67ec6f458e5475501cc75f7b2f25d329dc819fea6be33a9aaadd638a1490c8d0

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 11:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
Size 1.8MB
Sample261030-nnqq3sed22
SHA256 67ec6f458e5475501cc75f7b2f25d329dc819fea6be33a9aaadd638a1490c8d0
MD5 029165c44f2199cd5b1f8e7f2fb226bd
SHA1 6725c8d09973ed9cfd805d2c0675d76ef1d70dd5
SHA512 16f2b8411343ecde0584ee42024402fd8840bf3fbbaba5c35998623b50b26682386b3f7dcd2857d8ab06470ffd7292b82d4cb276ad80c33b15f6ef5a0e2a63f2
SSDEEP 49152:nYNwPLKduXQssClWGzKke30jaNf1TWbdz:nowbXQssClWCNU023W
TLSH
T1A38512107882C073E5B241711E3AD7B65A7D6D610F150CDBA7E0BA7D6E306C2AB35B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery macro spyware stealer upx

Malware Config

Signatures

Suspicious Office macro 1 IoCs

Office document equipped with macros.

macro

resource
behavioral2/files/0x000400000000042b-379.dat

Executes dropped EXE 11 IoCs

pid	Process
4720	elevation_service.exe
4112	elevation_service.exe
4596	maintenanceservice.exe
4656	OSE.EXE
264	PerceptionSimulationService.exe
4368	perfhost.exe
2044	ReFsDedupSvc.exe
1636	SensorDataService.exe
2796	ssh-agent.exe
3320	AgentService.exe
4972	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\84bc84784b315ee3.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0001000000009344-388.dat	upx
behavioral2/files/0x00010000000093d3-389.dat	upx
behavioral2/files/0x0001000000006215-396.dat	upx
behavioral2/files/0x0001000000009b8d-395.dat	upx
behavioral2/files/0x000100000000bd49-406.dat	upx
behavioral2/files/0x000100000000627a-407.dat	upx
behavioral2/files/0x0001000000006223-405.dat	upx
behavioral2/files/0x000100000000a314-404.dat	upx
behavioral2/files/0x000100000000a2ff-403.dat	upx
behavioral2/files/0x000100000000a2bc-402.dat	upx
behavioral2/files/0x0001000000009384-401.dat	upx
behavioral2/files/0x000100000000a1cf-400.dat	upx
behavioral2/files/0x000100000000ba38-398.dat	upx
behavioral2/files/0x000100000000a0c9-399.dat	upx
behavioral2/files/0x0001000000009cf9-393.dat	upx
behavioral2/files/0x000100000001b990-391.dat	upx
behavioral2/files/0x0001000000009cd1-392.dat	upx
behavioral2/files/0x000100000000994d-390.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107515\java.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107515\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000047badb736268dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000983ff7756268dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008ab22a796268dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000001edcb9766268dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001bd7c4746268dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000d4c56786268dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c86c717c6268dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000677dd1786268dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 63 IoCs

pid	Process
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
4720	elevation_service.exe
4720	elevation_service.exe
4720	elevation_service.exe
4720	elevation_service.exe
4720	elevation_service.exe
4720	elevation_service.exe
4720	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeAssignPrimaryTokenPrivilege	3320	AgentService.exe
Token: 33	4972	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4972	SearchIndexer.exe
Token: SeBackupPrivilege	2044	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2044	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2044	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2044	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2044	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2044	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2044	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2044	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2044	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2044	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	4104	2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	4720	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 4540	4972	SearchIndexer.exe	101
PID 4972 wrote to memory of 3400	4972	SearchIndexer.exe	102
PID 4972 wrote to memory of 3472	4972	SearchIndexer.exe	103
PID 4972 wrote to memory of 2964	4972	SearchIndexer.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_029165c44f2199cd5b1f8e7f2fb226bd_amadey_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4104

