ad466519abd0eef2ce950575196280712f108ce80d43613485ce2fcc222fc9a2

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 09:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
Size 1.4MB
Sample261011-lljtmsfe48
SHA256 ad466519abd0eef2ce950575196280712f108ce80d43613485ce2fcc222fc9a2
MD5 843a25cc58ce96451c019e4c06cf1aac
SHA1 2948a1b13bd2ffdde6476d777d389011369c9690
SHA512 db1c94c771f32c5e07a45dcf66ac3e418bd2912d1a3a085a9192243ce4e05af31cc1d0bc7176d3814f78057f03ba955693e7794be181fccdf6f6d1652efc8009
SSDEEP 24576:5PlShv/NkaR4orsbLAaayTli1/zFfTdA9fXBPSe9ERPWxNs298r3OCDIjG3gE9o:uhv1kASkaA/zZT4RwR+ft983Dl3gEe8H
TLSH
T13665232634D8D833E97B90340D10CAF24939ED2D5EA03CEBB7A16B6DDD351D28A2153B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery macro spyware stealer upx

Malware Config

Signatures

Suspicious Office macro 2 IoCs

Office document equipped with macros.

macro

resource
behavioral2/files/0x000d00000001c5ed-394.dat
behavioral2/files/0x000e00000001c2c3-395.dat

Executes dropped EXE 10 IoCs

pid	Process
5028	elevation_service.exe
4328	elevation_service.exe
4376	maintenanceservice.exe
2276	OSE.EXE
3764	perfhost.exe
3788	ReFsDedupSvc.exe
4820	SensorDataService.exe
4852	ssh-agent.exe
4704	AgentService.exe
5812	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe

Drops file in System32 directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\fa58ff0567fac3b7.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1204-0-0x0000000000400000-0x0000000000570000-memory.dmp	upx
behavioral2/memory/1204-68-0x0000000000400000-0x0000000000570000-memory.dmp	upx
behavioral2/files/0x00010000000093c8-374.dat	upx
behavioral2/files/0x000100000000932b-373.dat	upx
behavioral2/files/0x000100000000994b-375.dat	upx
behavioral2/files/0x000100000000b970-379.dat	upx
behavioral2/files/0x000100000000a2bb-388.dat	upx
behavioral2/files/0x0001000000006279-393.dat	upx
behavioral2/files/0x000100000000bd49-392.dat	upx
behavioral2/files/0x0001000000006222-391.dat	upx
behavioral2/files/0x000100000000a313-390.dat	upx
behavioral2/files/0x000100000000a2fe-389.dat	upx
behavioral2/files/0x000100000000936e-387.dat	upx
behavioral2/files/0x000100000000a1ce-386.dat	upx
behavioral2/files/0x000100000000a0c8-385.dat	upx
behavioral2/files/0x000100000000ba39-384.dat	upx
behavioral2/files/0x0001000000006214-382.dat	upx
behavioral2/files/0x0001000000009b8c-381.dat	upx
behavioral2/files/0x0001000000009cf8-378.dat	upx
behavioral2/files/0x0001000000009cd0-377.dat	upx
behavioral2/files/0x000100000001b94f-376.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107328\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107328\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107328\javaw.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107328\java.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004591d9a66459dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000b5aa716e6459dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007717eba66459dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000025fb536c6459dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001bbce0a66459dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d816bf706459dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 59 IoCs

pid	Process
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
5028	elevation_service.exe
5028	elevation_service.exe
5028	elevation_service.exe
5028	elevation_service.exe
5028	elevation_service.exe
5028	elevation_service.exe
5028	elevation_service.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeAssignPrimaryTokenPrivilege	4704	AgentService.exe
Token: 33	5812	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5812	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5812	SearchIndexer.exe
Token: SeBackupPrivilege	3788	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3788	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3788	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3788	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3788	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3788	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3788	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3788	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3788	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3788	ReFsDedupSvc.exe
Token: SeDebugPrivilege	1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	5028	elevation_service.exe
Token: SeDebugPrivilege	1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	1204	2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5812 wrote to memory of 4792	5812	SearchIndexer.exe	100
PID 5812 wrote to memory of 988	5812	SearchIndexer.exe	101
PID 5812 wrote to memory of 4716	5812	SearchIndexer.exe	102
PID 5812 wrote to memory of 436	5812	SearchIndexer.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-10_843a25cc58ce96451c019e4c06cf1aac_amadey_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1204

