6B278165731D2CF1151427D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 2.0MB
- SHA256 f3abcb686d0989eadaabc403c3dd99abe583dcd8cd3d9853b5164e9e8de661aa
- MD5 e1a4b5bc1e378851e70d51ba4eebd651
- SHA1 bdb965e8b8f5bb55a1b580940f4226301579067f
- SHA512 c016c4862fd7c6ef0796bafbc94753609acbaa2c1d9d110d15e11c3dedb32db95b487861c4127f4f87d9b964fe61c44f80e212f8803cb66fca76d6594ebda72a
- SSDEEP 24576:UG88u8FpJqH1bzria7/mHdCN/j2GLl3iFSE33b9:n7ZFPqVea7/DN/j2U4FH
- TLSH T120A5F16576E101F0D47BD1388A864663F671B8251364EBDF07A88B961F23BE44B3FB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.7MB
- SHA256 5b601074fb724d81b793bed664e408d1ebfaef071dbc4d64c8b811334130a4cd
- MD5 9a45d99156b65c5d89798471c6c067e4
- SHA1 1cf64cda6eb97df89c61022b1fb3c301ccf5b22c
- SHA512 2f454a24748136ebd5cd94d87dee8f73a9e7c09c31e3e1845d8699d794d7aa9a2e010d5367b293531e2a5e52de07035cb4eb1e3f446d0e57925aa1a3b84f41e9
- SSDEEP 12288:eHvUrBFrEjwaQDJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:ePUr+NQ7dCN/j2GLl3iFSE33b9
- TLSH T19885F22E62E918E5E67AD17D86868719F731B8615312D2CF02D0817E4F77EE8BC39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 e4f5ac104db62f11b0eb7d13320997bb9c33fc8220da9af660cdf0687bd00166
- MD5 99ce6af4f8fe94d5dc73e656a945d57f
- SHA1 073000cd0c0c4b8d51824c930422237e79070b4b
- SHA512 ef033a4bfb1bf779a45f786968586bc20df843ff0a7654ac944d439808aeb585ec01c183c0c2d8c6f5c4b777eecc76d29c9fa8e3734d083f77d367af6dcf3d6f
- SSDEEP 49152:DBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjoN/j2U4FH:sG05lO43bvj2jF
- TLSH T1F5D5CF6A62EC11F9D1BBC17CDAC64A0BEBB23815033556CF02A486A91F27FF4957E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 51745585dcf232ddc6c367fe2617839e1f94ad98494536c4c1f96103ca51875b
- MD5 a93713e056fd493a158f23f3f76bce31
- SHA1 5bd2a87f8b7e877b8042b3ffc940842d6418d6df
- SHA512 2976ec7555e1d4fb82e40e86f366de6e9aa0d097a619a92124acddda4ee24772320c0eee6f800e9154a630c81e73319b3e12a35a199d279d5d9d3e39a2a4bd96
- SSDEEP 24576:Ufa5POZ3dpFWVM50JicR2hG0lasx2+47eidnBdCN/j2GLl3iFSE33b9:Ma5POZ3+Jt2pasx2+mwN/j2U4FH
- TLSH T1E165BF5DA6FC01D5D1B9D17DC5838A1AF5B1342553329BCB022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 5d8974dddb63c9120496e629f9378366782f971eb1e48531615b70285445859d
- MD5 52fc8a4db826e2de1fba515705da3dd5
- SHA1 7687a22faa5665cc8fd7e625f84113e521daa78d
- SHA512 3942a25b3e4a1b41efa3904f5660d1d2893ac90b80c0c4bcde5f41f031489bda99e2ac2d2e61c84706dab471b6ef2455efd4fa02372dbf42c1a274c0d8fd8286
- SSDEEP 24576:RNcwHdjbyQ4nLC18lb/EOjowL7FkvdCN/j2GLl3iFSE33b9:RNc/zEOVHFjN/j2U4FH
- TLSH T15D857B2623E901E4F1BBE1BE89779546FA71786553308ACF0291851B1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 5655a668520508537dc8c097d0c7ef2a989013a1d8cd64226fe7cadec375ed45
- MD5 2de7ab12546c0753a23526df89f61245
- SHA1 27e92ce7c3a8a9240b9278c8ee4e41b3920eb313
- SHA512 b95d5fc0754eaf8f5dd677757afa07ea86d382f5c77369df08fb0a5846342ae5885a8fe2286343062e60d93232c751499f64f4d2c79b6eb74d9b09cd33ae231b
- SSDEEP 24576:w8kNvNnaFeYhJNtmZBmNdCN/j2GLl3iFSE33b9:w8MwBtOmiN/j2U4FH
- TLSH T17D55AF6EBAF846E4D1FEC6B58E238512E6727461173293CB4290C13F0E679D89D36F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.9MB
- SHA256 1fa771fd4c23b162765a00158ac2b1617cbb981566fcbbf7e4c347d18c1113be
- MD5 646b089c5d61d78d955f0e7e3d2cf5dd
- SHA1 9d57cde3adde4039abde625512d357f70ecf5d05
- SHA512 3b0aef9c26fb3f7eecdcddaa8d5cd9349eda8dd5f1248eff6d63b5db2b35b1042d5b0d59256592c482f36d7f74a34d93cc34e457728b0de8cbfac72ec2a4fcda
- SSDEEP 24576:kD3FHshBIYQgAudCN/j2GLl3iFSE33b9:kDVHeBIAAxN/j2U4FH
- TLSH T16495E17DE69C04E4E57BC2BCC6638A06E77178A8433255CB02D481BA1F6BEE46D39F50
- MD5 SHA1 SHA512 SSDEEP TLSH