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4720

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4112

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4596

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4656

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:264

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4368

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2044

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1636

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2796

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3320

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4540
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1262770251-41185387-1005173349-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1262770251-41185387-1005173349-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3400
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2840 2844 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3472
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 dbee0336caf070a2a218557fc92b4a2ee665b40210a012d6073d24ae99c043a0
MD5 a6042d3482ed0d70cd47b0d439971b8a
SHA1 32670e9c01619d8b4016d22af830559be56d3f24
SHA512 f43c5d9db2bbe16f998e2919d1cf4b1fbc6a1b03fea3f52c2374e8177337cd5d22646ee3f0aad00257a9bb9d2721ecb28c19b04d646f1b903de97487dc1bae33
SSDEEP 49152:9b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnqe30jaNf1TWbdz:D3q6sjBLU023W
TLSH
T17FD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 39b500f455a0184ee6eb630cd5b0d379822d442ed5907e5dc036a882338744fb
MD5 22fa52b8253a443a3c44833886d67388
SHA1 f3116fec9087464a4d896bcf4bf4ca3951ea4900
SHA512 3690e620426a0d45f80856bd00c6cdbc1b22c1af8393a5cf62b1ee62713c4795f5dceb53291b0f309ac3fef3bb03299acc743902f0baf608ec0eee78614b0fc4
SSDEEP 24576:NXYfDtczAYgXe4i7ojhsP5Lgrk1TWb4AN5OdLA6cXnezqPnW+wClWGezFkzKptK:YtcYe30jaNf1TWbdzOduXQssClWGzKK
TLSH
T16B751228B79008E9EDA78279C4A78611EB733C854754DB9B03E0DA255F333C99E3DB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 e3c8ec90a703a69cf9cc61220898edcacca74a06c176e1dea0dd0f4608af9ceb
MD5 1a299691a14f4cb194a4da4661d97971
SHA1 3531b81aca72934353cb0294869bd517867d21c3
SHA512 3666a435cb60c5fc0d24858f5e9e3532d979d2a2a70d1612a82f3e432ce50851ee3b79e8c0dee3b9b32dff5558ee5dd1e7325504f2b04627b8875f35ba0805ee
SSDEEP 24576:yXYXWnczAYgXe4i7ojhsP5Lgrk1TWb4AN5OdLA6cXnezqPnW+wClWGezFkzKptK:oncYe30jaNf1TWbdzOduXQssClWGzKK
TLSH
T15E751228B7D008E9EDA78279C4A78611EB733C854754DB9B03E0DA255F333899E3DB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 530bfed5f33a25d7cdef8de8fd382d08cd781b8fa6b2e3c41a4f93411789c0f1
MD5 1c237c466c0865aef180bd6a9f46c791
SHA1 73a320ddfd6f86339c12217f9ab32e392fe46cbf
SHA512 de1825e2a2541a59bf38e0cd7424509c860ecb24e016480a7322f511c4393c7a9c70415f9a688345e533cc9fb8517a716131aa733aa0d65b2604b62be1322af7
SSDEEP 24576:NXYfDtczAYgXe4i7ojhsP5Lgrk1TWb4AN5:YtcYe30jaNf1TWbdz
TLSH
T18D05F12877D409F9ED678278C8E28611EA737C814360EB9B03E499661F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 bc4813a94dfe77d0276bd0fd5cfca2c48e79288df5d4f1f9be3e2a05c854e2bf
MD5 41d11c881e1ed98e1b7260b0c90b1be0
SHA1 23d2e56a7b81fef40e0c70e9357977f2fc0a2d49
SHA512 02d6cde1fafa95cbabee28ca501b5ca5a398ef2d39ab3c4de8e65c418a9d9279e8c04387304a5a83a1efb3e7c1188258a0a13a0ae859e94830f137792a0cebb2
SSDEEP 12288:Tmw5HEjsChNVBFgl0WDm+Cs0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:ywu4OWqgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T12B05F14676A40CF9E5A78278C597C632F7F2BC412A25CB1F07A0C65B5F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4a526c04b089f03e17236ac0b415a28e11903d55f32ca5911cb360fe6bb5cc92
MD5 980993169f81c5d7fddc9891b3e9ae8d
SHA1 b02dff5b3dfc5e0023bd4a76aeaee0cf0ed2b166
SHA512 320035a97855db6b71d31203aee0450812a105f4cc308591ce299981ed2324cd7211fd77341ab56a407a582cfe3eb733c262d0642ecb058d202259faa048440c
SSDEEP 49152:+B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glfe30jaNf1TWbdz:su6Jmdxd2dfU023W
TLSH
T132D59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 31f19426ed22eb72375b219bb20adad8aa5bc4766bccd0c58d8b344bd7161486
MD5 938107759f75d3a61d7f350295cb876b
SHA1 02c6b597b7a1fde5b33ff0ffd9845ed08e660432