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5028

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4328

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4376

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2276

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3764

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3788

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4820

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4852

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4704

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5812
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4792
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:988
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4716
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 2928 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1871b63f642960ac33c4c93f2f686fe3520c35396e2e55f8bc151d95d41771df
MD5 9e334af0beeddabf5f7047990500cbf8
SHA1 ef959617e7be84cecfa2907ce510384460fb3cbb
SHA512 8cafc8d8dee6bb35f761bd267f69a362c15b879f62a5e92bfac3d45b8f50cd190bed23e39148120206e7fae95028ba670f185c79145ffdbfad44cfd1efebc728
SSDEEP 49152:sb+632BuPkFKRrdE6ohrstBhuXjfS4LWxniR+ft983Dl3gEe8xA+:W3q60jBlR+l9EDl3VxA+
TLSH
T1DBD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 822a804f6cb1db8679ef694c013e038275f6b693fdd79e4199553f65b930837d
MD5 ae7bd2fdd4e706e82efe8b34bcd55c39
SHA1 6aaa405984fbc94638ec00c9ffe10b469aef7f7b
SHA512 bd82242ad60b520e7bc59ef1157255616d07e14f3660ada87732209ede934421271c8682a82ee7d7382e8ea1f6931507332372cb1d157a5a7a020a8bdfa86128
SSDEEP 49152:rxcAR+ft983Dl3gEe8xA+53HJK8ourG/2fv/P7H:rhR+l9EDl3VxA+9c8trm2fv/Pb
TLSH
T1897512387BD409F6ED3782B9C9919411E672BC4547A4F78B03A0C9755F233886E3BB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 48be14c479437c0b48437911bf2cef5be2fc61290bdf5cab2d73a128d6ecebf2
MD5 76ac086a170abf65bb4cc0b9447fb82e
SHA1 5e799f740e36f1274b0e641502f004d251164d1f
SHA512 c677539c165c567eac1b984c2efe5af8536c5240bb3432acf636006abf108fdd1d86c760ee9db2f930009b792dcbd2085b92e119e481d6022f862c67b2d3da33
SSDEEP 24576:yXYfDtczAJRPWxNs298r3OCDIjG3gE9ow+8xA+:ZtcAR+ft983Dl3gEe8xA+
TLSH
T1CB05F12877D808F5ED6B827CC9A28512E6337C4547A0E7DB03A089665F333D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 a4d74cff15fcef42e34a22fe050a848d300796c7870e5f0e87e0fc7760b82fc0
MD5 8001603b88a66c42b8531aee70937025
SHA1 0c9f9d7b73f569647bd97982c9b4e305b2fb1e23
SHA512 cc9b3d73c1df0221a00db5f0446e2a3e1fb6995e66e9931c8ebf8140e98a6e049d728d39219bff859e289d0c7a215297c7ce3d3f9eb0fb3d5d2f09d772e74a05
SSDEEP 24576:SwuXOWnRPWxNs298r3OCDIjG3gE9ow+8xA+:SwsO4R+ft983Dl3gEe8xA+
TLSH
T1CF05F14536981CF5E96B82788687D132F7B3BC022A75DB2F4760C65B6F37321AD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 59414f25178108d66b2bb6caf1ade232bd3855a04af6fb4d1df434c7e5736454
MD5 5531562b6c70c37fe914ae5bc74ecb23
SHA1 3b153f71fd68b8976a6f5019023762529e71aa29
SHA512 ce18ec9d4c752e8c8dd20e7ef2cb9409d01ba48926a644fac9889bedb61043333bcbb9431feadde6364ea1345c359acc2321d8fc572f7cc30c1f38a17f078221
SSDEEP 49152:lB+taZ3usBWOBr4tEG20bqx0z+n217aau1glZR+ft983Dl3gEe8xA+:Lu6JmUxd2dZR+l9EDl3VxA+
TLSH
T196D59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 575b1c86d6db2bf367e095deaebc466205de7aff806569f6c2f4791acf09934d
MD5 67d82313e0461daa9d9b48f055083584
SHA1 11bfd9ab40d3d22e5e0db7caec9d2155def2ee13
SHA512 5034022e031ad65438daed2190d5ade8e97f8dccd610472e26618bb1114208eaa4465bf0824b104ceb6430257f1d9cfbffe19d7de622eaf92be6ecea7d6ea573
SSDEEP 49152:VMnYIWR+ft983Dl3gEe8xA+7ASkaA/zZT4R:e4R+l9EDl3VxA+n1A/2
TLSH
T19985F12AEADC44A2E17BD13C8DA34646F2B1B85D1B71D2CF02A6536D0E37ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 cd45bf9701601dc51c3b884985fcd641dec7a7674c32ad959fb969db7069061e
MD5 4fbf4af845f348e0364472fe70d645c9
SHA1 9a3080ebd6058decf0e33951a17ce92e1266b6ee
SHA512 64d26a9e97b8de09c9f562dedeb2fa2444f050b2c0ae23341f92fd4580427b5d175549de7971ef6c4c0895c14c8d6a31ad9c5931cb32850f4576fba8bd5e5247
SSDEEP 49152:1MnYIWR+ft983Dl3gEe8xA+eASkaA/zZT4R:+4R+l9EDl3VxA+U1A/2
TLSH
T11085F12AEADC44A2E17BD13C8DA34646F2B1B85D1B71D2CF02A6536D0E37ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 5cd5132e2df74e8dcd17113f3e6ae3ce1faa6aae729d60acf01d4af3053dc5b8
MD5 f79c5eabcfdee0673942fd81577614d8
SHA1 fd8933b2cbdd47014e2cb650eccb67033dd4f220
SHA512 a2e3bf33c18b6db2a00a714fcd1df6b3ef21420da0cd0f1ddbaedab29c7011c35002277588d3b322aebf50ce3d9c27e88b4661ece2e83aea940fb5b6abf1cdbc
SSDEEP 49152:jYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0pR+ft983Dl3gI:9ySzPRR+l9EDl3VxA+
TLSH
T1A8066C56A1A801D5C1BDC1B98F1BCC1BFA7134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 4.3MB
SHA256 d575664ad11e86076a13cffb511a27c3381ccd6033a958880b27e6fe228752a7
MD5 2cb5c44612a2bb23a9b8f1c9e0b7139f
SHA1 99b388d79718666ce4b33066d887bf524b05335b
SHA512 2e9b90b8c992002febea617ab78b9d938c259fc0fdc4c13cce9a7914dd0d799b0a098d58e39d17bb509d46ad5d8c8345b184cac0f940d66ef90e1d2db929a943
SSDEEP 49152:jYvKNpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0pR+ft983Dl3g3:VySzPRR+l9EDl3VxA+a1A/2
TLSH
T14B268D56A1A841D5C1BDC1B98F0BCC17FAB134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 7ad5e9fe838b2f56f19e0de3b36a9a97b303c5a0bac3128985b1e0303caf539f
MD5 4ddc7a3592d5454d13accb3ef2b14243
SHA1 40782493b4a4f8f0fd91d24871eb6ad4fe67b59c
SHA512 e6c4aff5a928e7aae996cbbf75a0ec774f1503072e1b2962234154fc1046c85cb41fd3196f8dcc803db436579f317bf10a8ea15093a5135afd0e4a44d054bc14
SSDEEP 24576:p47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYPRPWxNs298r3OCDIjG3gE9ow+8xA+L:p47JUQj4irIhCnDHUPfF/ZR+ft983DlF
TLSH
T1E565AE1DA3EC01D5E1BA927885158A5AEA71782E1F31CACF1270837D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 0d4f66b9b7413378de32528edbf59bfbcc317bac24d4592c1a9245d22aa7a735
MD5 cf181abba51866dfcd86a254aea91906
SHA1 e340706ab2cf96da252e125c93bddb3cd1d54a70
SHA512 1037b0f609687c74207d797703f839403fc6ca54cf30f2fa9ea784061355fef85809c0f81564ba3e9ab4d843b9715c5f3f0b6569173797e3954cfbd16065f42c
SSDEEP 49152:9o7JUQjqirIhCnDHUPfF/ZR+ft983Dl3gEe8xA+LdASkaA/zZT4R:6J0glD0PnR+l9EDl3VxA+L11A/2
TLSH
T1A7B5D01EA3EC01D5E1BAD27889154A5AEA71742E1F319ACF1270837D6F23ED44F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 893bd9712632c54f51a23d6d1055fe42b3a2030ab4f7f62a64f946a651a8828e
MD5 5189a2c82af3a760dedeed63bde6293e
SHA1 5417b4d10ca3b6e3e9b58c41665a55e019b2d9e3
SHA512 e6a9ea93e91fe86ac456f86638d2f9751467ce874883285d761a2ca8f90f1621c3eea618ba41a3a338df2da9951e4a966829f551174a3a99c484d286f889845d
SSDEEP 24576:R1XnUPyWepjYn+E/HULNdJpd6+S+zJ55p:RRnU6PjYn+E/HULnr4f+95
TLSH
T13D3518117626CB4FC6A940325E33D2CCA7707D05EE04AB0773C9873FD576A59BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 346KB
SHA256 8d34289e7ec0c08a4a975c05f20400d09344928097812866570c2db395ae575b
MD5 fdef1f53a3e939f555774af6bf362761
SHA1 6807026f4ad50088a83ad1208b9cf05fa49b7c16
SHA512 65d7a0f388bc3090e159757dc9ae0c59fe8c51aa7d7a98396484cdc23247ad950ba7d9bca1344f81708dcfbf3fb9a346b7e437a650f29aa00eaf72d38790e669
SSDEEP 768:4I/TnalTZJlTPBlTz2+EQM6IUI/T5e/alTZJlTPBlTz2+EQMuf6+jxN7DalTZJl6:zaXI7xN7DlkdTeRf0bSmOMOks
TLSH
T1EB74D715B714F32EC5B6807748B0D1AB9B3DB8229F5203023BC81E95DCF225676B6F99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertToSend.docm