SHA512 9ea0327aa695644e20e39e98635528ed3e058f7d7b793104a096dff958bce44d4603d51e65e1c2a9834f224e6205596e61385081ef69c35ee658c2a823882485
SSDEEP 24576:QfwvUk9RX6wkyAIHgXe4i7ojhsP5Lgrk1TWb4AN5:kMnYIue30jaNf1TWbdz
TLSH
T1DE35D029EBD804D5E1B7923C99F3460AF6B178591B31C6CF029A53AE0E37ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 868fcf1e4cacf0b1f724db22eb77b6dbc495d48ce374bcf1619157ac192ddb2a
MD5 c921c98a0f9567529df01b1751708860
SHA1 61cb8d43a2feab52442ee5b13eb27a8fd2046b4c
SHA512 2d7eb381a3051cb73a39ef9d8ee036181c1916b694c70591b87991db648e73d3171466ae5c58a75a1b230feb711d85c2755ed897f029060abfceb12a497290da
SSDEEP 49152:jMnYIue30jaNf1TWbdz6duXQssClWGzKK:4AU023WZXQssClWCp
TLSH
T127850129EED808D5E1B7D27C88B74606F6B138591B31C6CF0299936D0E37ED4AE39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 5b6400a7f3cc2cb0c4b6316393f77606d5adb722edf0d7d9985997ba0db29d6d
MD5 b295adce183facff3357c9dafd5fc5e1
SHA1 b3d11969a44758f5a06504cabf724a775e7741be
SHA512 08c61cc7a457566fe42ed453aa97eead28e9c51afe5c0c9e9d948631d940265d105c7d77d4eb16dab1dbb6e18d96e1570680945acd16ff3690dc97dd89c3a169
SSDEEP 49152:bYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Pe30jaNf1TWbp:+ySzPHU023W
TLSH
T1E2067C96A16801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 4.3MB
SHA256 ed1a2443cdca9604961a3a00f184e19ea5ce012db4e981676fe5f3579d315e58
MD5 4603f677f4191d078a82c310212629f9
SHA1 3a85070be2a3a600f05de6ded7ec60ffdee035e5
SHA512 a0b9df0b05a23986cf352225cdf992fa255b88ae3c2dd0ae8e714cd0c1a4adc558b02eb6950e80f8dceea2ffaeb5e3f3eb884ae7b3fd406e6e0c17991d9725a3
SSDEEP 49152:vYC8Npsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Pe30jaNf1TWbv:kySzPHU023WtXQssClWCp
TLSH
T1B6269E96A16801D5C1BAC1B98B0BCC17FBB1344903359BEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 0de4b30cce1a5aae06a40772f12d9d61a1d5a1584839de0cce8132dc1c22ea02
MD5 0ef17d73ab275504cf6ecd5eb27a8358
SHA1 3b9b8b0122e515d05cab1aa8d3c160f3e1929a39
SHA512 d9199cc16964af1290d7594adc2cdbe213e2e7365b78eb23be8d47d1a6a38f5ed98f53ca73655e106be481c4caf208a82c80943c1cbd6a475d9273188db1c212
SSDEEP 24576:W47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYygXe4i7ojhsP5Lgrk1TWb4AN5:W47JUQjTirIhCnDHUPfF/fe30jaNf1Te
TLSH
T1EA65AE1EA3EC01D5E1BAC27885554A5AEA71782E1B31CACF12B0837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 4c19da260ca56568f362676a3e2fdc24c615256178d1328c0e054ee99ea97daf
MD5 f7e50c65028ae6faa4f8ec79f10318d0
SHA1 804d07195ba1ebb1479b5d98df6422c57b64acc8
SHA512 1eae23d03efad047873501dd0625b8d9d84d5ea5f05a4e9a9dd85cb124453da737d6202e1ac18241fec7515e0fcad9d79d089570a2fc6d8c9108a6cded21a246
SSDEEP 49152:jJ7JUQjdirIhCnDHUPfF/fe30jaNf1TWbdzXduXQssClWGzKK:JJnglD0PNU023WOXQssClWCp
TLSH
T1ABB5D01DA3EC01D5E1BAD27885154A5AEA71782E1F318ACF12B0837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 495b55f83a52caf0e5e230ddff91424585dd716ccf01c27d493f8a9d4d3fef51
MD5 93ef56db264b90f2ef403f09e76f4105
SHA1 fc44f0074c99a4a68eaf3a5caa5955be71a75148
SHA512 87a3731927bc95483cd9108d7324c1b68909022694cbae50a21970ee31aa106a7acff5e7057b1e6314de2b3a7fdfb89e5f3d672e11d63e907c77ce47f76b026e
SSDEEP 24576:AuX/JrUPlx1YZz0HIpR2XS9q0WhH5j9pqF:brUtxyZ8IpR6QpWht9pq
TLSH
T1434517017626DB4FC6A940361E76D6CCAB707D06EE046F1373C9873FC476659BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 8KB
SHA256 e81eb137acf85e7bea30ee4212c64d076d19c686d63e430d2f42e829a8073cc8
MD5 decdffc886aad6186ac39b0ad36d22fe
SHA1 edba33b053f486eed0743053fa8679665efd70bc
SHA512 f6e5fb8ecb16775e5dffd02efb69bc71f9e8d30afc02e5082b5d0c17cf9d0d9f79e1f33c89a4eabd61ef03627beff813e1d91bc3769a5e7594c253b7d22e7d6e
SSDEEP 48:e9QQ4wOdZnNn37nXll7nXllpgeVnS0PUREK0kENRu+UKnR0:fQUZRrllrllOPP+LRTXm
TLSH
T192020072B7D4F332C85603B24870D3DA63BAF5A16C100387795013DECCADA821E56F51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 329KB
SHA256 5a3395d8b6db3973c46ea17bee404d54dd4ff8dc04135ff3fdb7cd0e39157e88
MD5 669f80645036f3a65925de08eea1728b
SHA1 9c65cfa6215e4596efa21b70857fa78ffc8c6e8f
SHA512 8c1468ab2d3cb09b7aa671a2f06338228500f79ec7dc886049534b50e222dcd5fa26beaae2bafd0f2b5f213785a51101c183dee6fa8d0a282fa5149718ce4823
SSDEEP 1536:ZaZQFQJy3d0MMWnlI9EDJKE+3+dX6NT27h2:gg0cFKW6S
TLSH
T1E8749311B718B329C8B280B74871D6A79B3DF812CF2252423FD81D96C8F625A7B76F51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RenameUninstall.docm

Path C:\Users\Admin\Desktop\RenameUninstall.docm
Size 777KB
SHA256 c2145b1d141f6264e2885abd2ac4d0888e3cf1663ef5ad3c511198ebeeab378f
MD5 a9385f82a5df3bb0fc088d7a5956ec3b
SHA1 e223ce256554ddafd89a85a4d0ad730e2e4f9688
SHA512 c4f77071cdb7a2e43723b6af17ef26491088a0506d18e40ac721a66ab27461a3f6dc62a5277d289976971f3c8819f6c631fc0a297af073b7524a5d0e0fe7b5ec
SSDEEP 24576:Nc0Eir9DOgLMcgft7cDsYDoy0XS8orxmWiQb:G0EirRO2MhSc5o
TLSH
T1AD0533929BB625B7E3AC0939E570C49DB32F850AD6B2400F725A82973476CB34535CEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 bc05c10c948366400b1a4409188d627a8590346ab694d9f923c2677d3fe63fbb
MD5 10b692932507d3661cca742206eb605b
SHA1 72a7c013b540c68c403eaefb0d81a2c5430ecd29
SHA512 7194c113f27ca653d535a1101d34692c688b719004a0db2abd2a890707f71549e715c8042423b77d1e79fb1bfb5010ebf3c3f392a835fe663543e7f5f5a0090b
SSDEEP 12288:M07C0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:xbgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T156D423629F584DC6F29BC3F090FBC760F5663EC0270089EB56D0BA9319B8CD99EB4519
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 d3ca76517d19c696b7b29221f04bbae3c13e718a3fcacd4f653f29602c0135b7
MD5 911f008b898d5936c5ca5d1f749d8b1b
SHA1 97f18b778836222f9e388720f90af9e50a52d365
SHA512 79f259c29c7707707bc714f597d51cc751a5681076aa238cac8e481bca115823560730ad8bda21b6aad750351b0085310a81318f1fa85e62d9ce88ca450504c7
SSDEEP 24576:zgb6bmBIi49WNNFpg1rSvFv7bYtgXe4i7ojhsP5Lgrk1TWb4AN5:zgb4mBIBhGFle30jaNf1TWbdz
TLSH
T12965AE1E22EC02F5E0FAD2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\System32\AppVClient.exe
Size 1.3MB
SHA256 e972536e25ccee17203b76f646ea977c9761fb313e8c0fa5241151840fdf80a8
MD5 bb80ca3f4634c9e98e49cf07527b6e21
SHA1 fa48c5cd707ba1cd8ea4ee49040dccc0bbce8714
SHA512 d77635f1aeb8ceda594ba759c8a0d601005e33c98f999a159f5b7a0bb33b24e2b682e9c71b8552088a81af8316e4e62ab4184927dbdfa987b34ca87e327ab87a
SSDEEP 24576:JTkNvNnaFeYhJNtmZBmsgXe4i7ojhsP5Lgrk1TWb4AN5:JTMwBtOmje30jaNf1TWbdz
TLSH
T1FE55AF6EBAB806E4D1FEC6B4CD238512E6727851173293CB5290C13F0E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 832KB
SHA256 b2bb9b98e3a0661d0c36658f1a398963eae0f38f6ed1c55fb6687be036b40836
MD5 1cde5826e1c4749f9e26da5b64aa8c66
SHA1 820e12171fa66c7fbc41f1f1febcaa5bb84a4435
SHA512 03ade47ffa2ba5b41b3bc9c76baa9f3b745f67aa50aea63d070267f3df373017dd52530519a71304ac251489aee9fb4ee3e992ee1a2e233c5977bf1cc0dc13d2
SSDEEP 12288:qpGzsljdLpS69fWfXhNToOzj4Lnqn/E2nyX3qmkwCl0BGOxXtzHlkzKpQrG93D2:eGidLA6cXnezqPnW+wClWGezFkzKptK
TLSH
T1D405232C78A12889D4BBD6B6001F56237EB538914B190DEF4AE0E6389F153C5E73CE5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 815723618d0fe823990b124f1ac50a198edad1743b151566a4998a4059a91100
MD5 317c07df7ecce94040c6330922dbf64a
SHA1 5ef5d7c27ee2f02b76abe8dc645c6dfdb26ee63b
SHA512 0f1d63d2ead1850ca39d07b0cfbd423230ed9bb6e305613768638a443350daa7c5236a88b023b5822b3ee1e5c0dd9eba1d98690e55ac2619d37711d7c821d062
SSDEEP 24576:qG88u8FpJqH1bzria7/mCgXe4i7ojhsP5Lgrk1TWb4AN5:R7ZFPqVea7/Qe30jaNf1TWbdz
TLSH
T14535F16577E101F1D07BD138898246A3F6B2B8151364EFDF07A88B521F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 10ac3e98da15dafb07d768a86bd607a89d544ac9d36cdb4c2212fae40368e9e0
MD5 e4196073fa74da48d27ae74f5e3a4dcc
SHA1 5a68cafa51c4e8d8245cad1079074ca36d1ed824
SHA512 f9699dbd30077397ed4533dc6d3c7f536c4d60fed0a5cbce42930b8d8a4d7b0da695840fd5218983668fdb4a75c5c933319c8f41020cb9faafa634d576dcd05a
SSDEEP 24576:FPUr+NQOgXe4i7ojhsP5Lgrk1TWb4AN5:FJQBe30jaNf1TWbdz
TLSH
T17105E12F66A81CE5E27AE17C85828719F7717852131196DF02E0817E4F67DE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 525110ec41ba0ea3cacca9c1b860888ab0c288c43f8e992596059b5b854e50c3