Path C:\Users\Admin\Desktop\ConvertToSend.docm
Size 774KB
SHA256 15a2e9db6b17436becae7a5eef489de8a2689755c4049a60f6a533e12409e716
MD5 f1211c5835c8c028fb69517bf15a410a
SHA1 d6381ba6bb6e1c74a7f01cd856c5edb7f1ff6144
SHA512 d347fc13fae63c8e6e0ebb45e0093a6e1cc47dab4a0814e13fed085e1acb7f4ceff8573795d00fc275bebc3a2789b919bed0c0a6814e712a46107b801fce8e53
SSDEEP 24576:4ZtETaAYtTetkqpkHykRiVD852cRqqEBhg:4Z29STerkS2bFgqEBa
TLSH
T141F4238366BCF013E49219BF91E10599EDD0438373A2FB1AF07309CF6EB3529DA55169
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DismountDisable.docm

Path C:\Users\Admin\Desktop\DismountDisable.docm
Size 780KB
SHA256 c0d42edc163f08e26a21bfaee9d359004d96774ad83540dbaf248e0f301fc8ca
MD5 56eb065caca753a9a7c3523c5240dfe4
SHA1 61fbd14e7dab2f9a1162df204a12904a0fdcfc1c
SHA512 66c5b116b5ccff42c36c61c2ea3dc00a8f30242bb135f43fe5228be8eba104d085ccb90eed15e5b1526cae9c5c917917e7d4e633bfaf055bd2ccbd55af482d93
SSDEEP 24576:msv9DkGs2C/HcFCKaZSip5EsLVdSZrZWP7cVjM2E3:mIRkGa/8F7aZ/p5mBZWTcV4/
TLSH
T1B40523F71A3418CCD92B74B2E25582CCBB8D9A75B0E1136731CB7295EA12DE3C0DA5B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 d3de3211469585ff78146886d334234f9c19f3d3d800fa8d5949c4667a5b1c34
MD5 1f1ebcd41952da4e7c67781c11b2b355
SHA1 b89fdf26ef56efcbb311dbddf28a5deffb32c931
SHA512 1dce779360f77be594995a04166bc10e4b5c365a51963ab1adf341ad125c7a748887457574ae91ea4fcdaa1fd4c1c43700ad6876e0fbd0a96661f935c7f52c85
SSDEEP 12288:707qRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:wqRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T10BD423002D4C29C2EA3F91F4598AE071B12BBD4E2FF464F3E41186A1AD796CDDDB056B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 787e2deb9f1fe2549dfaaa15862708f7715163af74c28bc8a7813f2463da757d
MD5 ebce37a454223a24ef4a5444dbe831b5
SHA1 2a392d858b3a64245e29e51faad0abd1c9c01186
SHA512 026aff3d8cf97fdd9b28885fc87f19c8526b0d3cc7a2f74446881431882ecdaa37ddd8e48daaf0a0edc61bc118b4a8d074b4020a806428a1c34cc50cd1f87f78
SSDEEP 24576:vgb6bmBIi49WNNFpg1rSvFv7bYwRPWxNs298r3OCDIjG3gE9ow+8xA+:vgb4mBIBhGFPR+ft983Dl3gEe8xA+
TLSH
T1CE65AE1E22EC02F5E0FAD2B89DAA4417D6B278161731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 836KB
SHA256 89870e69617687246abf706174c6480e355873865214eea0d3f858a43fa152c5
MD5 ed9436206d396a1e4f35d43ac53d8bb2
SHA1 3ec33e92d63022320e19f2aa975577b09d8ed422
SHA512 7038d5320464de4b27f1fd924713e72ef0b6fa4483b7ba91fd256cf8cfb494ba49de5831f2c3b4d20f91372b56874b8c371fec59541a9f138d2f1f5862456f0e
SSDEEP 24576:yGXaR4orsbLAaayTli1/zFfTdA9fXBPSe9:yGXASkaA/zZT4R
TLSH
T1E405223F22F67555E57AC0388D1208A268B0B25E975038FF49F1F72CCD368E56A39E18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 30c385795d8b2819ee130de92121a8316adb36460a97df0436d565d239b66a93
MD5 48a841d4a6805ba6b92a18448eee96f2
SHA1 74634de1b39980561c2a45fdc83af3a5f67efe83
SHA512 188bd4f873f7501cb91aabbdcd902be20449901da5eb14c22fdc0eea55cc07ce1d0b5fe68429ab9782e5eb9a352e5559142c74f9df8d5e0fc49d3151276451ef
SSDEEP 24576:VG88u8FpJqH1Wzria7/mfRPWxNs298r3OCDIjG3gE9ow+8xA+:Y7ZFPqVha7/oR+ft983Dl3gEe8xA+
TLSH
T1D035012576E401F1D47BD1388A824663F6B2B8151374FFDF06A88B511F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 7808a99f2608082918fa7b81db075e6d2852d6e5fafe1f5d353cc90b8aa14e31
MD5 3d7e771d33a56192dca3e2a4aa0a2c47
SHA1 9514fa9d6cdd4aa65f236cbbb5cf8ccc4c351559
SHA512 b6c5f0d0695e75972488ed885a54e6662bd141f04d7715b2756b8a06a113cd12a76ef18fb7facd04c7dbe6c282f18f5a7b6910310a98890fc77e219221240895
SSDEEP 49152:YBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjrR+ft983Dl3gEe8xF:zG05lO43bOR+l9EDl3VxA+
TLSH