MD5 fcb8d1dc50392c1a64b7a66f248dee86
SHA1 4b975a9fd63ea8e0df5ee2876625e62e4721b222
SHA512 34d26d4b1afe080a1484e7dab4ec877d39736debd842273fb0acf352c500704b60942317888f7883728be3679f282c4a7396433be1c9c78da97a50427ba3e805
SSDEEP 49152:YBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjxe30jaNf1TWbdz:zG05lO43bWU023W
TLSH
T1D7D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3bc73c35fc0b3c14c4dc4f4b3b555808ad6b8815d23d9661d698cf9aa8f83244
MD5 707346bc383af6aadfe26d18cab5ad39
SHA1 6ba866b7cdb7328f1dba6e82f0197d7446f1ea88
SHA512 18a94a18126189354e5ad4a8292ca407ed09ac2e67ad8c19ff994fd01c93b4598d953fc8f48b3f1b7cbe5eb6daceab7e7aa4baddec88f750d19c18b6b726a802
SSDEEP 24576:sfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn4gXe4i7ojhsP5Lgrk1TWb4AN5:0a5POZ3BJt2pasx2+mpe30jaNf1TWbdz
TLSH
T19D65AF5EA6FC01D5D1B9D17DC583861AF5B1346253319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 7946f40e10324fed01f8de70db99dd3b38bb39df0fd4d9e6f6d0dbf282c7010e
MD5 6e398d18fc63e5c90dbf9cc3ae898031
SHA1 5e23e08f275e2d4869d3503bd22f7ba14899218b
SHA512 08286484c9c616f31fd9df43c14855de054f6ebd9d87fb8aba4f7c77db7d74e50d043c7b97265e56893c0d7da9c85641a64679ef83b96cfc1748f0c434a0436c
SSDEEP 24576:WNcwHdjbyQ4nLC18lb/EOjowL7FkKgXe4i7ojhsP5Lgrk1TWb4AN5:WNc/zEOVHFwe30jaNf1TWbdz
TLSH
T1BD858C5623E901E4F1BBE1BE89779646FAB1786513308ACF0291851B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\System32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 1577837d0a303cf2f29011d2b15d4eadca3576f43ae9e34072e477968438c82e
MD5 a42c124637d614ab106557b5b4784b92
SHA1 1d4083f3cfa41c437de61f5e57dac897f1f615cc
SHA512 8044dd5522a40d4c99993d67d39a5c89eb15ce222ba13990fa01e1bef3457bb8e736024d4bae5da3fe11cc46517abb64957d31737216e841c4c9d22178cd10c2
SSDEEP 24576:1D3FHshBIYQgAvgXe4i7ojhsP5Lgrk1TWb4AN5:1DVHeBIAAme30jaNf1TWbdz
TLSH
T13D25E17EEA5C04E4E57BC1BCD6A38A06E77138A9032156DB02D0D1B61F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 948KB
SHA256 becf53ca426c3c8376b928f3b1a40710b82d98bdb6d7dfa50e188d4d553f6b28
MD5 8593b65f89148ce7999f5f0145438d04
SHA1 58c9242c8d80d6395e7ef955dafc648c219a1e25
SHA512 b27a7ecd3be2578cb645d24a3aa1600a3c9d36108a7150d8c758bc1fe85f45cc62af17a118d90546ea7c4ec4d3d0fa2d9a6743759f7cd2b7a11dc7790015965d
SSDEEP 24576:w6DI1dLA6cXnezqPnW+wClWGezFkzKptK:w6DI1duXQssClWGzKK
TLSH
T18725025C726610FAD0BBD07A81470612D6B274A18B5609DF4B94C67D8FA3ECDFA3CE42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 932KB
SHA256 66aa01a504a5f08080ba05625d85daa0b8be09b0c117534ee967c322bb2a1a5f
MD5 ee636dfd4b9cb726886ce2af5ca1a542
SHA1 9a6e07dc67eb70a54f26f8e53d897708fd778392
SHA512 d0fe67c1ef713ab3025b72796306f9dfc28043b94ba8faa5cb27c5dec2c29272f333ac43b172633da150b8946cd7b19af88d2aa951f3512b926d50e0151cd35b
SSDEEP 12288:lG6kyBsljdLpS69fWfXhNToOzj4Lnqn/E2nyX3qmkwCl0BGOxXtzHlkzKpQrG93K:ctysdLA6cXnezqPnW+wClWGezFkzKptK
TLSH
T1E6152308A69014C9F9FB56B4462B42618F793C104F264ADF6AE0E73D2F367C5EA34B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 804KB
SHA256 3de5ce9626e62eaa4aba8ff437be94fc9b37028b3d0d12d253008f52645a22f6
MD5 2a7ad06cbae5bae3d88895260ed1fe3b
SHA1 2b97eebd8b63e17082801b819e06c03afae18fa5
SHA512 230b927fc14d0e26dc649936a3ccdbf9cd60f17d3db9d5a4deacf8c1985dc53696ec0621d8569f110aacc32c654a53ac081cb2f1ddffdb21a32a6c26ba6fe183
SSDEEP 12288:EyGsljdLpS69fWfXhNToOzj4Lnqn/E2nyX3qmkwCl0BGOxXtzHlkzKpQrG93D2:d/dLA6cXnezqPnW+wClWGezFkzKptK
TLSH
T19005235CA8511886E5F7AAB2010F16124FA93C960F5B0DEBAE90D6388F153CAD739F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.4MB
SHA256 08ef5598424bf497b916674ee2753f461dd3b26bbd41132ebc4e4981fd8c84e0
MD5 e36186f7da24a3786312511b3a8979c6
SHA1 5fc210ebd0be1f93247656471c8953582ada9e56
SHA512 852679f042473c54947795d3ad01f6db7229bf81b3bb312a0ecf9e806aa94cd418d2bf933e74b499f53f2986d8f28af215041f35a26371d80f874773fd77006b
SSDEEP 24576:5Dg3LoTfaidZCdLA6cXnezqPnW+wClWGezFkzKptK:xgsTrZCduXQssClWGzKK
TLSH
T12B65AD1DA7EA05CAE2B2D675D8231493D633B4315772C6DF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.1MB
SHA256 41c48226ea7be945766f72b3a227c5e9c821ce9ca275615368c382a5b357e876
MD5 d14255ab7537e789dd4785c58948dc9d
SHA1 52bba9b23ba326b04f6b0495aa5cd06327a6de72
SHA512 83fefb4bc61c417f62da5c956adacc5e678260a76edf1c8adaa875cb7a355b2cc10df7053533d625610c90793a693e08b86015756525b7c405da0ff0cef729e1
SSDEEP 49152:mgb4mBIBhGFle30jaNf1TWbdzQduXQssClWGzKK:mtgU023WvXQssClWCp
TLSH
T103A5D01E22E801E5E0FAD2B8DDAB4417D6B278161731D6DF1250423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 49626ba8aa5d0d82aec09380503a0b6831a1267480a39a4be38f5f5b8196232a
MD5 d57a8df2b00fbc7c20403b3cdb00864a
SHA1 979b0b0bf541e74a2f2589dce1a0bc0be590ec57
SHA512 8ddae1d6c202c6e1c9c09ab177bac15d4d34d05ebdb03e5534501dd3ce0a03bca6b2b72efc6cc61661e530a63ca359f1b57bb0f83a6d836df51eb6cfee43b10f
SSDEEP 49152:bAMwBtOmje30jaNf1TWbdzQduXQssClWGzKK:cF7U023WvXQssClWCp
TLSH
T194A5E16EBAB806E4D1FEC6B58D238512EA727851173253CB5390C13F0E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 95b9b16cda982ef1406fe7ac8cea049b684053ef7c2ee7f8fb9e1eea3de3f3d4
MD5 ff34ad13ccea7bef038db6c02b09acae
SHA1 7dbbd61ebb52f93e02e47a59f29e24c792ea3c57
SHA512 d1146881bd6d4d671c7f8b7e7a92bd7c830d92638085bc2cb3f9a5fb8e6a5f71e355c136878ab0ba0f16a6f91ff3839981cdda1f5994b03c8620fb6d12a18194
SSDEEP 49152:PDVHeBIAAme30jaNf1TWbdzzduXQssClWGzKK:MU023WqXQssClWCp
TLSH
T1EE85127DEA5804D5E57BC2BC96638A02E7B138E903225ADB06D0D1B61F2BED46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\system32\TieringEngineService.exe
Size 1.1MB
SHA256 362279990b53a0d402fe2ca8a616a48c5ad5fcbb71aaa61e1261d482bbd80f7f
MD5 3ff09b30ffa30956e633400744b9449a
SHA1 324bd337075fa72d1425a9b5e9b17e063b688939
SHA512 ac703ddc3f589987edee3278de5cc82fd185058d001ca6cd0a36b3969ed9d30240b197b37e7f05d5818e56a6fecf7ba35f8317849390e3f10147372fd0c76c01
SSDEEP 24576:DJnJPbzB4SidLA6cXnezqPnW+wClWGezFkzKptK:DJnJv6SiduXQssClWGzKK
TLSH
T1EE35E02CD1A810E8E4B7C2B4811A176AFF71386D2F2669C759B4D5343F12FD0AA39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 796KB
SHA256 602e7e7a6b1111e4e861e4050bd1fb70a482e74e1c2372d521645467aa1a1d22
MD5 d3cfea9419e28a18761d3f0a3008cfa4
SHA1 4ff9217e632b6c87cb7e74f65f2e1105f24c3c21
SHA512 0b7910d6efce12e2b3a4794e86094619ccc19be3d671924ff082a8c338fe1e2b08adb0ae288838c6fc9904481eeb7eb87906ccff812de0270d350a5c6e3aa727
SSDEEP 12288:GRsljdLpS69fWfXhNToOzj4Lnqn/E2nyX3qmkwCl0BGOxXtzHlkzKpQrG93D2:GcdLA6cXnezqPnW+wClWGezFkzKptK
TLSH
T1ED052358A841088AE5F7A9F2100F16221F992C864F9F0DD3AE64E7285F153CBD73DB67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 940KB
SHA256 763d0f7c5299bce1a34303ec7a3bf3a049f7136efc41143620efcf391d49b13d
MD5 737b8ba784373ffa3972a298f83f3f9b
SHA1 20b0ec0473ffa1e23a617b387975ccc8398cf1ed
SHA512 81ff3cf2e03ffda3f184a2e2fa0216b03deb2c838af5ad6a3ea958539d5aa1e8556915586caaa3b515433d968a7a01c836cd43778c90a404e774b500b57e2994
SSDEEP 24576:46UqjpvGdLA6cXnezqPnW+wClWGezFkzKptK:46UlduXQssClWGzKK
TLSH
T13525235C648018D9E0BA5670941B42364AB53C620BBA4DEF76D4D73D8F32BC5D63EF22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vssvc.exe