T1C5D5C06E62EC11F5D1BBC17CDAC6460BEBB23815033556CB02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e8cebadb5c39c7ec684b9dfdcaf94fb5105648a610667d7ffe61b65b9c5acefa
MD5 2d3bcfbe9041712bd7f99f063d66219a
SHA1 04e2678726fdaac2dfd323b1f6d097019e31b17d
SHA512 f34b9689404fd1924c347937a0a9d550865ade3254e972e293dfa6b0d4889db7b85b553ef9f27cf1a8fef93cf24607f65f4427379af11bd9de48eb43bf3c3fa1
SSDEEP 24576:ffa5POZ3dpqWVM50JicR2hG0lasx2+47eidnpRPWxNs298r3OCDIjG3gE9ow+8xF:na5POZ39Jt2pasx2+mTR+ft983Dl3gE9
TLSH
T11565BF5EA6FC01D5D579D17DC583861AF5B2342613329BCB012182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 6a6f40c7979a514ea56753e5d729ef1827f2866c54e4a349db7bb6626e411004
MD5 2658060ab63820f9fc12347a722bfe38
SHA1 fd55e64c1966c421c1d8f1464e678732648a91bf
SHA512 cc1973f448762b38dc0845e5a1208dba7b49c82d8e71ca2bee2145783c1973b167a624cc696a1231908617e6e86df4102d7a229319902013228f6cb22489cf84
SSDEEP 24576:ANcwHdjbyQ4nLC18lb/EOjowL7FkHRPWxNs298r3OCDIjG3gE9ow+8xA+:ANc/zEOVHFIR+ft983Dl3gEe8xA+
TLSH
T1FD858C1623E901E4F5BBE1BE89779546FA71786913308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\System32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 1ca1a3f3303030bba8cbe6021cc2e78988bf5c86af166c1988252d7e4913746a
MD5 9ee005dd98e1d5bcf68c7a53868385d6
SHA1 b327e796bc964f2872d7cca225350ed4cf7f0c76
SHA512 c8535bfa057961a6a4c3e626a718dd58a3d486ce74beeb1749abb6053a714c22b7d9bd14dc83647dfbb1967f6850a668c922b3139523fe2087eef8a56d7746e3
SSDEEP 24576:QD3FHshBIYQgA+RPWxNs298r3OCDIjG3gE9ow+8xA+:QDVHeBIAA+R+ft983Dl3gEe8xA+
TLSH
T17825E13DEA9C04E1E57BD1BCDA538606E67238AD033266DB0190C1B65F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 952KB
SHA256 3c2372f274f0352b4891781d43ae553a60504c8b731ac3cbd44c1b20ee4afe9b
MD5 22cf710e18bf0a9a3a75524e2a035499
SHA1 c06a13d3a18bab9c9ea6eda7fd7c7cfe27ce6e8c
SHA512 437ad33edb1a7359ccf368e18b8d49b65d83847ab6fafcf57845a1bea4cab9d81e24767002e35ad110572413fb8da0cd1b9eea2ae639f95f5b75dfa9e9221757
SSDEEP 24576:t6DIzaR4orsbLAaayTli1/zFfTdA9fXBPSe9:t6DIzASkaA/zZT4R
TLSH
T13525122E23BA11B5E17BD03D8A830552D6B1B179C35228DF0AE4D67D8E73DDCB938A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 936KB
SHA256 1743c6c6d17f7d3bee65c3bc5456dee6a472c7812335f7e5fbaeef187154bb90
MD5 877c97cb25f86c0295bd19b903b1a3a0
SHA1 c9ee79c09d3a5e04e9f7e9e283945764e1539e2b
SHA512 4700b2abfd28d01fbc554bd9ba23a4352ba2d497d95e35f1f2e723d94cc09db795de0708f692a9b2b192403f0bf080f0d96d86bfabb3a12d1b03d6176ab6ed71
SSDEEP 24576:NtyAaR4orsbLAaayTli1/zFfTdA9fXBPSe9:NtbASkaA/zZT4R
TLSH
T1BD15222A13F86551FAB980388E2305E18E70F81D9B6074EF65E1FB1D6E33AE4AD31715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 808KB
SHA256 9db04fc0ccd209a0e15b9270e3eeeac922648128f2d638348034a05ff47a6d59
MD5 3a907922ab3714584a00f6ce9149d524
SHA1 3950ecd21454cabb464d923103ea80aa303a4825
SHA512 87637ece9f4bf1fefc0dd396cd9efd9ef31c3b696287556f80694460fb2f7deca67d786ff8549ad719d418c3383017e0e1d8c60cb45cbf8f7c76bfb9af9f08e3
SSDEEP 24576:NUaR4orsbLAaayTli1/zFfTdA9fXBPSe9:NUASkaA/zZT4R
TLSH
T11605233F12BA7A12F569D0784D0209E249B0D25E979138EF69F6FB0CDC378EA4A35714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.4MB
SHA256 0566e3e1e3b31a0992bc617475259e0d475a4e50cb0013ca57d3f8928fd13733
MD5 d68e2a47bbe4e19c753b3312d855e698
SHA1 69aa495e0167af3d8901a8ee3df7f49ca556c035
SHA512 26716c4bbc65abbaf2046f39d2a781c297aa1e39e564687f0f911ad342c436d1fc788f919e006fb17a3db3e24e254a1e36b39a19009db55c3f3c0b6a129564c4
SSDEEP 24576:9lgILoTfaidZqaR4orsbLAaayTli1/zFfTdA9fXBPSe9:/gHTrZqASkaA/zZT4R
TLSH
T11E65AE1D63FA05CAE2B2D239D8621493D633B4315772D6DF2458C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.1MB
SHA256 1bd8d9586ff25b91b9519b862f64893a8fc094bf6ecf3729f182e6de77e8a7dd
MD5 9c87e3548e0ea64e95f78313691010e0
SHA1 1171247614e76ec1f608e26ad4b70543ac4ec418
SHA512 331ffcadeca99b2f02b8929f0041ab75295b7af39bbe7515b3fcc826823de020598c0a396d9ca8b103fd1a3668c19b8dd436832b5830133ede3d863b509207f0
SSDEEP 49152:egb4mBIBhGFPR+ft983Dl3gEe8xA+YvASkaA/zZT4R:etYR+l9EDl3VxA+Yj1A/2
TLSH
T100A5D01E22EC02F5E1FAE2B8CDA64417D6B278161731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 6f5abd0e58d7fca226b588822c26571fe2b008e2b365d58d379a14be515a4edd
MD5 dd1de8783b2042f4930825d589f0881f
SHA1 566d91fb0bf3f99ab6011537d6c125db7805c996
SHA512 9d871e3d1131d56ba1587740b74d032f707e40c96d814bd02fa5e05f1d865159d65cba7e93417ef603fcf32fa28d9cf6a437e606287bfde0ce1b0e059981afb3
SSDEEP 24576:HTkNvNnaFeYhJNtmZBmiaR4orsbLAaayTli1/zFfTdA9fXBPSe9:HTMwBtOmiASkaA/zZT4R
TLSH
T1D675B02E76F846E4E1FEC5B4CD238512EA727461173292CF5290C13E5E279D89E3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1004KB
SHA256 cc0268a77584beaebccaf7516c9c03c95d50283fbdeee2c7f8ecdc40f002dfd7
MD5 5b901e93711dcef13bf9f14a1ac549a7
SHA1 719d432a563c608ec10fdde8728aeb4ceb77f018
SHA512 1aaea9ccd283b0736f602acf97baa34bf06a4b711447d3b60f0eb4b74bed70f91f76278ad3192627a812e60c8955892fd623c01d026a96c7a714c3a5cb4ad965
SSDEEP 24576:UPUr+NQYaR4orsbLAaayTli1/zFfTdA9fXBPSe9:UJQYASkaA/zZT4R
TLSH
T11C25F22F22ED1CE5F67AE07C8D424659E771B4661311A1CF02E1926E4E37DE8AD3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 835f4f82239e8af42b72fc076edf06c1192a1b7a031fabbf1c340602dcc7d51b
MD5 4904c2be67d7a5bd42185845cfe35174
SHA1 cc993b95276488e01aff3e43ffe29d85a4a87da3
SHA512 e5a8873a96a65a0598b6875d0a1656be54673e8b93dc7070066931f17e104c7162dc0f85ec0d5c9988dc1d57a69796aaf7ddb99573af1ac1d2f09cdd6c088c1d
SSDEEP 49152:VDVHeBIAA+R+ft983Dl3gEe8xA+SASkaA/zZT4R:iR+l9EDl3VxA+Q1A/2
TLSH
T1AA85023EEAAC04E1E57BC1BCCA538902E671789D036165DB05E0D2B95F3BEE46D39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\system32\TieringEngineService.exe
Size 1.1MB
SHA256 b041290b5fee759168b020284949d3d806bda50ed7781e77c80ea1f8e14bdd3e
MD5 cbd8a76a7577ef1ced75d7b0778e1e14
SHA1 2175cde365f8f98ea143cf63530643e4308298ac
SHA512 912adf39d6725359a4d31627d3003dc73b8098ea9f2274f0eaddf71ff6cf8b38da19ebf318d2a1a378c24782eba45eb4a2aaaba6dcdc6726e03e0e223d42649b
SSDEEP 24576:oJnJPbzB4ShaR4orsbLAaayTli1/zFfTdA9fXBPSe9:oJnJv6ShASkaA/zZT4R
TLSH
T1E935E13DD2A810E9E4B7C1B485161B96FF71346D2F2168CB19B4D5387F12EE0AA39F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 800KB
SHA256 18961c1f6c8ebe11b07edac7363d05bc85c210f9d66d08222a08c76ad5930a51
MD5 6abc22b92216fa671e85a9989384d4e2
SHA1 8a6a4e6aa6fc64b2cefa5dc01143548d41fa8dfe
SHA512 599c54e5a72dc441c01341748ed0577bd707b0c455bad94c59239590177d76239aa9da6e230222897ddb9b2ec91ad2a1251269a022c661803b665aae43e2f47d
SSDEEP 24576:hxaR4orsbLAaayTli1/zFfTdA9fXBPSe9:hxASkaA/zZT4R
TLSH
T18805233F12F9AA12F669D0784D020DD249B0C25ED79178DF69B6BB0C9C378EA5E35318
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 944KB
SHA256 8974bb8ddfb1fcc843edb0fead57d9bb984c77da3e0dc20370440f8a8177cd3f
MD5 354a52463fc0c472d0f121d39d95957a
SHA1 d6765d83e9e513a430d0cf0df526a3b47393866a
SHA512 2810b0caed5a4641c4ea350b25d715736435206ce5951d7170a279211738db84ff0c8e3b14a693e0b248743a39f4da7817a462eb38833c4997fd87a5f1adfed8
SSDEEP 24576:A6UqjpVaR4orsbLAaayTli1/zFfTdA9fXBPSe9:A6UEASkaA/zZT4R
TLSH
T1B625122F12E464A5F579C034CD22456245B0F92E53A174EF75E8EB3E8E33DD58A3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vssvc.exe