Path C:\Windows\system32\vssvc.exe
Size 2.2MB
SHA256 53a88d80ecdde9cfdbe77f803b384d0bafea7a0eabf6c49509b34a3cd73ef4d5
MD5 260c7170169bc27623fcc22dacaea9ab
SHA1 5f1ccc7282a810f4c6d771f7f2905482c5268818
SHA512 6c1c2e62c96ff7b12075b2a02fba6a450d6055ca9745dea0d1a1b891a4487d85f19d196c9149fb7c1b7db42e32127be9db91c0fb54c883b77b517c9834fa35e8
SSDEEP 24576:sCLHGL0MoeVtFumTijCmlKQWDkmdLA6cXnezqPnW+wClWGezFkzKptK:sCLHGeeV5ijCmlDWDkmduXQssClWGzKK
TLSH
T1A9A57C05A7EB4184E8F3CAF5CA2694169E327C549B34F7DF4E80CA6A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\system32\wbem\WmiApSrv.exe
Size 964KB
SHA256 8f077d73c0a2f6d81d4ac081d387d719f1b516f2a5848e827da2b55143b8f719
MD5 96ddb7663419f1c9453fe9fc9e527047
SHA1 e905265a286028e9df5a4d04ca9230445371b4a9
SHA512 7c615421d59bb1db0ae649a5b137b81d772f52bd8836965d0cdece0aee2d1cfe45ec5a5ac33441cfb1cc30dbb5aafdc35062e3a3f769dcb6b2296790a3cfcf54
SSDEEP 24576:+rcmRGdLA6cXnezqPnW+wClWGezFkzKptK:IcmRGduXQssClWGzKK
TLSH
T13125015EB66A00E6E1B7C17C88064616EBB3347117524BDF46A0C73D4F276DABE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\system32\wbengine.exe
Size 2.2MB
SHA256 9b0648d445afb977dd5c249e6fb538bdf096b96993d475dfd09d5c9fdc95bdf2
MD5 e2242c9e6cb0c5483ed4d87cc68da84d
SHA1 3507ea9e2454e951e7730a80c0d103f28d7fdf98
SHA512 4dd9e08b5695d55f446bfb95de46c75af57b8a1b28621f5ecb1d9dd3d48fb6a89239d3237306df5c4c8e2f02a1d660e2890b2d86d25b2487765aab539bc57dc7
SSDEEP 49152:VDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3hduXQssClWGzKK:23Upow8sBPXQssClWCp
TLSH
T1BAB59D3DA2E800A8D9AAC379C5421366EA71782D3F3015DB0174C578BF1BEF19A39F56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/264-83-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/264-89-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/264-81-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/264-263-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1636-344-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1636-110-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1636-109-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1636-327-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1636-116-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1636-342-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2044-358-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2044-98-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2044-104-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2044-97-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2044-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2044-360-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2796-341-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2796-122-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2796-130-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2796-124-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/2964-357-0x00000226DA410000-0x00000226DA69B000-memory.dmp