Path C:\Windows\system32\vssvc.exe
Size 2.2MB
SHA256 80cfbe1678da8d77cf04be8cb16c8526addae0e58adb1f5294dbe451f53e35d3
MD5 c8988db31d64e319df9ccde484127726
SHA1 a9883f3a96bfc3cb21dc9761ae973488258afde1
SHA512 367fe426234aa9dc3b07b399466a0d344d26436c00414cd2104b9c54c808d38e86deb0d4e7e32ceef903382a3360dfdf7e6b7db086c5ea7006751c6769bc2cd8
SSDEEP 24576:yCLHGL0MoeVtFumTijCmlKQWDk6YaR4orsbLAaayTli1/zFfTdA9fXBPSe9:yCLHGeeV5ijCmlDWDk6YASkaA/zZT4R
TLSH
T1ADA57C15A7EB5184F8F3CAF4CA2294168A327C549B34F7DF4A80CA6A1E32FD5D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\system32\wbem\WmiApSrv.exe
Size 968KB
SHA256 8e66bf511c8ceb4125b60c61b6d9fd88f4925fdd1bcaf06273bce3c71e1d6b16
MD5 8d24625b731b7f98d6d0656f80b5ae18
SHA1 197def964610c9cc11cab45f50e64aed53d119be
SHA512 17282af812ff36daf07924b7019e47132e92f0fc6024db30eb1fcfba4299ac196f880ffbc935cee2853643e03842b57b64ee215fb6e35bf3bd82f0d83b36ae52
SSDEEP 24576:brcmReaR4orsbLAaayTli1/zFfTdA9fXBPSe9:XcmReASkaA/zZT4R
TLSH
T16225012F72BE00A6E1BBC13C8D424552E6B3B039535266DF46A1C73D8D279E97E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\system32\wbengine.exe
Size 2.2MB
SHA256 a910041eca4bca480bf51a4f6ed732c2030804a86737756a306df86975f13b6c
MD5 76757d113469835abf6613fc1d83c556
SHA1 9c3f3433613aae9040a34d0ec0c17fbedc4e86bb
SHA512 f766cd5408e0dad02191779d30204d2dd919876c0be62cdc47208fcd3e1880b9ec47bc773ba58fecda6de436664a2a3be9cbc938dc893e2c4d2c7c073a402b46
SSDEEP 49152:hDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3nASkaA/zZT4R:S3Upow8sBU1A/2
TLSH
T13AB59D3DA2E810A8D9AAC379C54213A6EA71742E3F3015DB0174C578BF1BDF19A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/436-364-0x000001981EAA0000-0x000001981EB1C000-memory.dmp

Download

memory/1204-0-0x0000000000400000-0x0000000000570000-memory.dmp

Download

memory/1204-7-0x0000000000D60000-0x0000000000DE5000-memory.dmp

Download

memory/1204-6-0x0000000000D60000-0x0000000000DE5000-memory.dmp

Download

memory/1204-13-0x00000000030B0000-0x0000000003117000-memory.dmp

Download

memory/1204-20-0x00000000030B0000-0x0000000003117000-memory.dmp

Download

memory/1204-2-0x0000000000D60000-0x0000000000DE5000-memory.dmp

Download

memory/1204-68-0x0000000000400000-0x0000000000570000-memory.dmp

Download

memory/2276-88-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2276-82-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2276-81-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2276-304-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3764-92-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3764-319-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3788-95-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3788-96-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3788-102-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3788-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3788-354-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3788-352-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4328-158-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4328-40-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4328-47-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4328-48-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4328-41-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4376-69-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/4376-73-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/4376-61-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4376-62-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/4376-75-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4376-70-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/4704-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4704-155-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4704-149-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4704-151-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4704-143-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4820-335-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4820-337-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4820-107-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4820-108-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4820-339-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4820-114-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4852-128-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4852-121-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4852-122-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4852-336-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5028-119-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5028-34-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5028-35-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5028-28-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5028-27-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5812-159-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5812-166-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5812-160-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5812-343-0x0000000140000000-0x0000000140172000-memory.dmp

Download