Download

memory/3320-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3320-149-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3320-140-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/3320-145-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/3320-147-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/4104-15-0x0000000002B80000-0x0000000002C4C000-memory.dmp

Download

memory/4104-0-0x0000000000400000-0x00000000005C9000-memory.dmp

Download

memory/4104-80-0x0000000000400000-0x00000000005C9000-memory.dmp

Download

memory/4104-16-0x0000000002DD0000-0x0000000002E55000-memory.dmp

Download

memory/4104-1-0x0000000002450000-0x00000000024B7000-memory.dmp

Download

memory/4104-8-0x0000000002DD0000-0x0000000002E55000-memory.dmp

Download

memory/4104-14-0x0000000002450000-0x00000000024B7000-memory.dmp

Download

memory/4112-43-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4112-134-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4112-36-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4112-42-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4112-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4368-93-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4368-309-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4596-60-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4596-58-0x0000000001A20000-0x0000000001A80000-memory.dmp

Download

memory/4596-54-0x0000000001A20000-0x0000000001A80000-memory.dmp

Download

memory/4596-47-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4596-48-0x0000000001A20000-0x0000000001A80000-memory.dmp

Download

memory/4656-207-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4656-62-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4656-63-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4656-69-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4720-96-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4720-30-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/4720-22-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/4720-28-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4720-29-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/4972-348-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4972-160-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4972-161-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4972-167-0x0000000000620000-0x0000000000680000-memory.dmp

Download